[PATCH] net: inet: prevent lhash2 lookups from escaping into ehash

[David Lee <david.lee@trailofbits.com>]

The lhash2 and ehash tables share sk_nulls_node. When a listening
socket is unhashed and rehashed as a connected socket while an RCU
listener lookup is walking it, the reader can follow the node's new
next pointer into ehash. inet_lhash2_lookup() and
inet6_lhash2_lookup() do not validate the terminal nulls marker, so
they can return an ehash entry under the listener lookup's
unreferenced ownership contract.

In particular, returning a TIME_WAIT socket makes the TCP receive
path consume a reference that the lookup never acquired. Repeated
races can free the object while it remains linked in the hash tables.

Skip non-listening sockets before scoring them. Also restart the walk
when its terminal nulls marker does not match the expected lhash2 slot,
as the established lookup already does.

Fixes: cae3873c5b3a ("net: inet: Retire port only listening_hash")
Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers a
KASAN use-after-free and can share if needed.

 net/ipv4/inet_hashtables.c  | 20 ++++++++++++++++----
 net/ipv6/inet6_hashtables.c | 20 ++++++++++++++++----
 2 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index ba0faa9ae..563c8af44 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -415,16 +415,23 @@ EXPORT_SYMBOL_GPL(inet_lookup_reuseport);
 /* called with rcu_read_lock() : No refcount taken on the socket */
 static struct sock *inet_lhash2_lookup(const struct net *net,
 				struct inet_listen_hashbucket *ilb2,
+				unsigned int slot,
 				struct sk_buff *skb, int doff,
 				const __be32 saddr, __be16 sport,
 				const __be32 daddr, const unsigned short hnum,
 				const int dif, const int sdif)
 {
-	struct sock *sk, *result = NULL;
+	struct sock *sk, *result;
 	struct hlist_nulls_node *node;
-	int score, hiscore = 0;
+	int score, hiscore;
 
+begin:
+	result = NULL;
+	hiscore = 0;
 	sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) {
+		if (READ_ONCE(sk->sk_state) != TCP_LISTEN)
+			continue;
+
 		score = compute_score(sk, net, hnum, daddr, dif, sdif);
 		if (score > hiscore) {
 			result = inet_lookup_reuseport(net, sk, skb, doff,
@@ -437,6 +444,9 @@ static struct sock *inet_lhash2_lookup(const struct net *net,
 		}
 	}
 
+	if (get_nulls_value(node) != slot + LISTENING_NULLS_BASE)
+		goto begin;
+
 	return result;
 }
 
@@ -486,7 +496,8 @@ struct sock *__inet_lookup_listener(const struct net *net,
 	hash2 = ipv4_portaddr_hash(net, daddr, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet_lhash2_lookup(net, ilb2,
+				    hash2 & hashinfo->lhash2_mask, skb, doff,
 				    saddr, sport, daddr, hnum,
 				    dif, sdif);
 	if (result)
@@ -496,7 +507,8 @@ struct sock *__inet_lookup_listener(const struct net *net,
 	hash2 = ipv4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet_lhash2_lookup(net, ilb2,
+				    hash2 & hashinfo->lhash2_mask, skb, doff,
 				    saddr, sport, htonl(INADDR_ANY), hnum,
 				    dif, sdif);
 done:
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index b111b51d6..a9dfd47dd 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -184,16 +184,23 @@ EXPORT_SYMBOL_GPL(inet6_lookup_reuseport);
 /* called with rcu_read_lock() */
 static struct sock *inet6_lhash2_lookup(const struct net *net,
 		struct inet_listen_hashbucket *ilb2,
+		unsigned int slot,
 		struct sk_buff *skb, int doff,
 		const struct in6_addr *saddr,
 		const __be16 sport, const struct in6_addr *daddr,
 		const unsigned short hnum, const int dif, const int sdif)
 {
-	struct sock *sk, *result = NULL;
+	struct sock *sk, *result;
 	struct hlist_nulls_node *node;
-	int score, hiscore = 0;
+	int score, hiscore;
 
+begin:
+	result = NULL;
+	hiscore = 0;
 	sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) {
+		if (READ_ONCE(sk->sk_state) != TCP_LISTEN)
+			continue;
+
 		score = compute_score(sk, net, hnum, daddr, dif, sdif);
 		if (score > hiscore) {
 			result = inet6_lookup_reuseport(net, sk, skb, doff,
@@ -206,6 +213,9 @@ static struct sock *inet6_lhash2_lookup(const struct net *net,
 		}
 	}
 
+	if (get_nulls_value(node) != slot + LISTENING_NULLS_BASE)
+		goto begin;
+
 	return result;
 }
 
@@ -260,7 +270,8 @@ struct sock *inet6_lookup_listener(const struct net *net,
 	hash2 = ipv6_portaddr_hash(net, daddr, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet6_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet6_lhash2_lookup(net, ilb2,
+				     hash2 & hashinfo->lhash2_mask, skb, doff,
 				     saddr, sport, daddr, hnum,
 				     dif, sdif);
 	if (result)
@@ -270,7 +281,8 @@ struct sock *inet6_lookup_listener(const struct net *net,
 	hash2 = ipv6_portaddr_hash(net, &in6addr_any, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet6_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet6_lhash2_lookup(net, ilb2,
+				     hash2 & hashinfo->lhash2_mask, skb, doff,
 				     saddr, sport, &in6addr_any, hnum,
 				     dif, sdif);
 done: