[PATCH net] ipvlan: inherit needed_headroom from phy_dev

[Eric Dumazet <edumazet@google.com>]

ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),
but leave needed_headroom set to 0.

When the underlying phy_dev (or stacked lower device) requires extra headroom
for headers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom),
upper layers calculating packet headroom via LL_RESERVED_SPACE(dev) fail to
reserve sufficient headroom.

This can result in reallocation failures, skb headroom underflows, or KASAN
slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()
prepends header data.

Fix this by:
1. Inheriting needed_headroom from phy_dev in ipvlan_init().
2. Propagating needed_headroom updates to attached ipvlans in
   ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.

Note that a similar issue exists in macvlan and will be handled in another
patch.

Fixes: 2ad7bfab3016 ("ipvlan: Initial check-in of the IPVLAN driver.")
Reported-by: syzbot+1f9fd0f4b601cf88d6e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/T/#u
Reported-by: Tangxin Xie <xietangxin@h-partners.com>
Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5Wj+4x0sw@mail.gmail.com/T/#mcc6307f115e500df23ea2980d5669fe95f20b6b4
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 drivers/net/ipvlan/ipvlan_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index ed46439a9f4eb1dd8bfaf6c83476ba4f2aff31bc..7513c005a5121676d3f8edb0898492ad434a9fab 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -146,6 +146,7 @@ static int ipvlan_init(struct net_device *dev)
 	dev->lltx = true;
 	netif_inherit_tso_max(dev, phy_dev);
 	dev->hard_header_len = phy_dev->hard_header_len;
+	dev->needed_headroom = phy_dev->needed_headroom;
 
 	netdev_lockdep_set_classes(dev);
 
@@ -773,6 +774,7 @@ static int ipvlan_device_event(struct notifier_block *unused,
 	case NETDEV_FEAT_CHANGE:
 		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
 			netif_inherit_tso_max(ipvlan->dev, dev);
+			ipvlan->dev->needed_headroom = dev->needed_headroom;
 			netdev_update_features(ipvlan->dev);
 		}
 		break;
-- 
2.55.0.571.g244d577d93-goog