Re: [PATCH net] ppp_synctty: ensure a writeable skb header

[Eric Dumazet]

On Tue, Sep 8, 2026 at 9:21 AM Qingfang Deng <qingfang.deng@xxxxxxxxx> wrote:
>
> ppp_sync_txmunge() checks headroom before prepending the address and
> control bytes, but does not ensure that the skb header is writable.
> A received skb can reach this function through PPP channel bridging
> without passing through ppp_start_xmit(), which calls skb_cow_head().
>
> For example, a PPPoE frame may share its buffer with a clone queued to
> an AF_PACKET socket. If it is bridged to a synchronous tty channel, the
> address/control bytes can overwrite data still visible to that socket.
>
> Use skb_cow_head() to ensure both sufficient headroom and a writable
> header.
>
> Fixes: 4cf476ced45d ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
> Signed-off-by: Qingfang Deng <qingfang.deng@xxxxxxxxx>

SGTM. I will fix pppoatm_send() in net/atm/pppoatm.c which has a similar bug.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>