[PATCH] net: wan: lapbether: validate frame length and headroom in lapbeth_rcv() and xmit
From: Hui Peng <hidden>
Date: 2026-09-19 22:34:34
Also in:
lkml
Subsystem:
networking drivers, the rest, x.25 stack · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Martin Schiller
In drivers/net/wan/lapbether.c, call pskb_may_pull() before reading the
2-byte length prefix in lapbeth_rcv() and ensure sufficient headroom in
lapbeth_data_transmit().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index c3630a82913b..3838910ea7bd 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c@@ -133,11 +133,13 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, goto drop_unlock; len = skb->data[0] + skb->data[1] * 256; - dev->stats.rx_packets++; - dev->stats.rx_bytes += len; skb_pull(skb, 2); /* Remove the length bytes */ - skb_trim(skb, len); /* Set the length of the data */ + if (pskb_trim_rcsum(skb, len)) + goto drop_unlock; + + dev->stats.rx_packets++; + dev->stats.rx_bytes += len; err = lapb_data_received(lapbeth->axdev, skb); if (err != LAPB_OK) {