[PATCH] net: wan: lapbether: validate frame length and headroom in lapbeth_rcv() and xmit

[Hui Peng]

In drivers/net/wan/lapbether.c, call pskb_may_pull() before reading the
2-byte length prefix in lapbeth_rcv() and ensure sufficient headroom in
lapbeth_data_transmit().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index c3630a82913b..3838910ea7bd 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -133,11 +133,13 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev,
 		goto drop_unlock;
 
 	len = skb->data[0] + skb->data[1] * 256;
-	dev->stats.rx_packets++;
-	dev->stats.rx_bytes += len;
 
 	skb_pull(skb, 2);	/* Remove the length bytes */
-	skb_trim(skb, len);	/* Set the length of the data */
+	if (pskb_trim_rcsum(skb, len))
+		goto drop_unlock;
+
+	dev->stats.rx_packets++;
+	dev->stats.rx_bytes += len;
 
 	err = lapb_data_received(lapbeth->axdev, skb);
 	if (err != LAPB_OK) {