[LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Martin Doucha]

The icmp_msgs_burst sysfile was added to non-root namespaces in kernel
v6.12. Older kernels allow changing the value only from the root
namespace. Set the global limit first, then change the test namespace
limit as well if needed.

Fixes: 3c4c712f1f9b ("cve: icmp_rate_limit: set icmp_msgs_burst within network namespace")
Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 testcases/cve/icmp_rate_limit01.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index 5193c5dfd..37bc71cb8 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -62,7 +62,12 @@ static void setup(void)
 	/* Do NOT close this FD, or both interfaces will be destroyed */
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
-	SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
+	/*
+	 * Set namespace local rate limit if needed. The global limit might
+	 * be ignored otherwise.
+	 */
+	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
+		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
 
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
@@ -257,6 +262,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
+		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},
 		{}
 	},
 	.tags = (const struct tst_tag[]) {
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] icmp_rate_limit01: Fix rate limit change on older kernels

[linuxtestproject.agent]

Hi Martin,

On Wed, 29 Apr 2026 14:11:27 +0200, Martin Doucha wrote:
> icmp_rate_limit01: Fix rate limit change on older kernels

> +	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
> +		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");

SAFE_ACCESS() exists in tst_safe_macros.h, but since it calls tst_brk()
on failure it cannot be used here — file absence is the expected case on
pre-v6.12 kernels and handling it gracefully is the whole point. Is raw
access() acceptable for this feature-probe pattern, or should a different
idiom be used?

Pre-existing issues noticed in the surrounding code (not introduced
by this patch):

- testcases/cve/icmp_rate_limit01.c:203 — sleep(2) in packet_batch()
  used to wait for ICMP responses; consider a poll-based approach.

---
Note:

Our agent completed the review of the patch.

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Andrea Cervesato via ltp]

Hi Martin,

> The icmp_msgs_burst sysfile was added to non-root namespaces in kernel
> v6.12. Older kernels allow changing the value only from the root
> namespace. Set the global limit first, then change the test namespace
> limit as well if needed.
> 
> Fixes: 3c4c712f1f9b ("cve: icmp_rate_limit: set icmp_msgs_burst within network namespace")
> Signed-off-by: Martin Doucha <mdoucha@suse.cz>
> ---
>  testcases/cve/icmp_rate_limit01.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
> index 5193c5dfd..37bc71cb8 100644
> --- a/testcases/cve/icmp_rate_limit01.c
> +++ b/testcases/cve/icmp_rate_limit01.c
> @@ -62,7 +62,12 @@ static void setup(void)
>  	/* Do NOT close this FD, or both interfaces will be destroyed */
>  	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
>  
> -	SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
> +	/*
> +	 * Set namespace local rate limit if needed. The global limit might
> +	 * be ignored otherwise.
> +	 */
> +	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
> +		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
>  
>  	/* Configure child namespace */
>  	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
> @@ -257,6 +262,7 @@ static struct tst_test test = {
>  	},
>  	.save_restore = (const struct tst_path_val[]) {
>  		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
> +		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},

Shouldn't we use TST_SR_SKIP_MISSING here instead of TBROK?

Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Martin Doucha]

On 5/6/26 11:12, Andrea Cervesato wrote:
> Hi Martin,
> 
>> @@ -257,6 +262,7 @@ static struct tst_test test = {
>>   	},
>>   	.save_restore = (const struct tst_path_val[]) {
>>   		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
>> +		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},
> 
> Shouldn't we use TST_SR_SKIP_MISSING here instead of TBROK?

Hi,
this .save_restore line references the icmp_msgs_burst sysfile in global 
network namespace which exists on all kernels since v3.18 if they have 
IPv4 support enabled. I guess we should add CONFIG_INET to 
.needs_kconfigs but otherwise the .save_restore is correct.

The access() check in setup(), on the other hand, searches for the same 
file in nested network namespaces where it may be missing on much more 
recent kernels.

-- 
Martin Doucha   mdoucha@suse.cz
SW Quality Engineer
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Cyril Hrubis]

Hi!
> >> @@ -257,6 +262,7 @@ static struct tst_test test = {
> >>   	},
> >>   	.save_restore = (const struct tst_path_val[]) {
> >>   		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
> >> +		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},
> > 
> > Shouldn't we use TST_SR_SKIP_MISSING here instead of TBROK?
> 
> Hi,
> this .save_restore line references the icmp_msgs_burst sysfile in global 
> network namespace which exists on all kernels since v3.18 if they have 
> IPv4 support enabled. I guess we should add CONFIG_INET to 
> .needs_kconfigs but otherwise the .save_restore is correct.

Sounds good to me. Feel free to add my Reviewed-by: to a patch with
CONFIG_INET in the .needs_kconfigs

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Cyril Hrubis]

Hi!
Pushed with the suggested change, thanks.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp