Commit 72b5b9a28b99 for kernel

commit 72b5b9a28b996e09b8b5b944370c79851bb68f52
Author: Zixuan Chai <petalzu987@gmail.com>
Date:   Thu Sep 24 09:26:05 2026 +0800

    llc: reserve device headroom for allocated frames

    llc_alloc_frame() reserves link-layer headroom using the device type.
    This is insufficient for stacked Ethernet devices such as VLAN devices,
    where vlan_dev_hard_header() pushes a VLAN header before the lower
    device's Ethernet header. An LLC response on such a device can
    therefore underflow skb headroom in eth_header().

    Use LL_RESERVED_SPACE() to account for the device's actual required
    headroom while preserving the existing LLC device-type check.

    Fixes: bf9ae5386bca ("llc: use dev_hard_header")
    Cc: stable@vger.kernel.org
    Reported-by: VEGA <vega@nebusec.ai>
    Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
    Signed-off-by: Ren Wei <weir@nebusec.ai>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260924012613.2533934-1-weir@nebusec.ai
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 1bd446a21092..3904a1b4ba84 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -19,12 +19,12 @@
 #include <linux/llc.h>
 #include <linux/slab.h>

-static int llc_mac_header_len(unsigned short devtype)
+static int llc_mac_header_len(struct net_device *dev)
 {
-	switch (devtype) {
+	switch (dev->type) {
 	case ARPHRD_ETHER:
 	case ARPHRD_LOOPBACK:
-		return sizeof(struct ethhdr);
+		return LL_RESERVED_SPACE(dev);
 	}
 	return 0;
 }
@@ -45,7 +45,7 @@ struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev,
 	int hlen = type == LLC_PDU_TYPE_U ? 3 : 4;
 	struct sk_buff *skb;

-	hlen += llc_mac_header_len(dev->type);
+	hlen += llc_mac_header_len(dev);
 	skb = alloc_skb(hlen + data_size, GFP_ATOMIC);

 	if (skb) {