Re: [PATCH] net: rose: use pskb_may_pull() in CLEAR_REQUEST length check

[Andrew Lunn <andrew@lunn.ch>]

On Mon, Apr 20, 2026 at 01:57:23AM +0000, Ashutosh Desai wrote:
> Commit 2835750dd647 ("net: rose: reject truncated CLEAR_REQUEST frames
> in state machines") guards against short CLEAR_REQUEST frames using a
> plain skb->len comparison. Use pskb_may_pull() instead, which both
> enforces the length requirement and ensures the bytes are in the linear
> part of the skb, making the subsequent accesses to skb->data[3] and
> skb->data[4] safe for non-linear buffers.

Did you review all the other comparisons on skb->len in rose?

rose_route.c-	if (frametype == ROSE_CALL_REQUEST &&
rose_route.c:	    (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
rose_route.c-	     skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
rose_route.c-	     ROSE_CALL_REQ_ADDR_LEN_VAL))

rose_loopback.c-		if (frametype == ROSE_CALL_REQUEST &&
rose_loopback.c:		    (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
rose_loopback.c-		     skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=

Do these need the same fix? Are there other places non linear buffers
should be considered?

       Andrew