[LTP] [PATCH] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[Brian Grech]

On debug kernels with CONFIG_PROVE_LOCKING or PREEMPT_RT, each socket
operation (bind, sendto) takes ~3-4ms instead of <0.5ms on a normal
kernel. At the default icmp_msgs_per_sec=1000, the token bucket refills
~371 tokens during the 371ms it takes to send 100 packets, so rate
limiting never engages and all batches return identical error counts,
causing a false TFAIL.

Lower icmp_msgs_per_sec to 10 in both the global save_restore and the
child network namespace. At 10/sec the bucket cannot meaningfully refill
during the send loop regardless of kernel speed, while the 2s inter-batch
sleep still allows full credit recovery (10 * 2 = 20 = burst).

Also add PATH_IPV4_ICMP_MSGS_PER_SEC to tst_path_defs.h alongside the
existing PATH_IPV4_ICMP_MSGS_BURST macro.

Assisted-by: ClaudeCode:claude-sonnet-4-6
Signed-off-by: Brian Grech <bgrech@redhat.com>
---
 include/tst_path_defs.h           |  1 +
 testcases/cve/icmp_rate_limit01.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/tst_path_defs.h b/include/tst_path_defs.h
index 1a60028d3..35fb24274 100644
--- a/include/tst_path_defs.h
+++ b/include/tst_path_defs.h
@@ -79,6 +79,7 @@
 #define PATH_IPV4_ICMP_RATEMASK			"/proc/sys/net/ipv4/icmp_ratemask"
 #define PATH_IPV4_ICMP_ECHO_IGNORE_ALL		"/proc/sys/net/ipv4/icmp_echo_ignore_all"
 #define PATH_IPV4_ICMP_MSGS_BURST		"/proc/sys/net/ipv4/icmp_msgs_burst"
+#define PATH_IPV4_ICMP_MSGS_PER_SEC		"/proc/sys/net/ipv4/icmp_msgs_per_sec"
 #define PATH_IPV4_TCP_PROBE_INTERVAL		"/proc/sys/net/ipv4/tcp_probe_interval"
 #define PATH_IPV4_TCP_KEEPALIVE_TIME		"/proc/sys/net/ipv4/tcp_keepalive_time"
 #define PATH_IPV4_TCP_NOTSENT_LOWAT		"/proc/sys/net/ipv4/tcp_notsent_lowat"
diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index ee2e73544..fa10ae58f 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -63,12 +63,17 @@ static void setup(void)
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
 	/*
-	 * Set namespace local rate limit if needed. The global limit might
-	 * be ignored otherwise.
+	 * Set namespace local rate limits if needed. The global limits might
+	 * be ignored otherwise. Lower icmp_msgs_per_sec to ensure rate limiting
+	 * engages even on slow debug kernels where the send loop takes long
+	 * enough that the token bucket refills mid-batch at the default 1000/sec.
 	 */
 	if (!access(PATH_IPV4_ICMP_MSGS_BURST, F_OK))
 		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_BURST, "50");
 
+	if (!access(PATH_IPV4_ICMP_MSGS_PER_SEC, F_OK))
+		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_PER_SEC, "10");
+
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
 	NETDEV_ADD_ADDRESS_INET("ltp_veth2", htonl(DSTADDR), NETMASK,
@@ -263,6 +268,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{PATH_IPV4_ICMP_MSGS_BURST, "50", TST_SR_TBROK},
+		{PATH_IPV4_ICMP_MSGS_PER_SEC, "10", TST_SR_SKIP},
 		{PATH_USER_MAX_USER_NAMESPACES, "1024", TST_SR_SKIP},
 		{}
 	},
-- 
2.55.0