Re: [regression 5.10.y] Libvirt can no longer delete macvtap devices after backport of a6cec0bcd342 ("net: rtnetlink: add bulk delete support flag") to 5.10.y series (Debian 11)

[Ben Hutchings <benh@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 2036 bytes --]

Hi all,

On Fri, 2025-12-19 at 10:19 +0100, Thorsten Leemhuis wrote:
> On 12/18/25 20:50, Salvatore Bonaccorso wrote:
> > 
> > Is there soemthing missing?
> > 
> > Roland I think it would be helpful if you can test as well more recent
> > stable series versions to confirm if the issue is present there as
> > well or not, which might indicate a 5.10.y specific backporting
> > problem.
> 
> FWIW, it (as usual) would be very important to know if this happens with
> mainline as well, as that determines if it's a general problem or a
> backporting problem
[...]

The bug is this:

- libvirtd wrongly used to use NLM_F_CREATE (0x400) and NLM_F_EXCL
  (0x200) flags on an RTM_DELLINK operation.  These flags are only
  semantically valid for NEW-type operations.

- rtnetlink is rather lax about checking the flags on operations, so
  these unsupported flags had no effect.

- rtnetlink can now support NLM_F_BULK (0x200) on some DEL-type
  operations.  If the flag is used but is not valid for the specific
  operation then the operation now fails with EOPNOTSUPP.  Since
  NLM_F_EXCL == NLM_F_BULK and RTM_DELLINK does not support bulk
  operations, libvirtd now hits this error case.

I have not tested with mainline, but in principle the same issue should
occur with any other kernel version that has commit a6cec0bcd342 "net:
rtnetlink: add bulk delete support flag" together with an older version
of libvirt.

This was fixed in libvirt commit 1334002340b, which appears to have gone
into version 7.1.0, but Debian 11 "bullseye" has 7.0.0.

We can certainly fix the libvirt side of this in Debian, but this also
sounds like a case where the kernel should work around known buggy user-
space.  On the other hand, this has been upstream for over 3 years so
maybe it doesn't make sense now.

Please let me know whether I (or anyone) should try to implement a
workaround for this in the kernel.

Ben.

-- 
Ben Hutchings - Debian developer, member of kernel, installer and LTS
teams

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]