From: Ido Schimmel <idosch@nvidia.com>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, David Ahern <dsahern@kernel.org>,
netdev@vger.kernel.org, eric.dumazet@gmail.com
Subject: Re: [PATCH net] net: do not send ICMP/NDISC Redirects when peer allocation fails
Date: Sun, 26 Jul 2026 17:06:01 +0300 [thread overview]
Message-ID: <20260726140601.GA388109@shredder> (raw)
In-Reply-To: <20260724072901.1633601-1-edumazet@google.com>
On Fri, Jul 24, 2026 at 07:29:01AM +0000, Eric Dumazet wrote:
> When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry
> under memory pressure or tree size caps, redirect handlers previously fell
> back to sending un-rate-limited ICMP/NDISC Redirect messages.
>
> In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.
> In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into
> inet_peer_xrlim_allow(), which returned true when peer == NULL.
>
> Because ICMP/NDISC Redirects are not part of the default global rate limit
> mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates
> an un-rate-limited ICMP packet storm.
>
> Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and
> ndisc_send_redirect() when peer is NULL.
>
> Fixes: 92d868292634 ("inetpeer: Move ICMP rate limiting state into inet_peer entries.")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
prev parent reply other threads:[~2026-07-26 14:06 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 7:29 [PATCH net] net: do not send ICMP/NDISC Redirects when peer allocation fails Eric Dumazet
2026-07-24 13:42 ` Jakub Kicinski
2026-07-24 14:15 ` Eric Dumazet
2026-07-24 14:20 ` Jakub Kicinski
2026-07-26 14:06 ` Ido Schimmel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260726140601.GA388109@shredder \
--to=idosch@nvidia.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.