[PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[Gabriel Goller]

seg6_build_state() rejected invalid configurations with a generic -EINVAL, so
"ip route add ... encap seg6 ..." always reported "Invalid argument".

Attach an extack message to each of them. The checks themselves and their return
values are unchanged.

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---

v2 (https://lore.kernel.org/netdev/20260918153544.1178884-1-g.goller@proxmox.com/):
 * dropped tests

 net/ipv6/seg6_iptunnel.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 61c6a27bf202..e7f75970e26e 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -756,8 +756,12 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
 	struct seg6_lwt *slwt;
 	int err;
 
-	if (family != AF_INET && family != AF_INET6)
+	if (family != AF_INET && family != AF_INET6) {
+		NL_SET_ERR_MSG(
+			extack,
+			"unsupported address family for SRv6 encapsulation");
 		return -EINVAL;
+	}
 
 	err = nla_parse_nested_deprecated(tb, SEG6_IPTUNNEL_MAX, nla,
 					  seg6_iptunnel_policy, extack);
@@ -765,8 +769,10 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
 	if (err < 0)
 		return err;
 
-	if (!tb[SEG6_IPTUNNEL_SRH])
+	if (!tb[SEG6_IPTUNNEL_SRH]) {
+		NL_SET_ERR_MSG(extack, "missing SRv6 SRH attribute");
 		return -EINVAL;
+	}
 
 	tuninfo = nla_data(tb[SEG6_IPTUNNEL_SRH]);
 	tuninfo_len = nla_len(tb[SEG6_IPTUNNEL_SRH]);
@@ -776,13 +782,18 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
 	 */
 	min_size = sizeof(*tuninfo) + sizeof(struct ipv6_sr_hdr) +
 		   sizeof(struct in6_addr);
-	if (tuninfo_len < min_size)
+	if (tuninfo_len < min_size) {
+		NL_SET_ERR_MSG(extack, "truncated SRv6 SRH attribute");
 		return -EINVAL;
+	}
 
 	switch (tuninfo->mode) {
 	case SEG6_IPTUN_MODE_INLINE:
-		if (family != AF_INET6)
+		if (family != AF_INET6) {
+			NL_SET_ERR_MSG(extack,
+				       "inline mode requires an IPv6 route");
 			return -EINVAL;
+		}
 
 		if (tb[SEG6_IPTUNNEL_SRC]) {
 			NL_SET_ERR_MSG(extack, "incompatible mode for tunsrc");
@@ -798,12 +809,16 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
 	case SEG6_IPTUN_MODE_L2ENCAP_RED:
 		break;
 	default:
+		NL_SET_ERR_MSG(extack, "invalid SRv6 encapsulation mode");
 		return -EINVAL;
 	}
 
 	/* verify that SRH is consistent */
-	if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo), false))
+	if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo),
+			       false)) {
+		NL_SET_ERR_MSG(extack, "invalid SRv6 segment routing header");
 		return -EINVAL;
+	}
 
 	newts = lwtunnel_state_alloc(tuninfo_len + sizeof(*slwt));
 	if (!newts)
-- 
2.47.3

Re: [PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[Andrea Mayer]

On Tue, 22 Sep 2026 11:08:33 +0200
Gabriel Goller <g.goller@proxmox.com> wrote:

Hi Gabriel,

> seg6_build_state() rejected invalid configurations with a generic -EINVAL, so
> "ip route add ... encap seg6 ..." always reported "Invalid argument".
> 
> Attach an extack message to each of them. The checks themselves and their return
> values are unchanged.
> 
> Signed-off-by: Gabriel Goller <g.goller@proxmox.com>

The commit message stays in the changelog, so wrapping the body at 75
columns would be better.

> ---
> 
> v2 (https://lore.kernel.org/netdev/20260918153544.1178884-1-g.goller@proxmox.com/):
>  * dropped tests
> 
>  net/ipv6/seg6_iptunnel.c | 25 ++++++++++++++++++++-----
>  1 file changed, 20 insertions(+), 5 deletions(-)
> 
> diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
> index 61c6a27bf202..e7f75970e26e 100644
> --- a/net/ipv6/seg6_iptunnel.c
> +++ b/net/ipv6/seg6_iptunnel.c
> @@ -756,8 +756,12 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
>  	struct seg6_lwt *slwt;
>  	int err;
>  
> -	if (family != AF_INET && family != AF_INET6)
> +	if (family != AF_INET && family != AF_INET6) {
> +		NL_SET_ERR_MSG(
> +			extack,
> +			"unsupported address family for SRv6 encapsulation");
>  		return -EINVAL;
> +	}

checkpatch flags this line ("Lines should not end with a '('"). The
two-line form used in the rest of the file would be better:

	NL_SET_ERR_MSG(extack,
		       "unsupported address family for SRv6 encapsulation");

The string goes a bit over 80 columns but should stay on one line for grep.

A side note: the source_inline bot failure looks like a false positive,
the script matches "inline" inside the string literal.

Thanks,
Andrea

Re: [PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[Gabriel Goller]

On 22.09.2026 23:49, Andrea Mayer wrote:
> On Tue, 22 Sep 2026 11:08:33 +0200
> Gabriel Goller <g.goller@proxmox.com> wrote:
> 
> Hi Gabriel,
> 
> > seg6_build_state() rejected invalid configurations with a generic -EINVAL, so
> > "ip route add ... encap seg6 ..." always reported "Invalid argument".
> > 
> > Attach an extack message to each of them. The checks themselves and their return
> > values are unchanged.
> > 
> > Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
> 
> The commit message stays in the changelog, so wrapping the body at 75
> columns would be better.

Done, thanks.

> > ---
> > 
> > v2 (https://lore.kernel.org/netdev/20260918153544.1178884-1-g.goller@proxmox.com/):
> >  * dropped tests
> > 
> >  net/ipv6/seg6_iptunnel.c | 25 ++++++++++++++++++++-----
> >  1 file changed, 20 insertions(+), 5 deletions(-)
> > 
> > diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
> > index 61c6a27bf202..e7f75970e26e 100644
> > --- a/net/ipv6/seg6_iptunnel.c
> > +++ b/net/ipv6/seg6_iptunnel.c
> > @@ -756,8 +756,12 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
> >  	struct seg6_lwt *slwt;
> >  	int err;
> >  
> > -	if (family != AF_INET && family != AF_INET6)
> > +	if (family != AF_INET && family != AF_INET6) {
> > +		NL_SET_ERR_MSG(
> > +			extack,
> > +			"unsupported address family for SRv6 encapsulation");
> >  		return -EINVAL;
> > +	}
> 
> checkpatch flags this line ("Lines should not end with a '('"). The
> two-line form used in the rest of the file would be better:
> 
> 	NL_SET_ERR_MSG(extack,
> 		       "unsupported address family for SRv6 encapsulation");
> 
> The string goes a bit over 80 columns but should stay on one line for grep.

Fixed this.

Thanks for the review!
Gabriel

> A side note: the source_inline bot failure looks like a false positive,
> the script matches "inline" inside the string literal.
> 
> Thanks,
> Andrea
> 
> 

Re: [PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[Hangbin Liu]

On Tue, Sep 22, 2026 at 11:08:33AM +0200, Gabriel Goller wrote:
> seg6_build_state() rejected invalid configurations with a generic -EINVAL, so
> "ip route add ... encap seg6 ..." always reported "Invalid argument".
> 
> Attach an extack message to each of them. The checks themselves and their return
> values are unchanged.
> 
> Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
> ---
> 
> v2 (https://lore.kernel.org/netdev/20260918153544.1178884-1-g.goller@proxmox.com/):
>  * dropped tests
> 
>  net/ipv6/seg6_iptunnel.c | 25 ++++++++++++++++++++-----
>  1 file changed, 20 insertions(+), 5 deletions(-)
> 
> diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
> index 61c6a27bf202..e7f75970e26e 100644
> --- a/net/ipv6/seg6_iptunnel.c
> +++ b/net/ipv6/seg6_iptunnel.c
> @@ -756,8 +756,12 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
>  	struct seg6_lwt *slwt;
>  	int err;
>  
> -	if (family != AF_INET && family != AF_INET6)
> +	if (family != AF_INET && family != AF_INET6) {
> +		NL_SET_ERR_MSG(
> +			extack,
> +			"unsupported address family for SRv6 encapsulation");
>  		return -EINVAL;
> +	}
>  
>  	err = nla_parse_nested_deprecated(tb, SEG6_IPTUNNEL_MAX, nla,
>  					  seg6_iptunnel_policy, extack);
> @@ -765,8 +769,10 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
>  	if (err < 0)
>  		return err;
>  
> -	if (!tb[SEG6_IPTUNNEL_SRH])
> +	if (!tb[SEG6_IPTUNNEL_SRH]) {
> +		NL_SET_ERR_MSG(extack, "missing SRv6 SRH attribute");

I think we can use NL_SET_ERR_MSG_ATTR.

Thanks
Hangbin

Re: [PATCH net-next v2] net: ipv6: seg6: report lwtunnel setup errors via extack

[Gabriel Goller]

On 23.09.2026 09:29, Hangbin Liu wrote:
> On Tue, Sep 22, 2026 at 11:08:33AM +0200, Gabriel Goller wrote:
> > seg6_build_state() rejected invalid configurations with a generic -EINVAL, so
> > "ip route add ... encap seg6 ..." always reported "Invalid argument".
> > 
> > Attach an extack message to each of them. The checks themselves and their return
> > values are unchanged.
> > 
> > Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
> > ---
> > 
> > v2 (https://lore.kernel.org/netdev/20260918153544.1178884-1-g.goller@proxmox.com/):
> >  * dropped tests
> > 
> >  net/ipv6/seg6_iptunnel.c | 25 ++++++++++++++++++++-----
> >  1 file changed, 20 insertions(+), 5 deletions(-)
> > 
> > diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
> > index 61c6a27bf202..e7f75970e26e 100644
> > --- a/net/ipv6/seg6_iptunnel.c
> > +++ b/net/ipv6/seg6_iptunnel.c
> > @@ -756,8 +756,12 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
> >  	struct seg6_lwt *slwt;
> >  	int err;
> >  
> > -	if (family != AF_INET && family != AF_INET6)
> > +	if (family != AF_INET && family != AF_INET6) {
> > +		NL_SET_ERR_MSG(
> > +			extack,
> > +			"unsupported address family for SRv6 encapsulation");
> >  		return -EINVAL;
> > +	}
> >  
> >  	err = nla_parse_nested_deprecated(tb, SEG6_IPTUNNEL_MAX, nla,
> >  					  seg6_iptunnel_policy, extack);
> > @@ -765,8 +769,10 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
> >  	if (err < 0)
> >  		return err;
> >  
> > -	if (!tb[SEG6_IPTUNNEL_SRH])
> > +	if (!tb[SEG6_IPTUNNEL_SRH]) {
> > +		NL_SET_ERR_MSG(extack, "missing SRv6 SRH attribute");
> 
> I think we can use NL_SET_ERR_MSG_ATTR.

Done, thanks!

Gabriel

> 
> Thanks
> Hangbin
> 
>