Re: [PATCH net] vlan: ensure sufficient headroom in vlan_dev_hard_header()

[Hangbin Liu <hangbin.liu@linux.dev>]

Hi Eric,
On Tue, Sep 22, 2026 at 11:39:24AM +0000, Eric Dumazet wrote:
> Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame() or
> br_send_bpdu()), or skbs allocated before dynamic device/headroom
> changes (e.g. toggling VLAN_FLAG_REORDER_HDR or bonding/team switching
> slaves), can reach vlan_dev_hard_header() with insufficient headroom and
> trigger skb_under_panic().
> 
> Use skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR
> is not set to ensure sufficient headroom for the VLAN header(s) and the
> underlying device hard header.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Zixuan Chai <petalzu987@gmail.com>
> Closes: https://lore.kernel.org/netdev/cover.1789987105.git.petalzu987@gmail.com/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/8021q/vlan_dev.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
> index 2859cbac3f266b7c4e3f44f41280d33ab69c5270..3598ad0779f050d25c6110de476fe9613137f983 100644
> --- a/net/8021q/vlan_dev.c
> +++ b/net/8021q/vlan_dev.c
> @@ -55,6 +55,9 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
>  	int rc;
>  
>  	if (!(vlan->flags & VLAN_FLAG_REORDER_HDR)) {
> +		if (skb_cow_head(skb,
> +				 dev->hard_header_len + dev->needed_headroom) < 0)

Should we use LL_RESERVED_SPACE() here?

Thanks
Hangbin
> +			return -ENOMEM;
>  		vhdr = skb_push(skb, VLAN_HLEN);
>  
>  		vlan_tci = vlan->vlan_id;
> -- 
> 2.55.0.1082.g2b9226bbc0-goog
>