Re: [PATCH net v5] ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Thu, 10 Sep 2026 22:00:42 +0800 you wrote:

When the forward output route cannot be used in icmp_route_lookup(),
it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr,
the original packet's source address.

ip_route_input() only returns an error for truly invalid packets. For
unreachable addresses it will succeed and return an input route whose
dst.output is set to ip_rt_bug(). The existing check only rejects
RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned
and later used for output, syzkaller triggering a WARN_ON_ONCE()
in ip_rt_bug() as bellow:

[...]

Here is the summary with links:
  - [net,v5] ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
    https://git.kernel.org/netdev/net/c/2998147b59c9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html