Re: [PATCH net] net: vrf: Set L3MDEV OIF flag for outbound lookups

[David Ahern <dsahern@kernel.org>]

[ cc author of referenced Fixes commit ]

On 10/28/26 7:57 AM, Gabriel Goller wrote:
> On 27.10.2026 01:47, Haon KIM wrote:
>> The IPv4 and IPv6 outbound processing paths in the VRF driver
>> set the L3 master device index in the flow structure before
>> performing route lookups, but do not set
>> FLOWI_FLAG_L3MDEV_OIF.
>>
>> Both the IPv4 and IPv6 outbound processing paths contain
>> the comment "needed to match OIF rule", indicating that
>> the L3 master device index is needed to match OIF rules.
>> However, FIB rule matching requires both
>> FLOWI_FLAG_L3MDEV_OIF and a matching flowi_l3mdev index
>> to match a rule specifying the VRF master as the output
>> interface.
>>
>> The matching logic introduced by commit 2d300ce0b783
>> ("net: fib_rules: Fix iif / oif matching on L3 master device")
>> requires FLOWI_FLAG_L3MDEV_OIF to be set for OIF rules to
>> match the VRF master. The existing outbound processing paths
>> set the L3 master device index directly, so
>> l3mdev_update_flow() does not set this flag.
>>
>> Consequently, OIF rules specifying the VRF master may fail
>> to match these flows.
>>
>> Set FLOWI_FLAG_L3MDEV_OIF in both outbound processing paths
>> so that FIB rules can correctly match the VRF master as the
>> output interface.
>>
>> The issue was identified by code inspection. Runtime testing
>> has not been performed.

Please do not do that; do some testing before sending patches.

>>
>> Fixes: 2d300ce0b783 ("net: fib_rules: Fix iif / oif matching on L3 master device")
> 
> I think this should be:
> 
> Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")

No, the Fixes above is correct if there is a bug; the
FLOWI_FLAG_L3MDEV_OIF flag was introduced by 2d300ce0b783 and was not
present for 40867d74c374.

That said, unless I am misremembering something the flag does not need
to be set in this outbound path.

> 
>> Signed-off-by: Haon KIM <akrn112@naver.com>
>> ---
>>  drivers/net/vrf.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
>> index 79d433f49f80..f22ac91fefd4 100644
>> --- a/drivers/net/vrf.c
>> +++ b/drivers/net/vrf.c
>> @@ -432,6 +432,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
>>  	fl6.flowlabel = ip6_flowinfo(iph);
>>  	fl6.flowi6_mark = skb->mark;
>>  	fl6.flowi6_proto = iph->nexthdr;
>> +	fl6.flowi6_flags = FLOWI_FLAG_L3MDEV_OIF;
>>  
>>  	dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
>>  	if (IS_ERR(dst) || dst == dst_null)
>> @@ -506,7 +507,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
>>  	fl4.flowi4_l3mdev = vrf_dev->ifindex;
>>  	fl4.flowi4_iif = LOOPBACK_IFINDEX;
>>  	fl4.flowi4_dscp = ip4h_dscp(ip4h);
>> -	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
>> +	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_OIF;
>>  	fl4.flowi4_proto = ip4h->protocol;
>>  	fl4.daddr = ip4h->daddr;
>>  	fl4.saddr = ip4h->saddr;
> 
> Also this is a breaking change, before the patch, this rule matched:
> 
>    ip rule add iif vrf0 table 100
> 
> After the patch, this one matches (and the iif rule above no longer does):
> 
>    ip rule add oif vrf0 table 100
> 
> A selftest would also be nice.

See commit message in cited Fixes commit. Have you checked
fib_rule_tests.sh? If not, try the commands in 2d300ce0b783 and if they
are broken, there is a problem. If not, let's get them added to the
selftest.