Please backport d289d5307762 ("ip6_vti: set netns_immutable on the fallback device.") to 6.12.y.

Please backport d289d5307762 ("ip6_vti: set netns_immutable on the fallback device.") to 6.12.y.

[Salvatore Bonaccorso]

Hi

d289d5307762 ("ip6_vti: set netns_immutable on the fallback device.")
was already queued for 7.0.13-rc1 and 6.18.36-rc1:
https://lore.kernel.org/all/20260616145117.258480602@linuxfoundation.org/
https://lore.kernel.org/all/20260616145103.487984074@linuxfoundation.org/
but not for the older series as needed.

For versions which do not have 0c493da86374 ("net: rename netns_local
to netns_immutable") in v6.15-rc1 this would need backporting.

Below is the backported patch for 6.12.y.

I have a question: Given the commit say "ip6_vti: set netns_immutable
on the fallback device.", but this won't be anymore a correct
statement, should 6.12.y get a "dedicated" backport instead of
claiming it the upstream commit?

Unfortunately the same change won't apply further down and will need
more work.

Regards,
Salvatore

From b004312340b7c6ec2d757c24279f5a1d0b3a831a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 8 Jun 2026 15:59:18 +0000
Subject: [PATCH] ip6_vti: set netns_immutable on the fallback device.

[ Upstream commit d289d5307762d1838aaece22c6b6fcad9e8865f9 ]

john1988 and Noam Rathaus reported that vti6_init_net() does not set the
netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).

Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)
correctly set this flag during their fallback device initialization to
prevent them from being moved to another network namespace.

Fixes: 61220ab34948 ("vti6: Enable namespace changing")
Reported-by: Noam Rathaus <noamr@ssd-disclosure.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20260608155918.787644-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[Salvatore Bonaccorso: Backport for version without 0c493da86374 ("net:
rename netns_local to netns_immutable") in v6.15-rc1 and use
netns_local.]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
---
 net/ipv6/ip6_vti.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 2ac88593a954..892533dbb527 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1157,6 +1157,7 @@ static int __net_init vti6_init_net(struct net *net)
 		goto err_alloc_dev;
 	dev_net_set(ip6n->fb_tnl_dev, net);
 	ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops;
+	ip6n->fb_tnl_dev->netns_local = true;
 
 	err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
 	if (err < 0)
-- 
2.53.0

Re: Please backport d289d5307762 ("ip6_vti: set netns_immutable on the fallback device.") to 6.12.y.

[Sasha Levin]

On Wed, Jun 17, 2026 at 12:43:25PM +0200, Salvatore Bonaccorso wrote:
> I have a question: Given the commit say "ip6_vti: set netns_immutable
> on the fallback device.", but this won't be anymore a correct
> statement, should 6.12.y get a "dedicated" backport instead of
> claiming it the upstream commit?

Queued for 6.12, thanks.

-- 
Thanks,
Sasha