Asim Viladi Oglu Manizada e9c238f6fe pppoe: reload header pointer after dev_hard_header() ... pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-07-23 07:01:53 -07:00
..
bsd_comp.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
Kconfig	TTY / Serial driver update for 7.2-rc1	2026-06-22 11:51:49 -07:00
Makefile	ppp: add PPPOX symbol	2026-04-28 18:31:10 -07:00
ppp_async.c	ppp: simplify input error handling	2026-03-09 19:07:38 -07:00
ppp_deflate.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
ppp_generic.c	ppp: annotate data races in ppp_generic	2026-07-23 07:01:37 -07:00
ppp_mppe.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
ppp_mppe.h
ppp_synctty.c	ppp: simplify input error handling	2026-03-09 19:07:38 -07:00
pppoe.c	pppoe: reload header pointer after dev_hard_header()	2026-07-23 07:01:53 -07:00
pppox.c	pppoe: remove kernel-mode relay support	2026-02-26 11:41:00 +01:00
pptp.c	pppox: remove sk_pppox() helper	2026-04-12 15:20:45 -07:00