[PATCH v2 net 0/4] vlan: ensure sufficient headroom in vlan_dev_hard_header()

[Eric Dumazet <edumazet@google.com>]

Callers that only reserve ETH_HLEN or less, or skbs allocated before
dynamic device/headroom changes (such as toggling VLAN_FLAG_REORDER_HDR
or bonding/team switching slaves), can reach vlan_dev_hard_header() with
insufficient headroom and trigger skb_under_panic().

When vlan_dev_hard_header() returns -ENOMEM upon skb_cow_head() failure,
a few callers of dev_hard_header() / llc_mac_hdr_init() had pre-existing
error-handling bugs:

- Patch 1 fixes a UAF/double-free of skb and leak of nskb in
  llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), as well as nskb leaks in
  llc_sap_action_send_xid_r() and llc_sap_action_send_test_r() when
  llc_mac_hdr_init() fails.
- Patch 2 checks the return value of llc_mac_hdr_init() in br_send_bpdu()
  and frees the skb on error.
- Patch 3 removes a shadowed 'int err;' variable in __teql_resolve() so
  negative errors from dev_hard_header() are properly returned as -EINVAL.
- Patch 4 uses skb_cow_head() in vlan_dev_hard_header() when
  VLAN_FLAG_REORDER_HDR is not set to ensure sufficient headroom for the
  VLAN header(s) and the underlying device hard header.

v2:
 - Add patches 1-3 to fix pre-existing error handling in llc, bridge, and
   sch_teql when dev_hard_header() fails (Sashiko).
 - Use READ_ONCE() when reading dev->hard_header_len and
   dev->needed_headroom in vlan_dev_hard_header(), and explain why
   LL_RESERVED_SPACE(dev) is not used here (Hangbin Liu, Sashiko).
 - Link to v1: https://lore.kernel.org/netdev/20260922113924.3165190-1-edumazet@google.com/

Eric Dumazet (4):
  llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
  bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
  net/sched: sch_teql: fix shadowed err in __teql_resolve()
  vlan: ensure sufficient headroom in vlan_dev_hard_header()

 net/8021q/vlan_dev.c     | 5 +++++
 net/bridge/br_stp_bpdu.c | 5 ++++-
 net/llc/llc_c_ac.c       | 2 +-
 net/llc/llc_s_ac.c       | 4 ++++
 net/sched/sch_teql.c     | 7 ++-----
 5 files changed, 16 insertions(+), 7 deletions(-)

-- 
2.56.0.rc1.310.g51773c2048-goog