Kernel VLAN fix stops skb panics when toggling HW offload

Eric Dumazet has posted a fix for Linux kernel VLAN devices that could panic with skb_under_panic when hardware VLAN TX offload was toggled on the underlying interface.

Turning NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX on or off caused the VLAN device to rewrite hard_header_len under RTNL. Lockless transmit paths, including AF_PACKET and IPv6 output, read that field without the lock. A stale value left packets with too little headroom, so software VLAN header insertion could underflow the skbuff. Feature transfer also adjusted hard_header_len without keeping header_ops in sync, so reserved space and header creation disagreed.

The change stops mutating hard_header_len at runtime. It stays fixed to the lower device’s value, and the extra VLAN tag length is accounted in needed_headroom instead, so upper layers always reserve enough room and AF_PACKET raw offsets stay aligned. The bug dates to the early 2.6 era. Tangxin Xie reported it.

While testing a backport, Xie hit a similar panic with macvlan stacked on a VLAN device: macvlan does not pick up the VLAN’s needed_headroom, so headers again overflow the reserved space. That layering case remains a separate follow-on.