On Mon, 18 May 2026 15:27:18 +0200 Robin Jarry <[email protected]> wrote:
> rte_net_get_ptype stops at the MPLS layer and never identifies the L3 > protocol of the payload. Also, the label parsing uses a fixed maximum of > 5 headers instead of checking the bottom of stack bit. > > Use the bottom of stack bit to consume all labels and inspect the first > nibble of the payload to determine if it is IPv4 or IPv6. > > Add test cases to verify this works. Ensure that an unknown protocol > after MPLS (e.g. ARP) does not produce a bogus L3 type. > > Signed-off-by: Robin Jarry <[email protected]> > --- AI spotted similar potential uint8_t overflow here. Patch 4/5: net: parse L3 protocol after MPLS labels Warning: same uint8_t l2_len concern as patch 2. The old loop was capped at MAX_MPLS_HDR (5); the new "do { } while (!mh->bs)" is bounded only by packet length, so a deep label stack wraps l2_len. Info: the local is named "nimble" (and the read into nimble_copy); the comment says "first 4 bits", i.e. the nibble. Likely meant "nibble".
