Re: [PATCH dpdk v5 2/5] net: support multiple stacked VLAN tags

[Stephen Hemminger <stephen@networkplumber.org>]

On Mon, 18 May 2026 15:27:16 +0200
Robin Jarry <rjarry@redhat.com> wrote:

> The VLAN and QinQ code paths in rte_net_get_ptype handle at most two
> tags with duplicated logic. Replace them with a single loop that
> consumes all consecutive VLAN/QinQ headers regardless of depth.
> 
> Bugzilla ID: 1941
> Suggested-by: David Marchand <david.marchand@redhat.com>
> Signed-off-by: Robin Jarry <rjarry@redhat.com>

Another issue discovered by AI is that hdr_lens->l2_len is too small.

Patch 2/5: net: support multiple stacked VLAN tags

Warning: hdr_lens->l2_len is uint8_t. The previous code capped the tag
count at RTE_NET_VLAN_MAX_DEPTH (8), bounding l2_len to 14 + 8*4 = 46.
The new do/while consumes tags until rte_pktmbuf_read() fails, so the
only bound is packet length. A frame carrying >=61 stacked VLAN/QINQ
tags (>=244 bytes of L2 headers) wraps l2_len around 256. There is no
infinite loop or OOB read (off advances monotonically and the read
terminates at end of data), but the wrapped l2_len is exactly the kind
of bad header-length value this series set out to fix in tap_verify_csum.
Consider keeping a depth cap, or widening/saturating l2_len.