AZL-99629

In the Linux kernel, the following vulnerability has been resolved:

net: tap: fix wrong transport_header when sending VLAN-tagged frame

In tapgetuserxdp(), when processing a VLAN-tagged frame (e.g. ETHP8021Q), skbsetnetworkheader() is called first to advance networkheader past the VLAN tag to the inner protocol header. skbprobetransportheader() is then called with skb->protocol still set to ETHP8021Q, while nhoff (derived from skbnetworkoffset()) already points past the VLAN tag to the inner protocol header.

In __skbflowdissect(), proto is initialized to ETH_P8021Q and nhoff points past the VLAN tag. When the dissector hits case ETHP8021Q, it reads a struct vlanhdr at the current nhoff via _skbheaderpointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skbprobetransportheader() never calls skbsettransportheader(), leaving transportheader at its uninitialized sentinel value (~0U).

Move skbsetnetworkheader() to after skbprobetransportheader(). At the time skbprobetransportheader() is called, networkheader still points to the VLAN header (offset ETHHLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transportheader to be set correctly.