Re: [PATCH net v2] ppp_async: drop the errored frame instead of resetting its headroom

[Eric Dumazet]

On Thu, Sep 3, 2026 at 8:21 AM Vlatko Kosturjak <kost@xxxxxxxx> wrote:
>
> ppp_receive_nonmp_frame() prepends a two-byte direction tag before running
> the pass/active BPF filters:
>
>         *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);
>
> Nothing on the receive path guarantees those two bytes of headroom. The
> frame-error path in ppp_async's process_input_packet() resets a reused skb's
> headroom to zero while claiming to restore it to a freshly allocated state -
> but a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:
>

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>