Re: [PATCH] ppp: make room for the filter tag instead of assuming it

[Qingfang Deng <qingfang.deng@linux.dev>]

Hi,

Please avoid sending patches with Gmail Web, as it replaces tabs with 
spaces.

On 2026/9/2 14:22, Vlatko Kosturjak wrote:
> ppp_receive_nonmp_frame() prepends a two-byte direction tag before running
> the pass/active BPF filters:
>
>          *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);
>
> Nothing on the receive path guarantees those two bytes of headroom, and a
> peer can arrange for only one to be available. ppp_async.c contributes two
> halves of the problem.
>
> First, the frame-error path resets a reused skb's headroom to zero while
> claiming to restore it to a freshly allocated state - but a fresh skb from
> dev_alloc_skb() carries NET_SKB_PAD:
>
>          err:
>                  if (skb) {
>                          /* make skb appear as freshly allocated */
>                          skb_trim(skb, 0);
>                          skb_reserve(skb, - skb_headroom(skb));
>                  }

I agree with Eric. Dropping the skb on error is cleaner and easier.

But I think the Fixes tag should reference the commit that introduced 
the skb_reserve() call:

6722e78c9005 ("[PPP]: handle misaligned accesses")

instead of 2.6.12-rc2.


Kind regards,