[LTP] [PATCH v2] cve/icmp_rate_limit01: Lower icmp_msgs_per_sec for debug kernel reliability

[Brian Grech]

On debug kernels with CONFIG_PROVE_LOCKING or PREEMPT_RT, each socket
operation (bind, sendto) takes ~3-4ms instead of <0.5ms on a normal
kernel. The default icmp_msgs_per_sec is 10000; at that rate the token
bucket (burst=50) refills ~37 tokens per 3.7ms inter-packet interval,
so the bucket never drains during the slow send loop and all batches
return identical error counts, causing a false TFAIL.

Lower icmp_msgs_per_sec to 10 so that at most ~0.037 tokens accumulate
per inter-packet interval. The bucket drains during the batch regardless
of kernel speed. Note that icmp_global_allow() caps the refill interval
at HZ jiffies (1 second), so after the 2s inter-batch sleep at most 10
tokens are recovered -- well below the burst of 50 set by this test --
preserving the variability needed to distinguish vulnerable from patched
kernels.

Also add PATH_IPV4_ICMP_MSGS_PER_SEC to tst_path_defs.h alongside the
existing PATH_IPV4_ICMP_MSGS_BURST macro.

Assisted-by: ClaudeCode:claude-sonnet-4-6
Signed-off-by: Brian Grech <bgrech@redhat.com>
---
 include/tst_path_defs.h           |  1 +
 testcases/cve/icmp_rate_limit01.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/tst_path_defs.h b/include/tst_path_defs.h
index 1a60028d3..35fb24274 100644
--- a/include/tst_path_defs.h
+++ b/include/tst_path_defs.h
@@ -79,6 +79,7 @@
 #define PATH_IPV4_ICMP_RATEMASK			"/proc/sys/net/ipv4/icmp_ratemask"
 #define PATH_IPV4_ICMP_ECHO_IGNORE_ALL		"/proc/sys/net/ipv4/icmp_echo_ignore_all"
 #define PATH_IPV4_ICMP_MSGS_BURST		"/proc/sys/net/ipv4/icmp_msgs_burst"
+#define PATH_IPV4_ICMP_MSGS_PER_SEC		"/proc/sys/net/ipv4/icmp_msgs_per_sec"
 #define PATH_IPV4_TCP_PROBE_INTERVAL		"/proc/sys/net/ipv4/tcp_probe_interval"
 #define PATH_IPV4_TCP_KEEPALIVE_TIME		"/proc/sys/net/ipv4/tcp_keepalive_time"
 #define PATH_IPV4_TCP_NOTSENT_LOWAT		"/proc/sys/net/ipv4/tcp_notsent_lowat"
diff --git a/testcases/cve/icmp_rate_limit01.c b/testcases/cve/icmp_rate_limit01.c
index ee2e73544..fa10ae58f 100644
--- a/testcases/cve/icmp_rate_limit01.c
+++ b/testcases/cve/icmp_rate_limit01.c
@@ -63,12 +63,17 @@ static void setup(void)
 	childns = SAFE_OPEN("/proc/self/ns/net", O_RDONLY);
 
 	/*
-	 * Set namespace local rate limit if needed. The global limit might
-	 * be ignored otherwise.
+	 * Set namespace local rate limits if needed. The global limits might
+	 * be ignored otherwise. Lower icmp_msgs_per_sec to ensure rate limiting
+	 * engages even on slow debug kernels where the send loop takes long
+	 * enough that the token bucket refills mid-batch at the default 1000/sec.
 	 */
 	if (!access(PATH_IPV4_ICMP_MSGS_BURST, F_OK))
 		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_BURST, "50");
 
+	if (!access(PATH_IPV4_ICMP_MSGS_PER_SEC, F_OK))
+		SAFE_FILE_PRINTF(PATH_IPV4_ICMP_MSGS_PER_SEC, "10");
+
 	/* Configure child namespace */
 	CREATE_VETH_PAIR("ltp_veth1", "ltp_veth2");
 	NETDEV_ADD_ADDRESS_INET("ltp_veth2", htonl(DSTADDR), NETMASK,
@@ -263,6 +268,7 @@ static struct tst_test test = {
 	},
 	.save_restore = (const struct tst_path_val[]) {
 		{PATH_IPV4_ICMP_MSGS_BURST, "50", TST_SR_TBROK},
+		{PATH_IPV4_ICMP_MSGS_PER_SEC, "10", TST_SR_SKIP},
 		{PATH_USER_MAX_USER_NAMESPACES, "1024", TST_SR_SKIP},
 		{}
 	},
-- 
2.55.0