Re: [PATCH net-next v2 1/2] tcp: avoid false bind exhaustion with odd-sized port ranges

[Kuniyuki Iwashima <kuniyu@google.com>]

On Fri, 06 Nov 2026 19:14:41 +0200, Florin Badita-Nistor wrote:
> inet_csk_find_open_port() rounds the range length down to an even
> number but keeps the original exclusive upper bound for wrapping.
> For an odd-sized range, the two scans can therefore miss a valid port
> and return EADDRINUSE while an eligible port remains free.
> 
> For example, restrict a TCP socket to IP_LOCAL_PORT_RANGE [40000, 40002]
> and hold explicit binds on 40000 and 40001. bind(..., 0) always fails,
> although an explicit bind to 40002 succeeds. Both IPv4 and IPv6 TCP and

This is the reason of warning in set_local_port_range(),
so kind of WAI to me.

The change should be fine, but we should remove the warning.


> MPTCP are affected. A namespace-wide odd-sized ip_local_port_range can
> also trigger the failure without a per-socket range setting.
> 
> Keep the full length for the scan bound and wrapping. The two scans
> then cover every candidate in an odd-sized range, with at most one
> repeated candidate when exhausted. Even-sized candidate sequences
> remain unchanged.
> 
> For odd-sized ranges, subtracting an odd remaining value when wrapping
> flips parity. The first scan can therefore also select offsets of the
> parity preferred by __inet_hash_connect(). Namespace-wide ranges with
> same-parity endpoints already trigger a sysctl warning, while connect()
> uses step 1 for a per-socket IP_LOCAL_PORT_RANGE.
> 
> This only fixes bind() allocation. The rounding in __inet_hash_connect()
> for namespace-wide ranges is unchanged, so connect() can still miss a
> port in an odd-sized namespace range.
> 
> The issue was triggered while developing port-range selftests with
> Codex assistance, then confirmed using userspace reproducers on
> unmodified kernels. No kernel instrumentation or fault injection was
> needed. Booted x86-64 KVM kernels were tested against the regression
> selftest, the full ip_local_port_range suite, and a Go net.Listen
> reproducer. The Go reproducer fails 100/100 times per IP version before
> the fix and 0/100 afterwards with a three-port namespace range and two
> listeners occupying its first two ports.
> 
> Fixes: ea8add2b1903 ("tcp/dccp: better use of ephemeral ports in bind()")
> Signed-off-by: Florin Badita-Nistor <baditaflorin@gmail.com>
> ---
>  net/ipv4/inet_connection_sock.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> index e56beec43..755fcea35 100644
> --- a/net/ipv4/inet_connection_sock.c
> +++ b/net/ipv4/inet_connection_sock.c
> @@ -343,8 +343,6 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret,
>  			low = half;
>  	}
>  	remaining = high - low;
> -	if (likely(remaining > 1))
> -		remaining &= ~1U;
>  
>  	offset = get_random_u32_below(remaining);
>  	/* __inet_hash_connect() favors ports having @low parity
> -- 
> 2.51.0
>