* [PATCH net] ip_tunnel: drop stale dst from generated PMTU ICMP replies
@ 2026-06-13 1:00 Laika Price via B4 Relay
2026-06-13 7:03 ` Paolo Abeni
0 siblings, 1 reply; 2+ messages in thread
From: Laika Price via B4 Relay @ 2026-06-13 1:00 UTC (permalink / raw)
To: David Ahern, Ido Schimmel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman
Cc: netdev, linux-kernel, Laika Price
From: Laika Price <laikabcprice@gmail.com>
iptunnel_pmtud_build_icmp(...) and iptunnel_pmtud_build_icmpv6(...) take
in an sk_buff, modify it to create a PMTU ICMP error reply, and return it.
As part of these modifications, the source/destination ethernet and IP
addresses are swapped around which makes the sk_buff's current dst invalid.
If the stale dst is left, the packet can skip input routing and be
forwarded using the original output device. This was observed when sending
packets to a VXLAN over a WireGuard tunnel - the ICMP reply was generated
but it was sent over the VXLAN instead of to the WireGuard tunnel.
Drop the stale dst after building the PMTU reply so that the packet is
routed using its new headers when it is reinjected.
Signed-off-by: Laika Price <laikabcprice@gmail.com>
---
net/ipv4/ip_tunnel_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index d3c677e9b..949150e43 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -267,6 +267,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu)
eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
skb_reset_mac_header(skb);
+ skb_dst_drop(skb);
return skb->len;
}
@@ -370,6 +371,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu)
eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
skb_reset_mac_header(skb);
+ skb_dst_drop(skb);
return skb->len;
}
---
base-commit: 2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0
change-id: 20260613-master-a299166b9069
Best regards,
--
Laika Price <laikabcprice@gmail.com>
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] ip_tunnel: drop stale dst from generated PMTU ICMP replies
2026-06-13 1:00 [PATCH net] ip_tunnel: drop stale dst from generated PMTU ICMP replies Laika Price via B4 Relay
@ 2026-06-13 7:03 ` Paolo Abeni
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Abeni @ 2026-06-13 7:03 UTC (permalink / raw)
To: laikabcprice, David Ahern, Ido Schimmel, David S. Miller,
Eric Dumazet, Jakub Kicinski, Simon Horman
Cc: netdev, linux-kernel
On 6/13/26 3:00 AM, Laika Price via B4 Relay wrote:
> From: Laika Price <laikabcprice@gmail.com>
>
> iptunnel_pmtud_build_icmp(...) and iptunnel_pmtud_build_icmpv6(...) take
> in an sk_buff, modify it to create a PMTU ICMP error reply, and return it.
> As part of these modifications, the source/destination ethernet and IP
> addresses are swapped around which makes the sk_buff's current dst invalid.
>
> If the stale dst is left, the packet can skip input routing and be
> forwarded using the original output device. This was observed when sending
> packets to a VXLAN over a WireGuard tunnel - the ICMP reply was generated
> but it was sent over the VXLAN instead of to the WireGuard tunnel.
>
> Drop the stale dst after building the PMTU reply so that the packet is
> routed using its new headers when it is reinjected.
>
> Signed-off-by: Laika Price <laikabcprice@gmail.com>
> ---
> net/ipv4/ip_tunnel_core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
> index d3c677e9b..949150e43 100644
> --- a/net/ipv4/ip_tunnel_core.c
> +++ b/net/ipv4/ip_tunnel_core.c
> @@ -267,6 +267,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu)
>
> eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
> skb_reset_mac_header(skb);
> + skb_dst_drop(skb);
>
> return skb->len;
> }
> @@ -370,6 +371,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu)
>
> eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
> skb_reset_mac_header(skb);
> + skb_dst_drop(skb);
>
> return skb->len;
> }
>
This apparently causes self-tests pmtu failure for the virtio_net device:
# 135.54 [+6.50] TEST: IPv4, bridged vxlan4: PMTU exceptions
[FAIL]
# 142.17 [+6.63] TEST: IPv4, bridged vxlan4: PMTU exceptions - nexthop
objects [FAIL]
# 148.71 [+6.53] TEST: IPv6, bridged vxlan4: PMTU exceptions
[FAIL]
# 155.44 [+6.74] TEST: IPv6, bridged vxlan4: PMTU exceptions - nexthop
objects [FAIL]
# 161.94 [+6.49] TEST: IPv4, bridged vxlan6: PMTU exceptions
[FAIL]
# 168.69 [+6.76] TEST: IPv4, bridged vxlan6: PMTU exceptions - nexthop
objects [FAIL]
# 175.01 [+6.32] TEST: IPv6, bridged vxlan6: PMTU exceptions
[FAIL]
# 181.83 [+6.82] TEST: IPv6, bridged vxlan6: PMTU exceptions - nexthop
objects [FAIL]
# 188.42 [+6.59] TEST: IPv4, bridged geneve4: PMTU exceptions
[FAIL]
# 195.31 [+6.89] TEST: IPv4, bridged geneve4: PMTU exceptions - nexthop
objects [FAIL]
# 201.99 [+6.68] TEST: IPv6, bridged geneve4: PMTU exceptions
[FAIL]
# 209.10 [+7.11] TEST: IPv6, bridged geneve4: PMTU exceptions - nexthop
objects [FAIL]
# 216.12 [+7.02] TEST: IPv4, bridged geneve6: PMTU exceptions
[FAIL]
# 223.36 [+7.23] TEST: IPv4, bridged geneve6: PMTU exceptions - nexthop
objects [FAIL]
# 230.26 [+6.90] TEST: IPv6, bridged geneve6: PMTU exceptions
[FAIL]
# 237.52 [+7.26] TEST: IPv6, bridged geneve6: PMTU exceptions - nexthop
objects [FAIL]
# 264.58 [+27.06] TEST: IPv4, OVS vxlan4: PMTU exceptions
[FAIL]
# 293.85 [+29.27] TEST: IPv4, OVS vxlan4: PMTU exceptions - nexthop
objects [FAIL]
# 322.61 [+28.76] TEST: IPv6, OVS vxlan4: PMTU exceptions
[FAIL]
# 350.36 [+27.75] TEST: IPv6, OVS vxlan4: PMTU exceptions - nexthop
objects [FAIL]
# 376.99 [+26.62] TEST: IPv4, OVS vxlan6: PMTU exceptions
[FAIL]
# 404.00 [+27.02] TEST: IPv4, OVS vxlan6: PMTU exceptions - nexthop
objects [FAIL]
# 429.71 [+25.71] TEST: IPv6, OVS vxlan6: PMTU exceptions
[FAIL]
# 455.60 [+25.88] TEST: IPv6, OVS vxlan6: PMTU exceptions - nexthop
objects [FAIL]
# 481.32 [+25.72] TEST: IPv4, OVS geneve4: PMTU exceptions
[FAIL]
# 507.38 [+26.06] TEST: IPv4, OVS geneve4: PMTU exceptions - nexthop
objects [FAIL]
# 533.62 [+26.24] TEST: IPv6, OVS geneve4: PMTU exceptions
[FAIL]
# 560.92 [+27.30] TEST: IPv6, OVS geneve4: PMTU exceptions - nexthop
objects [FAIL]
# 588.20 [+27.29] TEST: IPv4, OVS geneve6: PMTU exceptions
[FAIL]
# 615.22 [+27.02] TEST: IPv4, OVS geneve6: PMTU exceptions - nexthop
objects [FAIL]
# 641.40 [+26.18] TEST: IPv6, OVS geneve6: PMTU exceptions
[FAIL]
# 666.47 [+25.07] TEST: IPv6, OVS geneve6: PMTU exceptions - nexthop
objects [FAIL]
See:
https://github.com/linux-netdev/nipa/wiki/How-to-run-netdev-selftests-CI-style
on how to reproduce that results.
/P
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-13 7:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-13 1:00 [PATCH net] ip_tunnel: drop stale dst from generated PMTU ICMP replies Laika Price via B4 Relay
2026-06-13 7:03 ` Paolo Abeni
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox