[PATCH net] macvlan: Don't propagate promisc change to lower dev in passthru

[PATCH net] macvlan: Don't propagate promisc change to lower dev in passthru

[Vlad Buslov]

Macvlan device in passthru mode sets its lower device promiscuous mode
according to its MACVLAN_FLAG_NOPROMISC flag instead of synchronizing it to
its own promiscuity setting. However, macvlan_change_rx_flags() function
doesn't check the mode before propagating such changes to the lower device
which can cause net_device->promiscuity counter overflow as illustrated by
reproduction example [0] and resulting dmesg log [1]. Fix the issue by
first verifying the mode in macvlan_change_rx_flags() function before
propagating promiscuous mode change to the lower device.

[0]:
ip link add macvlan1 link enp8s0f0 type macvlan mode passthru
ip link set macvlan1 promisc on
ip l set dev macvlan1 up
ip link set macvlan1 promisc off
ip l set dev macvlan1 down
ip l set dev macvlan1 up

[1]:
[ 5156.281724] macvlan1: entered promiscuous mode
[ 5156.285467] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
[ 5156.287639] macvlan1: left promiscuous mode
[ 5156.288339] mlx5_core 0000:08:00.0 enp8s0f0: left promiscuous mode
[ 5156.290907] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
[ 5156.317197] mlx5_core 0000:08:00.0 enp8s0f0: promiscuity touches roof, set promiscuity failed. promiscuity feature of device might be broken.

Fixes: efdbd2b30caa ("macvlan: Propagate promiscuity setting to lower devices.")
Reviewed-by: Gal Pressman <gal@nvidia.com>
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
---
 drivers/net/macvlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 02bd201bc7e5..c8da94af4161 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -780,7 +780,7 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
 	if (dev->flags & IFF_UP) {
 		if (change & IFF_ALLMULTI)
 			dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
-		if (change & IFF_PROMISC)
+		if (!macvlan_passthru(vlan->port) && change & IFF_PROMISC)
 			dev_set_promiscuity(lowerdev,
 					    dev->flags & IFF_PROMISC ? 1 : -1);
 
-- 
2.39.2

Re: [PATCH net] macvlan: Don't propagate promisc change to lower dev in passthru

[Jiri Pirko]

Tue, Nov 14, 2023 at 06:59:15PM CET, vladbu@nvidia.com wrote:
>Macvlan device in passthru mode sets its lower device promiscuous mode
>according to its MACVLAN_FLAG_NOPROMISC flag instead of synchronizing it to
>its own promiscuity setting. However, macvlan_change_rx_flags() function
>doesn't check the mode before propagating such changes to the lower device
>which can cause net_device->promiscuity counter overflow as illustrated by
>reproduction example [0] and resulting dmesg log [1]. Fix the issue by
>first verifying the mode in macvlan_change_rx_flags() function before
>propagating promiscuous mode change to the lower device.
>
>[0]:
>ip link add macvlan1 link enp8s0f0 type macvlan mode passthru
>ip link set macvlan1 promisc on
>ip l set dev macvlan1 up
>ip link set macvlan1 promisc off
>ip l set dev macvlan1 down
>ip l set dev macvlan1 up
>
>[1]:
>[ 5156.281724] macvlan1: entered promiscuous mode
>[ 5156.285467] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
>[ 5156.287639] macvlan1: left promiscuous mode
>[ 5156.288339] mlx5_core 0000:08:00.0 enp8s0f0: left promiscuous mode
>[ 5156.290907] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
>[ 5156.317197] mlx5_core 0000:08:00.0 enp8s0f0: promiscuity touches roof, set promiscuity failed. promiscuity feature of device might be broken.
>
>Fixes: efdbd2b30caa ("macvlan: Propagate promiscuity setting to lower devices.")
>Reviewed-by: Gal Pressman <gal@nvidia.com>
>Signed-off-by: Vlad Buslov <vladbu@nvidia.com>

Reviewed-by: Jiri Pirko <jiri@nvidia.com>

Re: [PATCH net] macvlan: Don't propagate promisc change to lower dev in passthru

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue, 14 Nov 2023 18:59:15 +0100 you wrote:
> Macvlan device in passthru mode sets its lower device promiscuous mode
> according to its MACVLAN_FLAG_NOPROMISC flag instead of synchronizing it to
> its own promiscuity setting. However, macvlan_change_rx_flags() function
> doesn't check the mode before propagating such changes to the lower device
> which can cause net_device->promiscuity counter overflow as illustrated by
> reproduction example [0] and resulting dmesg log [1]. Fix the issue by
> first verifying the mode in macvlan_change_rx_flags() function before
> propagating promiscuous mode change to the lower device.
> 
> [...]

Here is the summary with links:
  - [net] macvlan: Don't propagate promisc change to lower dev in passthru
    https://git.kernel.org/netdev/net/c/7e1caeace041

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html