[PATCH net v2] net: parse the eighth nested VLAN tag

[PATCH net v2] net: parse the eighth nested VLAN tag

[Avi Weiss]

__vlan_get_protocol_offset() starts with VLAN_MAX_DEPTH (8) but
pre-decrements parse_depth before checking it. This rejects the eighth
VLAN header and returns protocol 0 instead of the encapsulated EtherType.

When skb->mac_len is ETH_HLEN, the first iteration rereads the outer
EtherType, so eight VLAN tags require nine iterations. Check the counter
before decrementing it and allow one extra iteration in this case.

Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
v2:
  - account for the extra iteration when mac_len is ETH_HLEN
  - validated the 7/8/9-tag cases with mac_len 0, 14 and 18
v1: https://lists.openwall.net/netdev/2026/10/31/78

 net/core/skbuff.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..8eb5cf532d00 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -7687,6 +7687,9 @@ struct vlan_type_depth __vlan_get_protocol_offset(const struct sk_buff *skb,
 {
 	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
 
+	if (vlan_depth == ETH_HLEN)
+		parse_depth++;
+
 	/* if type is 802.1Q/AD then the header should already be
 	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
 	 * ETH_HLEN otherwise
@@ -7703,7 +7706,7 @@ struct vlan_type_depth __vlan_get_protocol_offset(const struct sk_buff *skb,
 
 		vh = skb_header_pointer(skb, mac_offset + vlan_depth,
 					sizeof(vhdr), &vhdr);
-		if (unlikely(!vh || !--parse_depth))
+		if (unlikely(!vh || !parse_depth--))
 			return (struct vlan_type_depth) { 0 };
 
 		type = vh->h_vlan_encapsulated_proto;

base-commit: cb284914e749388eef402938bdb3115fe1f6d337
-- 
2.43.0

Re: [PATCH net v2] net: parse the eighth nested VLAN tag

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2] net: parse the eighth nested VLAN tag

[Andrew Lunn]

On Sun, Nov 01, 2026 at 04:58:42PM +0200, Avi Weiss wrote:
> __vlan_get_protocol_offset() starts with VLAN_MAX_DEPTH (8) but
> pre-decrements parse_depth before checking it. This rejects the eighth
> VLAN header and returns protocol 0 instead of the encapsulated EtherType.
> 
> When skb->mac_len is ETH_HLEN, the first iteration rereads the outer
> EtherType, so eight VLAN tags require nine iterations. Check the counter
> before decrementing it and allow one extra iteration in this case.
> 
> Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth")

Do you have a use case for 8 nested VLANs?

Have you seen people reporting issues? Does this bother anybody?

If not, i suggest you drop the Fixes: tag and post to net-next.

   Andrew