From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.216 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793793469; b=N/uT0+kcUvpprQIV1rN2Kx/pjyfLeIFE15GFcBjG8UDI8d4pwIFZHcIG0ycI4j6Kgl6N /78/zCn0aFKuBknfffJPEfEV2lECPfmFi9wmbuzTcYj2BLLUMjPnb1EvteA9KC3DuqYE6 q998o9lvPKkByxtI+sgqsaSKYGXhcFY4gjGqbcgy0Ct69cxzxvydIc8osbMlJsVBZz7EX o5Cv2Q/IQ1dBA+7ukCAc+Hq0nsxyuMoZasoUWVemP3gvrx8lSHtkjxCaNriqMAUFnnIFn Xe2p/hl5+UpVQcs3iP1qbdFlwzJbO75e7OBQI1TdomeMXUJqEAr5ncNVNvMqmcutsvw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793793469; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:MIME-Version:Content-Transfer-Encoding; bh=STtrZRO2YxEVx3H+ha1sUlpeSWj4yt3rSoZpXoj+5so=; b=kjdKGiZe2VNyeoJExxTSaGt75kED7XVl5lMv7IV6/yEh/NBW0xG9soh8Xuo3gxMNm0Hn K+djCnfG+TQOnUnpO22eeVjG/l5l9R5PviA1pvhzqEs8DgBJ2SENE5KWkkcbeAOfJqlNC +3DmBsuIFzeuwkj9APK4dO0ZpVW0A1EPPV4vdxIQNljK4aaxhNmrolxao/1GEPsXQf6Js gRi7GIGR0eBTOgJJniUMtZkkktVRqdJolt36W95uJU1vUOdBXo6pUAh2LtvZXL/yGIhv3 TfbMwhqfetbQ5LfBCyrEcgBPf640GbEoTSSZrbGzWt29mSVCaSm9WJy/q1gfl8WsywQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=GMfjJGR0; arc=none smtp.remote-ip=91.218.175.216 Received: from mta0.migadu.com (out-216.mta0.migadu.com [91.218.175.216]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAECE606A326 for ; Wed, 4 Nov 2026 11:57:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org DAECE606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=GMfjJGR0 X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=9ozzZ0J6mwwASk+DJQ5lOt7LdV8xbNav1SzRVl12KLg=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1793793466; v=1; x=1794398266; b=GMfjJGR0lqO4+dJV4F+jBRzqIx9RTGA9JvfN60PEXutxuzEn2uGGj/XmeyddR2cNtloJmS/X ErXKQQZLBUrl3vAi7YgGaiCcU1BfLh2JbMaKMxFpb1RDFICy5dTZ4ZOq+9dmK1JVkYCvURheR0q kL2POQN8V4HbSVjd0KjM0TFA= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 8e7a7c0b85afa322; Wed, 04 Nov 2026 11:57:45 +0000 X-Mizu-Trace-ID: 8e7a7c0b85afa322 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: netdev@vger.kernel.org Cc: Jiayuan Chen , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Willem de Bruijn , Kees Cook , Jeff Layton , Runyu Xiao , Breno Leitao , "Gustavo A. R. Silva" , Joe Damato , Stanislav Fomichev , Li RongQing , linux-kernel@vger.kernel.org Subject: [PATCH net] net: raw: fix ICMP unreachable sent when receive queue is full Date: Wed, 4 Nov 2026 19:57:26 +0800 Message-ID: <20261104115732.322151-1-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit It's found in a raw socket application. When the application doesn't read packets in time, the client receives ICMP Protocol Unreachable, which makes the client abort the session. The reason is that the server hits the sk_rcvbuf limit, and raw_v4_input() skips the socket before setting 'delivered', so it returns 0. Then ip_protocol_deliver_rcu() sees 'raw' is 0, thinks no one handles this protocol and calls icmp_send() to send ICMP Protocol Unreachable. IPv6 has the same issue, ip6_protocol_deliver_rcu() sends ICMPv6 Parameter Problem instead. Also, we'd better run icmp_filter() and ip_mc_sf_allow() (icmpv6_filter() for IPv6) before we check sk_rcvbuf, otherwise packets rejected by ICMP_FILTER/ICMPV6_FILTER or the multicast filter are counted in sk_drops. So move the check right before skb_clone(). Fixes: d721812aa875 ("ipv4: raw: check sk->sk_rcvbuf earlier") Fixes: 026763ece881 ("ipv6: raw: check sk->sk_rcvbuf earlier") Signed-off-by: Jiayuan Chen --- net/ipv4/raw.c | 15 ++++++++------- net/ipv6/raw.c | 15 ++++++++------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 9d01006d8189..f33a9dfc5309 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -182,18 +182,19 @@ static int raw_v4_input(struct net *net, struct sk_buff *skb, iph->saddr, iph->daddr, dif, sdif)) continue; - if (atomic_read(&sk->sk_rmem_alloc) >= - READ_ONCE(sk->sk_rcvbuf)) { - sk_drops_inc(sk); - continue; - } - delivered = 1; if ((iph->protocol != IPPROTO_ICMP || !icmp_filter(sk, skb)) && ip_mc_sf_allow(sk, iph->daddr, iph->saddr, skb->dev->ifindex, sdif)) { - struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC); + struct sk_buff *clone; + + if (atomic_read(&sk->sk_rmem_alloc) >= + READ_ONCE(sk->sk_rcvbuf)) { + sk_drops_inc(sk); + continue; + } + clone = skb_clone(skb, GFP_ATOMIC); /* Not releasing hash table! */ if (clone) raw_rcv(sk, clone); diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index b965258cf9e5..eb99f4a906ec 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -160,12 +160,6 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) inet6_iif(skb), inet6_sdif(skb))) continue; - if (atomic_read(&sk->sk_rmem_alloc) >= - READ_ONCE(sk->sk_rcvbuf)) { - sk_drops_inc(sk); - continue; - } - delivered = true; switch (nexthdr) { case IPPROTO_ICMPV6: @@ -197,8 +191,15 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) if (filtered < 0) break; if (filtered == 0) { - struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC); + struct sk_buff *clone; + + if (atomic_read(&sk->sk_rmem_alloc) >= + READ_ONCE(sk->sk_rcvbuf)) { + sk_drops_inc(sk); + continue; + } + clone = skb_clone(skb, GFP_ATOMIC); /* Not releasing hash table! */ if (clone) rawv6_rcv(sk, clone); -- 2.43.0