Please backport the following mainline commits to the stable trees.

Reason: the ocelot, ksz and sja1105 DSA taggers dereference
eth_hdr(skb)/skb_mac_header(skb) on their TX paths. skb->mac_header is
not set on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path
(packet_direct_xmit() -> netdev_start_xmit(), which bypasses the
dev_hard_start_xmit() reset from 6d1ccff62780), so eth_hdr(skb) resolves
~64 KB out of bounds -> out-of-bounds read. The fixes below make these
taggers read the header from skb->data instead. Reproducible with an
unmodified CONFIG_NET_DSA_LOOP=y kernel by sending on a raw packet
socket with PACKET_QDISC_BYPASS set.

These commits went into v6.4 without a Cc: stable tag because they were
made as preparation for reverting 6d1ccff62780 and the bug was assumed
to be future-only; it is not -- the bypass path was always unaffected by
that reset. 6.6.y and 6.12.y already carry them.

Prerequisite (helper, not a fix on its own; needed or the ocelot and
sja1105 fixes will not build on pre-v6.4 trees):

  1f5020acb33f ("net: vlan: introduce skb_vlan_eth_hdr()")

Fixes, in mainline order:

  eabb1494c9f2 ("net: dsa: tag_ocelot: do not rely on skb_mac_header() for VLAN xmit")
  499b2491d550 ("net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths")
  f9346f00b5af ("net: dsa: tag_sja1105: don't rely on skb_mac_header() in TX paths")
  0bcf2e4aca6c ("net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX")

Not all fixes apply to all trees (the vulnerable code was introduced at
different times). Per tree:

  6.1.y:  1f5020acb33f, eabb1494c9f2, 499b2491d550, f9346f00b5af, 0bcf2e4aca6c
  5.15.y: 1f5020acb33f, 499b2491d550, f9346f00b5af
          (tag_ocelot has no ocelot_xmit_get_vlan_info() before v5.16)
  5.10.y: 499b2491d550
          (sja1105_pvid_tag_control_pkt() is v5.15+; ocelot is v5.16+;
           skb_eth_hdr() already present, so no prerequisite needed)

Ordering: apply 1f5020acb33f before eabb1494c9f2/f9346f00b5af, and
eabb1494c9f2 before 0bcf2e4aca6c.

5.4.y is EOL and also lacks skb_eth_hdr(); not requested.

Thanks,
Doruk Ozturk