[PATCH net] macvlan: fix allmulti reference counting in passthru mode

[PATCH net] macvlan: fix allmulti reference counting in passthru mode

[Prasad Koya]

Enabling allmulticast on a down passthru macvlan, bringing it up,
then toggling allmulticast off and on can underflow the lower device's
allmulti reference count.

macvlan_change_rx_flags() only propagates IFF_ALLMULTI changes while
the macvlan is up. However, the passthru path in macvlan_open() skips
taking an allmulti reference when IFF_ALLMULTI is already set.
Clearing allmulticast after opening the device therefore decrements
a reference that was never taken. With no other allmulti users, the
unsigned counter wraps from zero to UINT_MAX. The next increment
fails with -EOVERFLOW and reports "allmulti touches roof".

Signed-off-by: Prasad Koya <prasad@arista.com>
---
Reproducer:

  #!/bin/bash
  set -euo pipefail

  ns=allmulti-test
  host=am-veth0
  peer=am-veth1
  mv=am-mv0

  cleanup()
  {
      ip netns del "$ns" 2>/dev/null || true
  }
  trap cleanup EXIT

  ip netns add "$ns"
  ip link add "$host" type veth peer name "$peer"
  ip link set "$peer" netns "$ns"

  ip link set "$host" up
  ip -n "$ns" link set lo up
  ip -n "$ns" link set "$peer" up

  ip -n "$ns" link add link "$peer" name "$mv" type macvlan mode passthru

  ip -n "$ns" link set dev "$mv" allmulticast on
  ip -n "$ns" link set dev "$mv" up
  ip -n "$ns" link set dev "$mv" allmulticast off
  ip -n "$ns" link set dev "$mv" allmulticast on

 drivers/net/macvlan.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index afad90b9222a..e20d587453d1 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -643,6 +643,14 @@ static int macvlan_open(struct net_device *dev)
 			if (err < 0)
 				goto out;
 		}
+		if (dev->flags & IFF_ALLMULTI) {
+			err = dev_set_allmulti(lowerdev, 1);
+			if (err < 0) {
+				if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
+					dev_set_promiscuity(lowerdev, -1);
+				goto out;
+			}
+		}
 		goto hash_add;
 	}
 
@@ -713,6 +721,8 @@ static int macvlan_stop(struct net_device *dev)
 	dev_mc_unsync(lowerdev, dev);
 
 	if (macvlan_passthru(vlan->port)) {
+		if (dev->flags & IFF_ALLMULTI)
+			dev_set_allmulti(lowerdev, -1);
 		if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
 			dev_set_promiscuity(lowerdev, -1);
 		goto hash_del;

base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
-- 
2.43.0

Re: [PATCH net] macvlan: fix allmulti reference counting in passthru mode

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] macvlan: fix allmulti reference counting in passthru mode

[Prasad Koya]

The issue was observed during development testing with 5.10 and 6.12
kernels. It was reproduced on Linux 6.12.68 by enabling allmulticast
on a down passthru macvlan, bringing it up, and toggling allmulticast
off and on. This triggered the “allmulti touches roof” warning.

> On Mon, Oct 26, 2026 at 7:51 PM <netdev-bot+sinfo@kernel.org> wrote:
>>
>> Hi!
>>
>> This is an automated message. This series looks like a fix, but its
>> commit messages seem to be missing some information:
>>
>>  - How the issue was discovered, e.g. hit in production, hit during
>>    development, syzbot report, manual code inspection, LLM or static
>>    analysis tool scan.
>>
>> Please do not repost the series just to address the above. Instead,
>> reply to this email with the missing information, so that reviewers
>> can take it into account. If the series needs another revision for
>> other reasons, please include the information in the commit messages
>> then.
>>
>> The evaluation is done by an LLM so it may be wrong, if you think
>> that is the case please reply and explain.