Re: [PATCH net] netrom: validate header lengths in nr_rx_frame() using pskb_may_pull()

NET/ROM nr_rx_frame() dereferences the 5-byte transport header
unconditionally. nr_route_frame() currently accepts frames as short as
NR_NETWORK_LEN (15 bytes), which can lead to small out-of-bounds reads
on short frames.

Fix by using pskb_may_pull() in nr_rx_frame() to ensure the full
NET/ROM network + transport header is present before accessing it, and
guard the extra fields used by NR_CONNREQ (window, user address, and the
optional BPQ timeout extension) with additional pskb_may_pull() checks.

This aligns with recent fixes using pskb_may_pull() to validate header
availability.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Stanislav Fort <redacted>
Cc: stable@vger.kernel.org
Signed-off-by: Stanislav Fort <redacted>
---
 net/netrom/af_netrom.c | 12 +++++++++++-
 net/netrom/nr_route.c  |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 3331669d8e33..1fbaa161288a 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c

@@ -885,6 +885,10 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
         *      skb->data points to the netrom frame start
         */

+       /* Ensure NET/ROM network + transport header are present */
+       if (!pskb_may_pull(skb, NR_NETWORK_LEN + NR_TRANSPORT_LEN))
+               return 0;
+
        src  = (ax25_address *)(skb->data + 0);
        dest = (ax25_address *)(skb->data + 7);

@@ -961,6 +965,12 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
                return 0;
        }

+       /* Ensure NR_CONNREQ fields (window + user address) are present */
+       if (!pskb_may_pull(skb, 21 + AX25_ADDR_LEN)) {