[PATCH net 0/2] vxlan: keep reserved_bits on changelink

[PATCH net 0/2] vxlan: keep reserved_bits on changelink

[Hannes Laimer]

Currently reserved_bits are reset on every changelink. This leads to
packets using extensions that were enabled on creation being dropped
after a changelink. The first commit describes the problem and
solution in more detail and the second just adds a selftest for this.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
Hannes Laimer (2):
      vxlan: keep reserved_bits across changelink
      selftests: forwarding: vxlan_reserved: add gbp changelink test

 drivers/net/vxlan/vxlan_core.c                           |  2 +-
 tools/testing/selftests/net/forwarding/vxlan_reserved.sh | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)
---
base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
change-id: 20261023-b4-vxlan-changelink-gbp-de5e81eed8d1

Best regards,
--  
Hannes Laimer <h.laimer@proxmox.com>

[PATCH net 1/2] vxlan: keep reserved_bits across changelink

[Hannes Laimer]

vxlan_nl2conf() derives reserved_bits from the extension attributes
set in the netlink message if IFLA_VXLAN_RESERVED_BITS is absent. A
changelink having it set is rejected, so this means that every
changelink will reset all extension bits and reserve them again.
vxlan_nl2flag() rejects setting a flag on an attribute that is
create-only on changelink. So also setting an extension attribute will
fail before it can un-reserve its fields.

The extension's header bits being reserved again then makes
vxlan_rcv() drop frames that have them set in their header as invalid.
The device still reports the extension as enabled, because only the
reserved_bits are rebuilt and the flags are just copied.

A simple reproducer is

    ip link add vxgbp type vxlan id 1 dstport 4789 local 10.0.0.1 gbp
    ip link set dev vxgbp type vxlan ageing 300

After setting the unrelated ageing, incoming packets with the GBP bit
set in the header start getting dropped.

Keeping the reserved_bits on changelink is safe because anything a
changelink accepts leaves the header bits enabled extensions use
unchanged.

Ran into this when adding support for the GBP flag in ifupdown2, see
link below. The device kept dropping packets after some time, it
turned out it always started after a changelink.

Tested this by changing ageing by hand on a vxlan device that was
created by ifupdown2 with the gbp flag, and checking the reserved bits
using

    ip -d link show vxgbp | grep -o 'reserved_bits 0x[0-9a-f]*'

Without the fix I got 0xf7ffffff000000ff after the changelink, and
with the fix it stayed 0x77000000000000ff. The following patch
contains a selftest that fails without the fix and passes with it.

Fixes: e4f8647767cf ("vxlan: Track reserved bits explicitly as part of the configuration")
Link: https://lore.proxmox.com/pve-devel/20260828134708.692354-1-h.laimer@proxmox.com/
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 drivers/net/vxlan/vxlan_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 278d41f58d89..223539099778 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -4488,7 +4488,7 @@ static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
 		}
 
 		conf->reserved_bits = reserved_bits;
-	} else {
+	} else if (!changelink) {
 		/* For backwards compatibility, only allow reserved fields to be
 		 * used by VXLAN extensions if explicitly requested.
 		 */

-- 
2.47.3

[PATCH net 2/2] selftests: forwarding: vxlan_reserved: add gbp changelink test

[Hannes Laimer]

On a device created with gbp, run the reserved bit probes before and
after an unrelated changelink. Check that what the device accepts has
not changed.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 tools/testing/selftests/net/forwarding/vxlan_reserved.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/testing/selftests/net/forwarding/vxlan_reserved.sh b/tools/testing/selftests/net/forwarding/vxlan_reserved.sh
index 709845123727..0ce264cc57f8 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_reserved.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_reserved.sh
@@ -40,6 +40,7 @@
 	reserved_31_test
 	reserved_56_test
 	reserved_63_test
+	gbp_changelink_test
     "}
 
 NUM_NETIFS=4
@@ -338,6 +339,20 @@ reserved_63_test()
 	    reserved_test 63
 }
 
+gbp_changelink_test_do()
+{
+	vxlan_device_add gbp
+	__default_test_do 25 "gbp"
+	ip link set dev vx1 type vxlan ageing 300
+	__default_test_do 25 "gbp after changelink"
+}
+
+gbp_changelink_test()
+{
+	in_defer_scope \
+	    gbp_changelink_test_do
+}
+
 trap cleanup EXIT
 
 setup_prepare

-- 
2.47.3

Re: [PATCH net 0/2] vxlan: keep reserved_bits on changelink

[Gabriel Goller]

On 23.10.2026 13:14, Hannes Laimer wrote:
> Currently reserved_bits are reset on every changelink. This leads to
> packets using extensions that were enabled on creation being dropped
> after a changelink. The first commit describes the problem and
> solution in more detail and the second just adds a selftest for this.
> 
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>

Gave it a quick spin in a vng instance, consider:

Tested-by: Gabriel Goller <g.goller@proxmox.com>
Reviewed-by: Gabriel Goller <g.goller@proxmox.com>

> ---
> Hannes Laimer (2):
>       vxlan: keep reserved_bits across changelink
>       selftests: forwarding: vxlan_reserved: add gbp changelink test
> 
>  drivers/net/vxlan/vxlan_core.c                           |  2 +-
>  tools/testing/selftests/net/forwarding/vxlan_reserved.sh | 15 +++++++++++++++
>  2 files changed, 16 insertions(+), 1 deletion(-)
> ---
> base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
> change-id: 20261023-b4-vxlan-changelink-gbp-de5e81eed8d1
> 
> Best regards,
> --  
> Hannes Laimer <h.laimer@proxmox.com>