[PATCH net v2] net: parse the eighth nested VLAN tag

[Avi Weiss <thnkslprpt@gmail.com>]

__vlan_get_protocol_offset() starts with VLAN_MAX_DEPTH (8) but
pre-decrements parse_depth before checking it. This rejects the eighth
VLAN header and returns protocol 0 instead of the encapsulated EtherType.

When skb->mac_len is ETH_HLEN, the first iteration rereads the outer
EtherType, so eight VLAN tags require nine iterations. Check the counter
before decrementing it and allow one extra iteration in this case.

Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
v2:
  - account for the extra iteration when mac_len is ETH_HLEN
  - validated the 7/8/9-tag cases with mac_len 0, 14 and 18
v1: https://lists.openwall.net/netdev/2026/10/31/78

 net/core/skbuff.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..8eb5cf532d00 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -7687,6 +7687,9 @@ struct vlan_type_depth __vlan_get_protocol_offset(const struct sk_buff *skb,
 {
 	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
 
+	if (vlan_depth == ETH_HLEN)
+		parse_depth++;
+
 	/* if type is 802.1Q/AD then the header should already be
 	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
 	 * ETH_HLEN otherwise
@@ -7703,7 +7706,7 @@ struct vlan_type_depth __vlan_get_protocol_offset(const struct sk_buff *skb,
 
 		vh = skb_header_pointer(skb, mac_offset + vlan_depth,
 					sizeof(vhdr), &vhdr);
-		if (unlikely(!vh || !--parse_depth))
+		if (unlikely(!vh || !parse_depth--))
 			return (struct vlan_type_depth) { 0 };
 
 		type = vh->h_vlan_encapsulated_proto;

base-commit: cb284914e749388eef402938bdb3115fe1f6d337
-- 
2.43.0