Re: [PATCH net v1] ip_gre: Reject enabling collect metadata through changelink

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Sep 17, 2026 at 05:50:16PM +0800, Xuanqiang Luo wrote:
> diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
> index 82309efd417e0..7b1b0f17f60b9 100644
> --- a/net/ipv4/ip_gre.c
> +++ b/net/ipv4/ip_gre.c
> @@ -1464,6 +1464,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
>  	if (!rtnl_dev_link_net_capable(dev, t->net))
>  		return -EPERM;
>  
> +	if (data && data[IFLA_GRE_COLLECT_METADATA] && !t->collect_md)
> +		return -EOPNOTSUPP;
> +
>  	err = ipgre_newlink_encap_setup(dev, data);
>  	if (err)
>  		return err;
> @@ -1496,6 +1499,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],
>  	if (!rtnl_dev_link_net_capable(dev, t->net))
>  		return -EPERM;
>  
> +	if (data && data[IFLA_GRE_COLLECT_METADATA] && !t->collect_md)
> +		return -EOPNOTSUPP;

Both functions have extack, so please add a rejection message to make it
clear to user space. Something like:

"Enabling collect_md on an existing device is not supported"

Also, I assume you audited other tunnels and confirmed that they don't
suffer from this problem?

> +
>  	err = ipgre_newlink_encap_setup(dev, data);
>  	if (err)
>  		return err;
> 
> base-commit: c9151088f1674fd29ff26a20f5fc687acf53a2f0
> -- 
> 2.43.0