ax25_rcv() calls skb_pull(skb, ax25_addr_size(&dp)) to strip the address header, then reads skb->data[0] (control byte) and skb->data[1] (PID byte) without verifying those bytes are in the linear sk_buff area. The original fix checked skb->len < 2, but as Eric Dumazet pointed out, skb->len counts bytes across the linear head and any non-linear fragments. If the two bytes needed sit in a fragment, the check passes but the direct skb->data access is still out of bounds. Use pskb_may_pull(skb, 2) instead, which ensures both bytes are present and pulls them into the linear area if needed before we read them. Suggested-by: Eric Dumazet Signed-off-by: Ashutosh Desai --- net/ax25/ax25_in.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c index d75b3e9ed..6a71dea87 100644 --- a/net/ax25/ax25_in.c +++ b/net/ax25/ax25_in.c @@ -217,6 +217,11 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev, */ skb_pull(skb, ax25_addr_size(&dp)); + if (!pskb_may_pull(skb, 2)) { + kfree_skb(skb); + return 0; + } + /* For our port addresses ? */ if (ax25cmp(&dest, dev_addr) == 0 && dp.lastrepeat + 1 == dp.ndigi) mine = 1; -- 2.34.1