From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A32464446E9; Thu, 30 Jul 2026 15:21:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424915; cv=none; b=WuKNG5z7j09V5EvbjceADqG2qQSo8iwwiZ318Y6eWEnmj1De+Kgey9lomq2AiHafqYNKiMV4iC00am9Dq/QKvkg0m78M5Uj2szJEIvhONblQGSkdfig+YMCpap/EnqAsv09N+NFiIn3Rz9iUcJo3Kj0EyXwLhCKv2tAcMa5KhUg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424915; c=relaxed/simple; bh=tXxoIEQIayA4mNrpDuAvV13vffuFR1vtJokzo34Lv9c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W6x6MOFsnhWxF3g0ldiLzIQlS6ruo2/ZbVF5s7Vk6bCfT5nbKBIrlebZRiyihPXxaPphTsfOzJc8RyJMTcDltlq41khw8GAvLVF+lFns4Xa39pQE0nUtbthKvjPxZpgRxpXsOZo99nvF9TvuOAjS0GPndbsDbc31bIBA+yjaSeo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N0uGvWHj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="N0uGvWHj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B9E41F000E9; Thu, 30 Jul 2026 15:21:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785424914; bh=/uStC4/x4QkO9rUK6SKpkLmxNPldaqxFhBZRonFOWgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=N0uGvWHj9gJnfXxCBY+0vIgjnsWaA3EpKlRtmas3NEClS6sXauWLU/ADD9YYZPHXj 137EzVXXnOpTcxU5A+eeUrUOR1xuwKrjT/J/SgsXZkPYmPCKnzFij+SW+X1bMPur16 1ESGzdvu7UnBrNKdHQ0CDuxwc3IqSQh3Q2hL6Gz8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Asim Viladi Oglu Manizada , Vadim Fedorenko , Eric Dumazet , Jakub Kicinski Subject: [PATCH 6.18 562/675] pppoe: reload header pointer after dev_hard_header() Date: Thu, 30 Jul 2026 16:14:52 +0200 Message-ID: <20260730141457.077870718@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141445.110192266@linuxfoundation.org> References: <20260730141445.110192266@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Asim Viladi Oglu Manizada commit e9c238f6fe42fb1b4dba3a578277de32cb487937 upstream. pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada Reviewed-by: Vadim Fedorenko Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ppp/pppoe.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/ppp/pppoe.c +++ b/drivers/net/ppp/pppoe.c @@ -903,6 +903,7 @@ static int pppoe_sendmsg(struct socket * dev_hard_header(skb, dev, ETH_P_PPP_SES, po->pppoe_pa.remote, NULL, total_len); + ph = pppoe_hdr(skb); memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); ph->length = htons(total_len);