[PATCH net] macvlan: fix allmulti reference counting in passthru mode

[Prasad Koya]

Enabling allmulticast on a down passthru macvlan, bringing it up,
then toggling allmulticast off and on can underflow the lower device's
allmulti reference count.

macvlan_change_rx_flags() only propagates IFF_ALLMULTI changes while
the macvlan is up. However, the passthru path in macvlan_open() skips
taking an allmulti reference when IFF_ALLMULTI is already set.
Clearing allmulticast after opening the device therefore decrements
a reference that was never taken. With no other allmulti users, the
unsigned counter wraps from zero to UINT_MAX. The next increment
fails with -EOVERFLOW and reports "allmulti touches roof".

Signed-off-by: Prasad Koya <prasad@xxxxxxxxxx>
---
Reproducer:

  #!/bin/bash
  set -euo pipefail

  ns=allmulti-test
  host=am-veth0
  peer=am-veth1
  mv=am-mv0

  cleanup()
  {
      ip netns del "$ns" 2>/dev/null || true
  }
  trap cleanup EXIT

  ip netns add "$ns"
  ip link add "$host" type veth peer name "$peer"
  ip link set "$peer" netns "$ns"

  ip link set "$host" up
  ip -n "$ns" link set lo up
  ip -n "$ns" link set "$peer" up

  ip -n "$ns" link add link "$peer" name "$mv" type macvlan mode passthru

  ip -n "$ns" link set dev "$mv" allmulticast on
  ip -n "$ns" link set dev "$mv" up
  ip -n "$ns" link set dev "$mv" allmulticast off
  ip -n "$ns" link set dev "$mv" allmulticast on

 drivers/net/macvlan.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index afad90b9222a..e20d587453d1 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -643,6 +643,14 @@ static int macvlan_open(struct net_device *dev)
 			if (err < 0)
 				goto out;
 		}
+		if (dev->flags & IFF_ALLMULTI) {
+			err = dev_set_allmulti(lowerdev, 1);
+			if (err < 0) {
+				if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
+					dev_set_promiscuity(lowerdev, -1);
+				goto out;
+			}
+		}
 		goto hash_add;
 	}
 
@@ -713,6 +721,8 @@ static int macvlan_stop(struct net_device *dev)
 	dev_mc_unsync(lowerdev, dev);
 
 	if (macvlan_passthru(vlan->port)) {
+		if (dev->flags & IFF_ALLMULTI)
+			dev_set_allmulti(lowerdev, -1);
 		if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
 			dev_set_promiscuity(lowerdev, -1);
 		goto hash_del;

base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
-- 
2.43.0