Re: [PATCH net] ppp_synctty: ensure a writeable skb header

On Tue, Sep 8, 2026 at 9:21 AM Qingfang Deng [off-list ref] wrote:

ppp_sync_txmunge() checks headroom before prepending the address and
control bytes, but does not ensure that the skb header is writable.
A received skb can reach this function through PPP channel bridging
without passing through ppp_start_xmit(), which calls skb_cow_head().

For example, a PPPoE frame may share its buffer with a clone queued to
an AF_PACKET socket. If it is bridged to a synchronous tty channel, the
address/control bytes can overwrite data still visible to that socket.

Use skb_cow_head() to ensure both sufficient headroom and a writable
header.

Fixes: 4cf476ced45d ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
Signed-off-by: Qingfang Deng <redacted>

SGTM. I will fix pppoatm_send() in net/atm/pppoatm.c which has a similar bug.

Reviewed-by: Eric Dumazet <edumazet@google.com>