[PATCH net] ipvlan: update port flags only after ipvlan_set_port_mode() succeeds

[PATCH net] ipvlan: update port flags only after ipvlan_set_port_mode() succeeds

[Wenbo Sun]

In ipvlan_link_new(), the shared port->flags is updated before
calling ipvlan_set_port_mode(). If ipvlan_set_port_mode() fails (e.g.
switching to L3S mode without CONFIG_IPVLAN_L3S), the error unwinds via
unlink_netdev, but the shared port->flags has already been modified and
is never restored.

As a result, subsequent operations on existing ipvlan interfaces on the
same lower device operate with corrupted port flags (e.g., VEPA or
PRIVATE flags inadvertently set or cleared).

Fix this by deferring the update of port->flags until after
ipvlan_set_port_mode() returns successfully, matching the behaviour of
ipvlan_nl_changelink().

This issue was identified with the assistance of an LLM-based code
review tool, confirmed by reproducing the state corruption in a
User-Mode Linux (UML) environment when ipvlan_set_port_mode() fails,
and verified in UML that the shared port flags remain unchanged upon
failure.

Fixes: a190d04db937 ("ipvlan: introduce 'private' attribute for all existing modes.")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 drivers/net/ipvlan/ipvlan_main.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f29864db662a..5732b167c5b3 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -678,12 +678,6 @@ int ipvlan_link_new(struct net_device *dev, struct rtnl_newlink_params *params,
 	if (err)
 		goto remove_ida;
 
-	/* Flags are per port and latest update overrides. User has
-	 * to be consistent in setting it just like the mode attribute.
-	 */
-	if (data && data[IFLA_IPVLAN_FLAGS])
-		port->flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
-
 	if (data && data[IFLA_IPVLAN_MODE])
 		mode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
 
@@ -691,6 +685,12 @@ int ipvlan_link_new(struct net_device *dev, struct rtnl_newlink_params *params,
 	if (err)
 		goto unlink_netdev;
 
+	/* Flags are per port and latest update overrides. User has
+	 * to be consistent in setting it just like the mode attribute.
+	 */
+	if (data && data[IFLA_IPVLAN_FLAGS])
+		port->flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
+
 	mutex_lock(&port->pnodes_lock);
 	list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
 	mutex_unlock(&port->pnodes_lock);
-- 
2.33.0

Re: [PATCH net] ipvlan: update port flags only after ipvlan_set_port_mode() succeeds

[Hangbin Liu]

Hi Wenbo,
On Wed, Nov 11, 2026 at 02:46:55PM +0800, Wenbo Sun wrote:
> In ipvlan_link_new(), the shared port->flags is updated before
> calling ipvlan_set_port_mode(). If ipvlan_set_port_mode() fails (e.g.
> switching to L3S mode without CONFIG_IPVLAN_L3S), the error unwinds via
> unlink_netdev, but the shared port->flags has already been modified and
> is never restored.

If ipvlan_set_port_mode() failed, the unregister_netdevice(dev) will be
called. Does port->flags still need to restore?

Thanks
Hangbin
> 
> As a result, subsequent operations on existing ipvlan interfaces on the
> same lower device operate with corrupted port flags (e.g., VEPA or
> PRIVATE flags inadvertently set or cleared).
> 
> Fix this by deferring the update of port->flags until after
> ipvlan_set_port_mode() returns successfully, matching the behaviour of
> ipvlan_nl_changelink().
> 
> This issue was identified with the assistance of an LLM-based code
> review tool, confirmed by reproducing the state corruption in a
> User-Mode Linux (UML) environment when ipvlan_set_port_mode() fails,
> and verified in UML that the shared port flags remain unchanged upon
> failure.
> 
> Fixes: a190d04db937 ("ipvlan: introduce 'private' attribute for all existing modes.")
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
> ---
>  drivers/net/ipvlan/ipvlan_main.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
> index f29864db662a..5732b167c5b3 100644
> --- a/drivers/net/ipvlan/ipvlan_main.c
> +++ b/drivers/net/ipvlan/ipvlan_main.c
> @@ -678,12 +678,6 @@ int ipvlan_link_new(struct net_device *dev, struct rtnl_newlink_params *params,
>  	if (err)
>  		goto remove_ida;
>  
> -	/* Flags are per port and latest update overrides. User has
> -	 * to be consistent in setting it just like the mode attribute.
> -	 */
> -	if (data && data[IFLA_IPVLAN_FLAGS])
> -		port->flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
> -
>  	if (data && data[IFLA_IPVLAN_MODE])
>  		mode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
>  
> @@ -691,6 +685,12 @@ int ipvlan_link_new(struct net_device *dev, struct rtnl_newlink_params *params,
>  	if (err)
>  		goto unlink_netdev;
>  
> +	/* Flags are per port and latest update overrides. User has
> +	 * to be consistent in setting it just like the mode attribute.
> +	 */
> +	if (data && data[IFLA_IPVLAN_FLAGS])
> +		port->flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
> +
>  	mutex_lock(&port->pnodes_lock);
>  	list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
>  	mutex_unlock(&port->pnodes_lock);
> -- 
> 2.33.0
> 
> 
>