[PATCH net] net: parse the eighth nested VLAN tag

[Avi Weiss <thnkslprpt@gmail.com>]

__vlan_get_protocol_offset() starts with VLAN_MAX_DEPTH (8) but
pre-decrements parse_depth before checking it. This rejects the eighth
VLAN header and returns protocol 0 instead of the encapsulated EtherType.

Check the counter before decrementing it, allowing eight nested tags
while continuing to reject a ninth. A compiled source-extracted test of
the helper and its public inline wrapper reproduces the incorrect result
for eight tags and verifies the corrected result. Seven-tag, nine-tag,
and truncated-header controls are unchanged.

Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 net/core/skbuff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..b10ce1d46674 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -7703,7 +7703,7 @@ struct vlan_type_depth __vlan_get_protocol_offset(const struct sk_buff *skb,
 
 		vh = skb_header_pointer(skb, mac_offset + vlan_depth,
 					sizeof(vhdr), &vhdr);
-		if (unlikely(!vh || !--parse_depth))
+		if (unlikely(!vh || !parse_depth--))
 			return (struct vlan_type_depth) { 0 };
 
 		type = vh->h_vlan_encapsulated_proto;

base-commit: cb284914e749388eef402938bdb3115fe1f6d337
-- 
2.43.0