[LTP] [PATCH] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[LTP] [PATCH] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[Brian Grech via ltp]

On debug kernels with CONFIG_PROVE_LOCKING or PREEMPT_RT, each socket
operation (bind, sendto) takes ~3-4ms instead of <0.5ms on a normal
kernel. At the default icmp_msgs_per_sec=1000, the token bucket refills
~371 tokens during the 371ms it takes to send 100 packets, so rate
limiting never engages and all batches return identical error counts,
causing a false TFAIL.

Lower icmp_msgs_per_sec to 10 in both the global save_restore and the
child network namespace. At 10/sec the bucket cannot meaningfully refill
during the send loop regardless of kernel speed, while the 2s inter-batch
sleep still allows full credit recovery (10 * 2 = 20 = burst).

Also add PATH_IPV4_ICMP_MSGS_PER_SEC to tst_path_defs.h alongside the
existing PATH_IPV4_ICMP_MSGS_BURST macro.

Assisted-by: ClaudeCode:claude-sonnet-4-6
Signed-off-by: Brian Grech <bgrech@redhat.com>
---
 include/tst_path_defs.h           |  1 +
 testcases/cve/icmp_rate_limit01.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/tst_path_defs.h b/include/tst_path_defs.h
index 1a60028d3..35fb24274 100644
--- a/include/tst_path_defs.h
+++ b/include/tst_path_defs.h
@@ -79,6 +79,7 @@
 #define PATH_IPV4_ICMP_RATEMASK			"/proc/sys/net/ipv4/icmp_ratemask"
 #define PATH_IPV4_ICMP_ECHO_IGNORE_ALL		"/proc/sys/net/ipv4/icmp_echo_ignore_all"
 #define PATH_IPV4_ICMP_MSGS_BURST		"/proc/sys/net/ipv4/icmp_msgs_burst"
+#define PATH_IPV4_ICMP_MSGS_PER_SEC		"/proc/sys/net/ipv4/icmp_msgs_per_sec"
 #define PATH_IPV4_TCP_PROBE_INTERVAL		"/proc/sys/net/ipv4/tcp_probe_interval"
 #define PATH_IPV4_TCP_KEEPALIVE_TIME		"/proc/sys/net/ipv4/tcp_keepalive_time"
 #define PATH_IPV4_TCP_NOTSENT_LOWAT		"/proc/sys/net/ipv4/tcp_notsent_lowat"
diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index ee2e73544..fa10ae58f 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -63,12 +63,17 @@ static void setup(void)
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
 	/*
-	 * Set namespace local rate limit if needed. The global limit might
-	 * be ignored otherwise.
+	 * Set namespace local rate limits if needed. The global limits might
+	 * be ignored otherwise. Lower icmp_msgs_per_sec to ensure rate limiting
+	 * engages even on slow debug kernels where the send loop takes long
+	 * enough that the token bucket refills mid-batch at the default 1000/sec.
 	 */
 	if (!access(PATH_IPV4_ICMP_MSGS_BURST, F_OK))
 		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_BURST, "50");
 
+	if (!access(PATH_IPV4_ICMP_MSGS_PER_SEC, F_OK))
+		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_PER_SEC, "10");
+
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
 	NETDEV_ADD_ADDRESS_INET("ltp_veth2", htonl(DSTADDR), NETMASK,
@@ -263,6 +268,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{PATH_IPV4_ICMP_MSGS_BURST, "50", TST_SR_TBROK},
+		{PATH_IPV4_ICMP_MSGS_PER_SEC, "10", TST_SR_SKIP},
 		{PATH_USER_MAX_USER_NAMESPACES, "1024", TST_SR_SKIP},
 		{}
 	},
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[linuxtestproject.agent]

Hi Brian,

On Wed, 22 Jul 2026, Brian Grech wrote:
> cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

> On debug kernels with CONFIG_PROVE_LOCKING or PREEMPT_RT, each socket
> operation (bind, sendto) takes ~3-4ms instead of <0.5ms on a normal
> kernel. At the default icmp_msgs_per_sec=1000, the token bucket refills
> ~371 tokens during the 371ms it takes to send 100 packets, so rate
> limiting never engages and all batches return identical error counts,
> causing a false TFAIL.

Checking net/ipv4/icmp.c (net_init_ipv4_early() /
icmp_sk_init()), the kernel default for icmp_msgs_per_sec has been
10000, not 1000, since the sysctl was introduced -- 1000 is actually
the default of the unrelated icmp_ratelimit sysctl (a millisecond
delay, not a rate). Is the "1000" default and the derived "~371
tokens in 371ms" figure meant to reference icmp_msgs_per_sec, or was
this confused with icmp_ratelimit? The direction of the fix still
holds either way, but the justification as written doesn't match the
real default.

> Lower icmp_msgs_per_sec to 10 in both the global save_restore and the
> child network namespace. At 10/sec the bucket cannot meaningfully refill
> during the send loop regardless of kernel speed, while the 2s inter-batch
> sleep still allows full credit recovery (10 * 2 = 20 = burst).

Two things don't line up here:

icmp_msgs_burst is set to 50 by this same test
(`{PATH_IPV4_ICMP_MSGS_BURST, "50", TST_SR_TBROK}`), not 20, so "20 =
burst" doesn't hold regardless of rate.

Also, icmp_global_allow() caps the elapsed interval used for the
refill calculation: `delta = min_t(u32, now - oldstamp, HZ);`, so at
most one second's worth of credit (10 tokens at this rate) is ever
added on a single check, no matter how long the real elapsed time
was. After the 2s sleep, the achievable refill is capped at 10, not
20.

Neither burst (50) nor the achievable refill (10) match the "10 * 2
= 20 = burst" statement. This likely doesn't break the practical
effect of the fix -- less refill only makes rate limiting engage
more reliably -- but is the reasoning here intentional, or should the
comment be corrected to reflect the actual kernel behavior?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[Brian Grech via ltp]

On debug kernels with CONFIG_PROVE_LOCKING or PREEMPT_RT, each socket
operation (bind, sendto) takes ~3-4ms instead of <0.5ms on a normal
kernel. The default icmp_msgs_per_sec is 10000; at that rate the token
bucket (burst=50) refills ~37 tokens per 3.7ms inter-packet interval,
so the bucket never drains during the slow send loop and all batches
return identical error counts, causing a false TFAIL.

Lower icmp_msgs_per_sec to 10 so that at most ~0.037 tokens accumulate
per inter-packet interval. The bucket drains during the batch regardless
of kernel speed. Note that icmp_global_allow() caps the refill interval
at HZ jiffies (1 second), so after the 2s inter-batch sleep at most 10
tokens are recovered -- well below the burst of 50 set by this test --
preserving the variability needed to distinguish vulnerable from patched
kernels.

Also add PATH_IPV4_ICMP_MSGS_PER_SEC to tst_path_defs.h alongside the
existing PATH_IPV4_ICMP_MSGS_BURST macro.

Assisted-by: ClaudeCode:claude-sonnet-4-6
Signed-off-by: Brian Grech <bgrech@redhat.com>
---
 include/tst_path_defs.h           |  1 +
 testcases/cve/icmp_rate_limit01.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/tst_path_defs.h b/include/tst_path_defs.h
index 1a60028d3..35fb24274 100644
--- a/include/tst_path_defs.h
+++ b/include/tst_path_defs.h
@@ -79,6 +79,7 @@
 #define PATH_IPV4_ICMP_RATEMASK			"/proc/sys/net/ipv4/icmp_ratemask"
 #define PATH_IPV4_ICMP_ECHO_IGNORE_ALL		"/proc/sys/net/ipv4/icmp_echo_ignore_all"
 #define PATH_IPV4_ICMP_MSGS_BURST		"/proc/sys/net/ipv4/icmp_msgs_burst"
+#define PATH_IPV4_ICMP_MSGS_PER_SEC		"/proc/sys/net/ipv4/icmp_msgs_per_sec"
 #define PATH_IPV4_TCP_PROBE_INTERVAL		"/proc/sys/net/ipv4/tcp_probe_interval"
 #define PATH_IPV4_TCP_KEEPALIVE_TIME		"/proc/sys/net/ipv4/tcp_keepalive_time"
 #define PATH_IPV4_TCP_NOTSENT_LOWAT		"/proc/sys/net/ipv4/tcp_notsent_lowat"
diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index ee2e73544..fa10ae58f 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -63,12 +63,17 @@ static void setup(void)
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
 	/*
-	 * Set namespace local rate limit if needed. The global limit might
-	 * be ignored otherwise.
+	 * Set namespace local rate limits if needed. The global limits might
+	 * be ignored otherwise. Lower icmp_msgs_per_sec to ensure rate limiting
+	 * engages even on slow debug kernels where the send loop takes long
+	 * enough that the token bucket refills mid-batch at the default 1000/sec.
 	 */
 	if (!access(PATH_IPV4_ICMP_MSGS_BURST, F_OK))
 		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_BURST, "50");
 
+	if (!access(PATH_IPV4_ICMP_MSGS_PER_SEC, F_OK))
+		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_PER_SEC, "10");
+
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
 	NETDEV_ADD_ADDRESS_INET("ltp_veth2", htonl(DSTADDR), NETMASK,
@@ -263,6 +268,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{PATH_IPV4_ICMP_MSGS_BURST, "50", TST_SR_TBROK},
+		{PATH_IPV4_ICMP_MSGS_PER_SEC, "10", TST_SR_SKIP},
 		{PATH_USER_MAX_USER_NAMESPACES, "1024", TST_SR_SKIP},
 		{}
 	},
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp