Re: [PATCH net] tunnels: Drop stale dst when building an ICMP error for PMTUD

On Wed, Sep 02, 2026 at 10:01:12PM +0300, Ido Schimmel wrote:

Bridged UDP tunnels such as VXLAN and GENEVE build an ICMP error packet
around an overlay packet if the packet is going to exceed the underlay
path MTU. The ICMP error packet is then injected back into the Rx path
with the source and destination addresses swapped, so that it will be
delivered to the overlay source.

If the overlay packet was routed to the UDP tunnel or locally generated,
then it is already carrying a valid dst entry and this entry is not
dropped when transforming the packet to an ICMP error packet. This
causes the IP layer to reuse the dst entry, leading to the ICMP error
packet being dropped or routed out of the UDP tunnel interface in case
of forwarding.

Good catch, thanks!

Reviewed-by: Guillaume Nault <redacted>