On Mon, 18 May 2026 15:27:16 +0200 Robin Jarry <[email protected]> wrote:
> The VLAN and QinQ code paths in rte_net_get_ptype handle at most two > tags with duplicated logic. Replace them with a single loop that > consumes all consecutive VLAN/QinQ headers regardless of depth. > > Bugzilla ID: 1941 > Suggested-by: David Marchand <[email protected]> > Signed-off-by: Robin Jarry <[email protected]> Another issue discovered by AI is that hdr_lens->l2_len is too small. Patch 2/5: net: support multiple stacked VLAN tags Warning: hdr_lens->l2_len is uint8_t. The previous code capped the tag count at RTE_NET_VLAN_MAX_DEPTH (8), bounding l2_len to 14 + 8*4 = 46. The new do/while consumes tags until rte_pktmbuf_read() fails, so the only bound is packet length. A frame carrying >=61 stacked VLAN/QINQ tags (>=244 bytes of L2 headers) wraps l2_len around 256. There is no infinite loop or OOB read (off advances monotonically and the read terminates at end of data), but the wrapped l2_len is exactly the kind of bad header-length value this series set out to fix in tap_verify_csum. Consider keeping a depth cap, or widening/saturating l2_len.
