UPSTREAM: wireguard: device: do not generate ICMP for non-IP packets

If skb->protocol doesn't match the actual skb->data header, it's
probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
expecting to reply to a valid IP packet. So this commit has that early
mismatch case jump to a later error label.

Bug: 254441685
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 99fff5264e7ab06f45b0ad60243475be0a8d0559)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Id4ecf76fbe0b144ad5157be15ff085d499eb8102