From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1330A8017D for ; Tue, 22 Sep 2026 15:02:29 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MF17Hh019528; Tue, 22 Sep 2026 18:01:08 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MF17Hh019528 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="MM0TTxcx" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MF0qjs019472 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 22 Sep 2026 18:00:52 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MF0qjs019472 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-486f3dbf7d2so36114f8f.0 for ; Tue, 22 Sep 2026 08:00:52 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBy/hh0jQ+ETT29TdXlTWfdaQNF81IYBU2pw+JgOkUbXHylpS6n6reETGKQMpxGSy/8d1R/CBA==@openvz.org X-Gm-Message-State: AFuF++mgwdnxhhuo69Tr7UscHHX8M4QQ/5s3JoDsJ41rx46FCq5idBYB 994OBXYZJLYoCtyxhjc2fJZrylfq98xDUPefEwtARSs1I1gY58SKh1DsCSZitpDiXq25gwm0ObB nS+FQCODN1iiVeiLsySo6wADnIR9NN4sEEE4I7yq3YchtYPSOmjg2Dw== X-Gm-Gg: AYBFou37AFnOOs1K5ZiF0IbAcbMPU5uRd6206xgOaKh51IblT2WmKDsgYyFQnkAVR3O dK5fqJMbPtzDNd/pvauR9cmH+Bx/bar0vBYa54A3uoxmeIEgCjSsNor6Sc/bFdok53Rpywg0EPy e2c+cBFQN21PRjA1sOWWTlhdo3vXKmKWgjuFpRKutP04VS53ux4/OF6k1qJ11wAKfdFd3m01jGC QBs5OrXGve0D69sJ7EPz2qhrT1LocEkZWkPWHhptinoiTHw8WD5I5KVPp+FMZTK8ql/Zg3UCcAF 5xiyvwaORtRBTI+szO3zyIW35kgCJ+mlO4MakeVAZc20qGzD3Q7J02A0H5ZgGOmvZLUPs5Db3q6 AvwfFvnNTVRqdjI2xVA== X-Received: by 2002:a05:6000:2999:10b0:488:6262:3e61 with SMTP id ffacd0b85a97d-48862623e90mr2521046f8f.15.1790089252162; Tue, 22 Sep 2026 08:00:52 -0700 (PDT) X-Received: by 2002:a05:6000:2999:10b0:488:6262:3e61 with SMTP id ffacd0b85a97d-48862623e90mr2521006f8f.15.1790089251622; Tue, 22 Sep 2026 08:00:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790089251; cv=none; d=google.com; s=arc-20260327; b=BAsUc6bjvREEUKuQeSo1HLXN6X/MB8GjNwfIZfz9qH0rCMR0b7KVGWcK4icMaW2n2M ZivN2s/rvYQ+6zp0EzwM0hyeGmL6zZDflzOlyywKCx4AA/O27yAN08He8yf5ZIy31SOe lVmqiOd3EUm0fFM/bQM1Xm0Wl/oqZZVN3doGDokNLvTJb5VY6/4ULKMwPZKJkqwv8Zfq CykG5EACK1AFLRgasuX7Aq+qowihTok/zqspZ/hyUPYSJ3ONF+c4dv+Xr28dlYdccCVz s0qRBk0npjSbThwE63X04PlwSgFj0Uhvim3+hrvTeQYPzg0QV3aL9Ng6XOKu4YaiTzwH a8fg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=Wzmfqlmt0+BKPaS2mEDvd5yV9thriTA0mQccb9DCsdM=; fh=RDs/3FkPwJ7DtDY3v0qOo3CaTMcY6h5syx0Vq9PC0Z0=; b=P9BaBbkUGNVTUZM10PufmN4A4lthiVus2QS/EFSJTMGHTIFPy3oQeHv2gOR/BuDqh/ b4p8fegWq10MEh/Dn0UsEMZyP2pH6UmzPuNDFBsY6BLffQmHXTN2XqiqFSIfEPzSioRd 6Y2wjXre4XJdRMDLOV5BPb0XOa+S1xOlzI+tvlKHA3o9ToneEHptPzHo5Mwcqisco3Cu 3RCRIqvWkBGVFZGOwbCrvk1KcdUhhHxDZ/NNeLAxqLsBzkXX19WGhAL14Rt2RLI7ddOR aXmxS85rjed+rGUobazqkD+BWQ13FrlylWCjjSkrpa6f/dO7075EBlMwvX3ejQtaoXDv /c/w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=MM0TTxcx; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48864d82ad4si2048923f8f.273.2026.09.22.08.00.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Sep 2026 08:00:51 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=MM0TTxcx; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=Wzmfqlmt0+BKPaS2mEDvd5yV9thriTA0mQccb9DCsdM=; b=MM0TTxcxcyLTIB6/Cuj bGQ4RNsYvl8UEVJufDwunSoQnahYqmMbz4d9k/Ry3VggTnZg/Jj+Y5b2mTnao09ihbrI3LPj2X/eq bVEb8xXCiZuKy7zH1YiudbK3kTaUjRFeMxk2QKWRPO7wy8ScihvEhLYdjYZI7voZfbdHSPGkv3hOb GtAK3wt3qUcE7dRWfocFHBBGTdxxTcpqmEOpOnuIIEJ2Bp1cgDGS+7apTfRsiyxM5rXavdQzYuZvz xNCdN2NIl7TKlGmOWH2nQuDGt4Z7UIiHCQJFqi8Q2vVAQ06rfCvEbB6ut0Nlm4TKLxOUdLnkmX2ZS Nnp+jBAsXwXneBQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x91wN-00DCaA-29; Tue, 22 Sep 2026 17:00:41 +0200 From: Konstantin Khorenko Date: Tue, 22 Sep 2026 17:00:48 +0200 MIME-Version: 1.0 Message-Id: <20260922-b4-kh-self1-v3-5-4548b8d45755@virtuozzo.com> References: <20260922-b4-kh-self1-v3-0-4548b8d45755@virtuozzo.com> In-Reply-To: <20260922-b4-kh-self1-v3-0-4548b8d45755@virtuozzo.com> To: Eva Kurchatova X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4378; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=lzz5plEyXcCY4PVxNYv7vhBwVJFdGdR69Xx7uwpPITU=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqspggvvnFrDP4RVewHa18pEQ4ZFrGH9HLW1pt3 uhXbGBrqmiJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCarKYIAAKCRBRlgpH+WFc KiBBD/0bnG9cta1H0lT7j2cECfIvZlOTCC3JdoYmXCXh4MbBzvyk0cHFR5nQM+DVdH93s45QKZA HHSGbhuggPQPDjTr8cY0uPF4xgj/UGHG6kMOgPTEL/3xxQr4n2Z1YLucwUaOV5HVlPWnI15awkG HWc7IQc+gJTtZQl0APWqGWtIjqYC98GLaULTVHo3ZOetrVQAJ35mCXWeRpJ7f/6FhHlj5WWOJWh ZPzw3uuH4N8BPeju9w0GYwDqwNaUtSW+7u5BzmxPylMNKozfGwUAoTOrKWeWkQ4zb0u8XCSYI/Y l+iPldPY/U8mpOO4bV0DB0P7lb+oZztL6Hl4HdF2DzUa1nszjV5ja1BUP6GPc5LioGhcicOOSs7 WOwmJaMU5eK17/50VkVfeeBL3eG3YEssiNZZF6qSuH0ldgKRF5ll2wNAcIiCDIIqxLVekaqoJj9 IfYVrK/qzT/oKmOhvYkWBurx0Y7M+vdc4+3WK3JqzEGsigTSoXsVGTNteAUXEFxhdsWd5ShGtcc yUSTSSfOc2654B7bvTNWwJobZkFWzQxi41VrWZZj304hePb7M+Z6g/EaCIoYfiIbB6pGCsuR+5m RpmXwJfpMGrstf/plbJS+z96q6FzZiLo0DRq+dcrz37gdU80id1g+WcOPH1EUCNun0mZkfOvyF7 S6cnVznneGQLuWw== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v3 5/5] ms/tunnels: Drop stale dst when building an ICMP error for PMTUD X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Ido Schimmel Bridged UDP tunnels such as VXLAN and GENEVE build an ICMP error packet around an overlay packet if the packet is going to exceed the underlay path MTU. The ICMP error packet is then injected back into the Rx path with the source and destination addresses swapped, so that it will be delivered to the overlay source. If the overlay packet was routed to the UDP tunnel or locally generated, then it is already carrying a valid dst entry and this entry is not dropped when transforming the packet to an ICMP error packet. This causes the IP layer to reuse the dst entry, leading to the ICMP error packet being dropped or routed out of the UDP tunnel interface in case of forwarding. Prior to the blamed commit this could not happen, as skb_tunnel_check_pmtu() did not build ICMP errors for PACKET_HOST packets. Such packets were instead encapsulated and, unless the DF bit was set in the outer header, fragmented by the underlay. Fix this by making sure that the ICMP error packet does not have a valid dst entry, thereby forcing the IP layer to perform a route lookup. Adjust the bridged PMTU exception selftests accordingly. When the local sender in ns_a pings the overlay destination with a deadline (-w), ping exits on the first socket error before any reply is received and returns a non-zero exit code. The test therefore only passed because the ICMP error was never delivered. Use a packet count (-c) like the ns_c line above it, so that the ICMP error counts against the packet budget and the exit code depends on whether echo replies were received. This passes with and without the fix. Fixes: 8930424777e4 ("tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().") Cc: stable@vger.kernel.org Reported-by: Laika Price Closes: https://lore.kernel.org/netdev/20260614-master-v3-1-9f5060ba1ed1@gmail.com/ Reported-by: Yaroslav Dudkov Closes: https://lore.kernel.org/netdev/20260901081825.287173-1-aroslavdudkov622@gmail.com/ Reported-by: Charles Bordet Closes: https://lore.kernel.org/netdev/aHVhQLPJIhq-SYPM@eldamar.lan/ Signed-off-by: Ido Schimmel Tested-by: Yaroslav Dudkov Reviewed-by: David Ahern Reviewed-by: Stefano Brivio Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20260902190112.4126199-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski (cherry picked from commit b58d749633203d92c265317b45fccee555090352) https://virtuozzo.atlassian.net/browse/VSTOR-139651 Feature: fix ms/net Signed-off-by: Konstantin Khorenko --- net/ipv4/ip_tunnel_core.c | 6 ++++++ tools/testing/selftests/net/pmtu.sh | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c index 8392d304a72eb..7e0f0291b7d56 100644 --- a/net/ipv4/ip_tunnel_core.c +++ b/net/ipv4/ip_tunnel_core.c @@ -252,6 +252,9 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0); skb_reset_mac_header(skb); + if (skb_valid_dst(skb)) + skb_dst_drop(skb); + return skb->len; } @@ -348,6 +351,9 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0); skb_reset_mac_header(skb); + if (skb_valid_dst(skb)) + skb_dst_drop(skb); + return skb->len; } diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh index 6c651c880fe83..19b9e099b06bd 100755 --- a/tools/testing/selftests/net/pmtu.sh +++ b/tools/testing/selftests/net/pmtu.sh @@ -1409,7 +1409,7 @@ test_pmtu_ipvX_over_bridged_vxlanY_or_geneveY_exception() { mtu "${ns_b}" ${type}_b $((${ll_mtu} + 1000)) run_cmd ${ns_c} ${ping} -q -M want -i 0.1 -c 10 -s $((${ll_mtu} + 500)) ${dst} || return 1 - run_cmd ${ns_a} ${ping} -q -M want -i 0.1 -w 1 -s $((${ll_mtu} + 500)) ${dst} || return 1 + run_cmd ${ns_a} ${ping} -q -M want -i 0.1 -c 10 -s $((${ll_mtu} + 500)) ${dst} || return 1 # Check that exceptions were created pmtu="$(route_get_dst_pmtu_from_exception "${ns_c}" ${dst})" -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel