[LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Martin Doucha]

The icmp_msgs_burst sysfile was added to non-root namespaces in kernel
v6.12. Older kernels allow changing the value only from the root
namespace. Set the global limit first, then change the test namespace
limit as well if needed.

Fixes: 3c4c712f1f9b ("cve: icmp_rate_limit: set icmp_msgs_burst within network namespace")
Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 testcases/cve/icmp_rate_limit01.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index 5193c5dfd..37bc71cb8 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -62,7 +62,12 @@ static void setup(void)
 	/* Do NOT close this FD, or both interfaces will be destroyed */
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
-	SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
+	/*
+	 * Set namespace local rate limit if needed. The global limit might
+	 * be ignored otherwise.
+	 */
+	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
+		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
 
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
@@ -257,6 +262,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
+		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},
 		{}
 	},
 	.tags = (const struct tst_tag[]) {
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] icmp_rate_limit01: Fix rate limit change on older kernels

[linuxtestproject.agent]

Hi Martin,

On Wed, 29 Apr 2026 14:11:27 +0200, Martin Doucha wrote:
> icmp_rate_limit01: Fix rate limit change on older kernels

> +	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
> +		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");

SAFE_ACCESS() exists in tst_safe_macros.h, but since it calls tst_brk()
on failure it cannot be used here — file absence is the expected case on
pre-v6.12 kernels and handling it gracefully is the whole point. Is raw
access() acceptable for this feature-probe pattern, or should a different
idiom be used?

Pre-existing issues noticed in the surrounding code (not introduced
by this patch):

- testcases/cve/icmp_rate_limit01.c:203 — sleep(2) in packet_batch()
  used to wait for ICMP responses; consider a poll-based approach.

---
Note:

Our agent completed the review of the patch.

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] icmp_rate_limit01: Fix rate limit change on older kernels

[Andrea Cervesato via ltp]

Hi Martin,

> The icmp_msgs_burst sysfile was added to non-root namespaces in kernel
> v6.12. Older kernels allow changing the value only from the root
> namespace. Set the global limit first, then change the test namespace
> limit as well if needed.
> 
> Fixes: 3c4c712f1f9b ("cve: icmp_rate_limit: set icmp_msgs_burst within network namespace")
> Signed-off-by: Martin Doucha <mdoucha@suse.cz>
> ---
>  testcases/cve/icmp_rate_limit01.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
> index 5193c5dfd..37bc71cb8 100644
> --- a/testcases/cve/icmp_rate_limit01.c
> +++ b/testcases/cve/icmp_rate_limit01.c
> @@ -62,7 +62,12 @@ static void setup(void)
>  	/* Do NOT close this FD, or both interfaces will be destroyed */
>  	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
>  
> -	SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
> +	/*
> +	 * Set namespace local rate limit if needed. The global limit might
> +	 * be ignored otherwise.
> +	 */
> +	if (!access("/proc/sys/net/ipv4/icmp_msgs_burst", F_OK))
> +		SAFE_FILE_PRINTF("/proc/sys/net/ipv4/icmp_msgs_burst", "50");
>  
>  	/* Configure child namespace */
>  	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
> @@ -257,6 +262,7 @@ static struct tst_test test = {
>  	},
>  	.save_restore = (const struct tst_path_val[]) {
>  		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
> +		{"/proc/sys/net/ipv4/icmp_msgs_burst", "50", TST_SR_TBROK},

Shouldn't we use TST_SR_SKIP_MISSING here instead of TBROK?

Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp