Re: [PATCH net v2 0/1] llc: reserve device headroom for allocated frames

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Thu, 24 Sep 2026 09:26:04 +0800 you wrote:

From: Zixuan Chai <redacted>

Hi Linux kernel maintainers,

We found and validated an issue in net/llc/llc_sap.c.

llc_mac_hdr_init() invokes the selected Ethernet device's header_ops
without verifying that the skb has enough headroom for the device's actual
link-layer header. LLC2 response paths allocate frames through
llc_alloc_frame(), which reserves only ETH_HLEN bytes for every
ARPHRD_ETHER device. On a non-offloaded VLAN device, vlan_dev_hard_header()
instead pushes a four-byte VLAN header followed by the lower device's
Ethernet header. After the LLC header consumes its reservation, the
Ethernet push crosses skb->head and invokes skb_under_panic(). With
CONFIG_LLC2 enabled, a remote layer-2 peer can send a NULL-DSAP XID or TEST
command through such a VLAN and make the automatic station response crash
the kernel.

[...]

Here is the summary with links:
  - [net,v2,1/1] llc: reserve device headroom for allocated frames
    https://git.kernel.org/netdev/net/c/72b5b9a28b99

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html