patch 'net: fix GTP tunnel parsing' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/27/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/6404681b938c6bf8f50edbd610c699f1a95d9c9e

Thanks.

Kevin

---
>From 6404681b938c6bf8f50edbd610c699f1a95d9c9e Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Mon, 1 Jun 2026 09:17:27 -0700
Subject: [PATCH] net: fix GTP tunnel parsing

[ upstream commit fcdc6720588d67ed6a447f63da220d1a4ac278c2 ]

If packet is fragmented across multiple mbufs or the packet
has only GTP header the code would reference outside
the incoming mbuf.

Send GTP packet:
- Valid GTP header (8 bytes)
- msg_type = 0xff
- e=1, s=1, pn=1 (sets gtp_len = 12)
- Total packet size = 10 bytes

Read at gh + 12 accesses 2 bytes beyond packet end.

The fix is to use rte_pktmbuf_read in a manner similar
to the read of the GTP header.

Fixes: 64ed7f854cf4 ("net: add tunnel packet type parsing")

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Reviewed-by: Andrew Rybchenko <andrew.rybchenko at oktetlabs.ru>
---
 lib/net/rte_net.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/lib/net/rte_net.c b/lib/net/rte_net.c
index c70b57fdc0..d9f2fdf357 100644
--- a/lib/net/rte_net.c
+++ b/lib/net/rte_net.c
@@ -220,6 +220,5 @@ ptype_tunnel_with_udp(uint16_t *proto, const struct rte_mbuf *m,
 		const struct rte_gtp_hdr *gh;
 		struct rte_gtp_hdr gh_copy;
-		uint8_t gtp_len;
-		uint8_t ip_ver;
+		uint32_t gtp_len;
 		gh = rte_pktmbuf_read(m, *off, sizeof(*gh), &gh_copy);
 		if (unlikely(gh == NULL))
@@ -232,7 +231,15 @@ ptype_tunnel_with_udp(uint16_t *proto, const struct rte_mbuf *m,
 		 * a GTP data packet. If not, it is a GTP control packet
 		 */
+		*off += gtp_len;
 		if (gh->msg_type == 0xff) {
-			ip_ver = *(const uint8_t *)((const char *)gh + gtp_len);
-			ip_ver = (ip_ver) & 0xf0;
+			const uint8_t *l3_byte;
+			uint8_t l3_copy, ip_ver;
+
+			/* read first byte of l3 header */
+			l3_byte = rte_pktmbuf_read(m, *off, sizeof(uint8_t), &l3_copy);
+			if (unlikely(l3_byte == NULL))
+				return 0;
+
+			ip_ver = *l3_byte & 0xf0;
 			if (ip_ver == RTE_GTP_TYPE_IPV4)
 				*proto = rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4);
@@ -244,5 +251,4 @@ ptype_tunnel_with_udp(uint16_t *proto, const struct rte_mbuf *m,
 			*proto = 0;
 		}
-		*off += gtp_len;
 		hdr_lens->inner_l2_len = gtp_len + sizeof(struct rte_udp_hdr);
 		hdr_lens->tunnel_len = gtp_len;
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-23 17:58:00.860522826 +0100
+++ 0077-net-fix-GTP-tunnel-parsing.patch	2026-07-23 17:57:58.689891661 +0100
@@ -1 +1 @@
-From fcdc6720588d67ed6a447f63da220d1a4ac278c2 Mon Sep 17 00:00:00 2001
+From 6404681b938c6bf8f50edbd610c699f1a95d9c9e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit fcdc6720588d67ed6a447f63da220d1a4ac278c2 ]
+
@@ -22 +23,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index 458b4814a9..0a91e92ba0 100644
+index c70b57fdc0..d9f2fdf357 100644