ppp_async: drop the errored frame instead of resetting its headroom

Please backport commit 8dc5d98a16fa ("ppp_async: drop the errored frame instead of resetting its headroom") to the currently supported stable kernels.

This fixes a remotely triggerable kernel panic/DoS in the PPP async receive path. On an errored frame, ppp_async currently reuses the skb after resetting its headroom. A subsequent frame can then cause the skb data pointer to be moved before the skb head, resulting in an skb_under_panic. CCP decompression can also access memory before the skb head.

The fix drops the errored skb and clears ap->rpkt instead of attempting to reuse it.

The fix applies cleanly to the relevant stable branches.

Upstream commit: 8dc5d98a16fa ("ppp_async: drop the errored frame instead of resetting its headroom")

Vlatko Kosturjak

Queued for 7.2, 6.18, 6.12, 6.6, 6.1, 5.15 and 5.10, thanks.

Thanks,
Sasha