Commit cd5dd68267c4 for kernel

commit cd5dd68267c4238795fadaf02b3575ca3f8a6500
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Sep 24 08:29:51 2026 +0000

    vlan: ensure sufficient headroom in vlan_dev_hard_header()

    Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),
    or skbs allocated before dynamic device/headroom changes (e.g. toggling
    VLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach
    vlan_dev_hard_header() with insufficient headroom and trigger
    skb_under_panic().

    Use skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR
    is not set to ensure sufficient headroom for the VLAN header(s) and the
    underlying device hard header.

    Use READ_ONCE() to read dev->hard_header_len and dev->needed_headroom as
    they can be updated concurrently under RTNL (e.g. in
    vlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on
    the transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the
    extra HH_DATA_MOD alignment padding does not trigger unnecessary
    pskb_expand_head() reallocations on inner stacked VLAN devices after the
    outer VLAN header has been pushed.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Zixuan Chai <petalzu987@gmail.com>
    Closes: https://lore.kernel.org/netdev/cover.1789987105.git.petalzu987@gmail.com/
    Link: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/
    Cc: Hangbin Liu <liuhangbin@gmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260924082951.1599377-5-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 2859cbac3f26..c949c6a82945 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -55,6 +55,11 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
 	int rc;

 	if (!(vlan->flags & VLAN_FLAG_REORDER_HDR)) {
+		unsigned int hlen = READ_ONCE(dev->hard_header_len) +
+				    READ_ONCE(dev->needed_headroom);
+
+		if (skb_cow_head(skb, hlen) < 0)
+			return -ENOMEM;
 		vhdr = skb_push(skb, VLAN_HLEN);

 		vlan_tci = vlan->vlan_id;