github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-04 18:29:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ip_gre: Reject enabling collect metadata through changelink

Browse Source 
ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP
or ERSPAN device. Unlike newlink, changelink does not enforce metadata
tunnel uniqueness. Converting a non-metadata device can therefore
replace the metadata receive entry for another device of the same type
in the same netns. Deleting either device then clears the shared entry,
breaking metadata receive lookup for the surviving device.

If parameter validation fails after collect_md is set, deleting the
modified device can also clear an entry it never owned.

Reject enabling metadata mode in both changelink callbacks before any
encapsulation or tunnel parameters are modified. Allow requests that
repeat the metadata attribute on an existing metadata device.

Fixes: 2e15ea390e ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260921031859.9283-1-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xuanqiang Luo 2026-09-21 11:18:59 +08:00 committed by Jakub Kicinski
parent 4bdee8060d
commit a3f315be9d
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/ipv4/ip_gre.c
View File

@ -1464,6 +1464,12 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
if (!rtnl_dev_link_net_capable(dev, t->net))
return -EPERM;
if (data && data[IFLA_GRE_COLLECT_METADATA] && !t->collect_md) {
NL_SET_ERR_MSG(extack,
"Enabling collect_md on an existing device is not supported");
return -EOPNOTSUPP;
}
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;
@ -1496,6 +1502,12 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],
if (!rtnl_dev_link_net_capable(dev, t->net))
return -EPERM;
if (data && data[IFLA_GRE_COLLECT_METADATA] && !t->collect_md) {
NL_SET_ERR_MSG(extack,
"Enabling collect_md on an existing device is not supported");
return -EOPNOTSUPP;
}
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;