[PATCH dpdk v2] net: fix L2 ptype assignment in VLAN loop

[Robin Jarry]

Since commit 1f250674085a ("net: fix packet type for stacked VLAN"),
rte_net_get_ptype() uses |= to set the L2 ptype inside the VLAN
parsing loop. Since pkt_type is already initialized with
RTE_PTYPE_L2_ETHER (0x1), or-ing it with RTE_PTYPE_L2_ETHER_VLAN
(0x6) results in RTE_PTYPE_L2_ETHER_QINQ (0x7). This causes single
VLAN frames to be misidentified as QinQ.

This was detected while testing DPDK 25.11.1 in grout. The net/tap
driver calls rte_net_get_ptype() in tap_verify_csum() to determine
the L2 header length. With the wrong ptype, l2_len is set to 22
(ether + QinQ = 14 + 8) instead of 18 (ether + VLAN = 14 + 4),
shifting the IP header pointer by 4 bytes. The checksum is then
computed on garbage data, causing valid packets to be dropped.

Use a simple assignment to replace the L2 ptype instead. Add a ptype
unit test covering plain Ethernet, VLAN and QinQ L2 detection to
prevent regressions.

Fixes: 1f250674085a ("net: fix packet type for stacked VLAN")
Cc: stable at dpdk.org

Signed-off-by: Robin Jarry <rjarry at redhat.com>
---

Notes:
    v2: added new ptype tests

 app/test/meson.build      |   1 +
 app/test/test_net_ptype.c | 117 ++++++++++++++++++++++++++++++++++++++
 lib/net/rte_net.c         |   2 +-
 3 files changed, 119 insertions(+), 1 deletion(-)
 create mode 100644 app/test/test_net_ptype.c

diff --git a/app/test/meson.build b/app/test/meson.build
index 7d458f9c079a..9f4afb040a46 100644
--- a/app/test/meson.build
+++ b/app/test/meson.build
@@ -135,6 +135,7 @@ source_file_deps = {
     'test_mp_secondary.c': ['hash'],
     'test_net_ether.c': ['net'],
     'test_net_ip6.c': ['net'],
+    'test_net_ptype.c': ['net'],
     'test_pcapng.c': ['net_null', 'net', 'ethdev', 'pcapng', 'bus_vdev'],
     'test_pdcp.c': ['eventdev', 'pdcp', 'net', 'timer', 'security'],
     'test_pdump.c': ['pdump'] + sample_packet_forward_deps,
diff --git a/app/test/test_net_ptype.c b/app/test/test_net_ptype.c
new file mode 100644
index 000000000000..9619c1d54a8e
--- /dev/null
+++ b/app/test/test_net_ptype.c
@@ -0,0 +1,117 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright 2026 Red Hat, Inc.
+ */
+
+#include <string.h>
+
+#include <rte_mbuf.h>
+#include <rte_net.h>
+
+#include <rte_test.h>
+#include "test.h"
+
+#define MEMPOOL_CACHE_SIZE 0
+#define MBUF_DATA_SIZE 256
+#define NB_MBUF 128
+
+/* Ether()/IP()/UDP()/Raw('x') */
+static const char pkt_ether_ipv4_udp[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x45, 0x00,
+	0x00, 0x1d, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
+	0x7c, 0xcd, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00,
+	0x00, 0x01, 0x00, 0x35, 0x00, 0x35, 0x00, 0x09,
+	0x89, 0x6f, 0x78,
+};
+
+/* Ether()/Dot1Q(vlan=42)/IP()/UDP()/Raw('x') */
+static const char pkt_vlan_ipv4_udp[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x81, 0x00, 0x00, 0x2a,
+	0x08, 0x00, 0x45, 0x00, 0x00, 0x1d, 0x00, 0x01,
+	0x00, 0x00, 0x40, 0x11, 0x7c, 0xcd, 0x7f, 0x00,
+	0x00, 0x01, 0x7f, 0x00, 0x00, 0x01, 0x00, 0x35,
+	0x00, 0x35, 0x00, 0x09, 0x89, 0x6f, 0x78,
+};
+
+/* Ether()/Dot1AD(vlan=42)/Dot1Q(vlan=43)/IP()/UDP()/Raw('x') */
+static const char pkt_qinq_ipv4_udp[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x88, 0xa8, 0x00, 0x2a,
+	0x81, 0x00, 0x00, 0x2b, 0x08, 0x00, 0x45, 0x00,
+	0x00, 0x1d, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
+	0x7c, 0xcd, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00,
+	0x00, 0x01, 0x00, 0x35, 0x00, 0x35, 0x00, 0x09,
+	0x89, 0x6f, 0x78,
+};
+
+static int
+test_get_ptype(struct rte_mempool *pool, const char *pktdata, size_t len,
+	       uint32_t expected_l2, uint8_t expected_l2_len)
+{
+	struct rte_net_hdr_lens hdr_lens;
+	struct rte_mbuf *m;
+	uint32_t ptype;
+	uint32_t l2;
+	char *data;
+
+	m = rte_pktmbuf_alloc(pool);
+	RTE_TEST_ASSERT_NOT_NULL(m, "cannot allocate mbuf");
+
+	data = rte_pktmbuf_append(m, len);
+	if (data == NULL) {
+		rte_pktmbuf_free(m);
+		RTE_TEST_ASSERT_NOT_NULL(data, "cannot append data");
+	}
+
+	memcpy(data, pktdata, len);
+
+	ptype = rte_net_get_ptype(m, &hdr_lens, RTE_PTYPE_ALL_MASK);
+	l2 = ptype & RTE_PTYPE_L2_MASK;
+
+	rte_pktmbuf_free(m);
+
+	RTE_TEST_ASSERT_EQUAL(l2, expected_l2,
+		"unexpected L2 ptype: got 0x%x, expected 0x%x",
+		l2, expected_l2);
+	RTE_TEST_ASSERT_EQUAL(hdr_lens.l2_len, expected_l2_len,
+		"unexpected l2_len: got %u, expected %u",
+		hdr_lens.l2_len, expected_l2_len);
+
+	return 0;
+}
+
+static int
+test_net_ptype(void)
+{
+	struct rte_mempool *pool;
+
+	pool = rte_pktmbuf_pool_create("test_ptype_mbuf_pool",
+			NB_MBUF, MEMPOOL_CACHE_SIZE, 0, MBUF_DATA_SIZE,
+			SOCKET_ID_ANY);
+	RTE_TEST_ASSERT_NOT_NULL(pool, "cannot allocate mbuf pool");
+
+	if (test_get_ptype(pool, pkt_ether_ipv4_udp,
+			   sizeof(pkt_ether_ipv4_udp),
+			   RTE_PTYPE_L2_ETHER, 14))
+		goto fail;
+
+	if (test_get_ptype(pool, pkt_vlan_ipv4_udp,
+			   sizeof(pkt_vlan_ipv4_udp),
+			   RTE_PTYPE_L2_ETHER_VLAN, 18))
+		goto fail;
+
+	if (test_get_ptype(pool, pkt_qinq_ipv4_udp,
+			   sizeof(pkt_qinq_ipv4_udp),
+			   RTE_PTYPE_L2_ETHER_QINQ, 22))
+		goto fail;
+
+	rte_mempool_free(pool);
+	return 0;
+
+fail:
+	rte_mempool_free(pool);
+	return -1;
+}
+
+REGISTER_FAST_TEST(net_ptype_autotest, NOHUGE_OK, ASAN_OK, test_net_ptype);
diff --git a/lib/net/rte_net.c b/lib/net/rte_net.c
index 458b4814a9c9..ea5ba7019089 100644
--- a/lib/net/rte_net.c
+++ b/lib/net/rte_net.c
@@ -359,7 +359,7 @@ uint32_t rte_net_get_ptype(const struct rte_mbuf *m,
 
 		if (++vlan_depth > RTE_NET_VLAN_MAX_DEPTH)
 			return 0;
-		pkt_type |=
+		pkt_type =
 			proto == rte_cpu_to_be_16(RTE_ETHER_TYPE_VLAN) ?
 				 RTE_PTYPE_L2_ETHER_VLAN :
 				 RTE_PTYPE_L2_ETHER_QINQ;
-- 
2.53.0