Re: [PATCH net v2 0/1] llc: reserve device headroom for allocated frames

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 24 Sep 2026 09:26:04 +0800 you wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> Hi Linux kernel maintainers,
> 
> We found and validated an issue in net/llc/llc_sap.c.
> 
> llc_mac_hdr_init() invokes the selected Ethernet device's header_ops
> without verifying that the skb has enough headroom for the device's actual
> link-layer header. LLC2 response paths allocate frames through
> llc_alloc_frame(), which reserves only ETH_HLEN bytes for every
> ARPHRD_ETHER device. On a non-offloaded VLAN device, vlan_dev_hard_header()
> instead pushes a four-byte VLAN header followed by the lower device's
> Ethernet header. After the LLC header consumes its reservation, the
> Ethernet push crosses skb->head and invokes skb_under_panic(). With
> CONFIG_LLC2 enabled, a remote layer-2 peer can send a NULL-DSAP XID or TEST
> command through such a VLAN and make the automatic station response crash
> the kernel.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/1] llc: reserve device headroom for allocated frames
    https://git.kernel.org/netdev/net/c/72b5b9a28b99

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html