Re: [PATCH net-next v3] net: dropreason: add SKB_DROP_REASON_IP_TTL_EXCEEDED
From: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: 2026-09-04 04:05:10
Also in:
lkml
on 9/4/26 11:01 AM, Junjie Cao wrote:
The forwarding paths report an expired TTL or hop limit as SKB_DROP_REASON_IP_INHDR, the reason otherwise used for a header that is malformed (ip_input.c, exthdrs.c, br_netfilter). Nothing else in the drop path separates the two: IPSTATS_MIB_INHDRERRORS covers both, and the TTL check runs before NF_INET_FORWARD, so netfilter tracing stops at PREROUTING and never sees the drop. The Fedora bug linked below shows how that reads in practice. The reporter took kfree_skb(reason=IP_INHDR, loc=ip_forward) to mean the software header checksum check had failed, and worked through RX checksum offload, tc csum actions and both libvirt firewall backends before the drops turned out to be replies arriving with TTL 1. ip_forward() never verifies the header checksum; that runs earlier, in ip_rcv_core(), and reports IP_CSUM. TTL expiry is not a corner case -- every traceroute through a Linux router goes through too_many_hops. The three loopback hop limit checks in exthdrs.c drop with no reason at all; give them the new one. IPSTATS_MIB_INHDRERRORS stays as it is: RFC 1213 counts time-to-live exceeded under ipInHdrErrors. The drop reason has no such constraint. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2517131 Signed-off-by: Junjie Cao <redacted>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> [...]
quoted hunk ↗ jump to hunk
/**@@ -606,6 +607,11 @@ enum skb_drop_reason { SKB_DROP_REASON_PSP_OUTPUT, /** @SKB_DROP_REASON_RECURSION_LIMIT: Dead loop on virtual device. */ SKB_DROP_REASON_RECURSION_LIMIT, + /** + * @SKB_DROP_REASON_IP_TTL_EXCEEDED: IPv4 TTL or IPv6 hop limit hit + * zero (see IPSTATS_MIB_INHDRERRORS)
nit: "<= 1" would be more accurate than "hit zero".
+ */ + SKB_DROP_REASON_IP_TTL_EXCEEDED, /** * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which * shouldn't be used as a real 'reason' - only for tracing code gen