Re: [PATCH net v2] ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

["dongchenchen (A)" <dongchenchen2@huawei.com>]

在 2026/8/17 22:15, Ido Schimmel 写道:
> On Sat, Aug 15, 2026 at 03:51:02PM +0800, Dong Chenchen wrote:
>> When the forward output route cannot be used in icmp_route_lookup(),
>> it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr,
>> the original packet's source address.
>>
>> ip_route_input() only returns an error for truly invalid packets. For
>> unreachable addresses it will succeed and return an input route whose
>> dst.output is set to ip_rt_bug(). The existing check only rejects
>> RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned
>> and later used for output, syzkaller triggering a WARN_ON_ONCE()
>> in ip_rt_bug() as bellow:
>>
>>   ------------[ cut here ]------------
>>   WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20
>>   RIP: 0010:ip_rt_bug+0x14/0x20
>>   Call Trace:
>>    ip_push_pending_frames+0xfa/0x100
>>    __icmp_send+0x905/0xf10
>>    ip_options_compile+0xc0/0xd0
>>    ip_rcv_finish_core+0x321/0xae0
>>    ip_rcv+0x1de/0x260
>>    __netif_receive_skb_one_core+0x11a/0x130
>>    netif_receive_skb+0x7b/0x260
>>    tun_get_user+0x11bf/0x1c10
>>   ------------[ cut here ]------------
>>
>> Reject any input route that is RTN_UNREACHABLE to fix it.
>>
>> Fixes: 8b7817f3a959 ("[IPSEC]: Add ICMP host relookup support")
>> Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com>
> 
> FYI, there's a new policy regarding AI review:
> 
> "
> Patch authors are expected to proactively look into the AI-generated
> reviews and handle such feedback as any other kind of review: either
> debate it or address it. In both cases a reply on the mailing list is
> expected.
> "
> 
> https://docs.kernel.org/next/process/maintainer-netdev.html#review-timelines
> 
>> ---
>>   net/ipv4/icmp.c | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
>> index 0caedfc7ca92..4703d8dd6b47 100644
>> --- a/net/ipv4/icmp.c
>> +++ b/net/ipv4/icmp.c
>> @@ -585,11 +585,11 @@ static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4,
>>   		 * checked fl4_dec.saddr above). However, a race condition
>>   		 * may occur if the address is added to the interface
>>   		 * concurrently. In that case, ip_route_input() returns a
>> -		 * LOCAL route with dst.output=ip_rt_bug, which must not
>> -		 * be used for output.
>> +		 * LOCAL or UNREACHABLE route with dst.output=ip_rt_bug,
>> +		 * which must not be used for output.
>>   		 */
> 
> Why would the addition of an address lead to RTN_UNREACHABLE? This seems
> to be true for RTN_LOCAL, but not for RTN_UNREACHABLE. Similarly, it
> doesn't seem like RTN_UNREACHABLE is the result of a race condition.
> 
> The comment needs to be reworded to reflect that.
> 
Thanks for review!
RTN_UNREACHABLE scenario indeed does not require contention conditions.
v3 will be sent.

Best regards
Dong Chenchen>> -		if (!err && rt2 && rt2->rt_type == RTN_LOCAL) {
>> -			net_warn_ratelimited("detected local route for %pI4 during ICMP sending, src %pI4\n",
>> +		if (!err && rt2 && (rt2->rt_type == RTN_LOCAL || rt2->rt_type == RTN_UNREACHABLE)) {
>> +			net_warn_ratelimited("detected unusable input route for %pI4 during ICMP sending, src %pI4\n",
>>   					     &fl4_dec.daddr, &fl4_dec.saddr);
> 
> The check is fine, but if RTN_UNREACHABLE is not the result of a race
> condition, then net_warn_ratelimited() should only be emitted for
> RTN_LOCAL.
> 
>>   			dst_release(&rt2->dst);
>>   			err = -EINVAL;
>> -- 
>> 2.25.1
>>
>