[PATCH] net: rose: use pskb_may_pull() in CLEAR_REQUEST length check

[Ashutosh Desai]

Commit 2835750dd647 ("net: rose: reject truncated CLEAR_REQUEST frames
in state machines") guards against short CLEAR_REQUEST frames using a
plain skb->len comparison. Use pskb_may_pull() instead, which both
enforces the length requirement and ensures the bytes are in the linear
part of the skb, making the subsequent accesses to skb->data[3] and
skb->data[4] safe for non-linear buffers.

Suggested-by: Simon Horman <horms@xxxxxxxxxx>
Signed-off-by: Ashutosh Desai <ashutoshdesai993@xxxxxxxxx>
---
 net/rose/rose_in.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rose/rose_in.c b/net/rose/rose_in.c
index ca4f217ef3d3..48183363d3f9 100644
--- a/net/rose/rose_in.c
+++ b/net/rose/rose_in.c
@@ -274,7 +274,7 @@ int rose_process_rx_frame(struct sock *sk, struct sk_buff *skb)
 	 * ROSE_CLEAR_REQUEST carries cause and diagnostic in bytes 3..4.
 	 * Reject a malformed frame that is too short to contain them.
 	 */
-	if (frametype == ROSE_CLEAR_REQUEST && skb->len < 5)
+	if (frametype == ROSE_CLEAR_REQUEST && !pskb_may_pull(skb, 5))
 		return 0;
 
 	switch (rose->state) {
-- 
2.34.1