Commit 7683df331d29 for kernel

commit 7683df331d296819a8f596dd752bbf95aa2e3478
Merge: bf83b257423b 73e08d50eb13
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Thu Nov 12 10:38:03 2026 -0800

    Merge branch 'net-virtio-validate-outer-protocol-of-udp-tunnel-gso-packets'

    Eric Dumazet says:

    ====================
    net: virtio: validate outer protocol of UDP tunnel GSO packets

    virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO
    packet really has outer IPv4/IPv6 and UDP headers matching the
    declared tunnel type. A guest, or any tap writer, can send a frame
    with another outer ethertype (NSH in the report), and the GSO stack
    then builds segments with skb->data before skb->head. The host
    crashes in skb_under_panic() as soon as a header is pushed.

    Patch 1 fixes the producer side, virtio_net_hdr_tnl_from_skb(), for
    VLAN tagged packets:
    - the tunnel offsets did not account for the VLAN tag tun inserts in
      the frame, and were 4 bytes short.
    - the outer family came from skb->protocol, which is the VLAN protocol
      when the tag is in the packet data, so an outer IPv6 header was
      reported as IPv4.
    Without it, patch 3 would drop such packets. Kernels without this fix
    still send such headers, so it should go to stable along with patch 3.

    Patch 2 clears a stale skb->protocol left on recycled NAPI frags skbs,
    which could make the checks of patch 3 reject valid frames.

    Patch 3 validates the outer headers, using the parsing helpers from
    Michael's series "net: resolve uncommon partial checksums at ingress",
    as Willem suggested. The callers tell whether frames start with an
    Ethernet header, as the device type of a tun device can be changed
    with TUNSETLINK. The rest of Michael's series (checksum validation and
    completion) is left to him.

    The selftests of v3 will follow in a separate series, with the fixes
    Sashiko found in them.
    ====================

    Link: https://patch.msgid.link/20261110213628.3476051-1-edumazet@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>