Re: [PATCH net v2 1/2] tcp: Fix the SO_REUSEPORT bind cache admitting a conflicting socket

[Kuniyuki Iwashima <kuniyu@google.com>]

On Wed, 11 Nov 2026 12:47:03 -0500, Juan Agustin Niccolini wrote:
> When the port is in the FASTREUSEPORT_STRICT state, inet_csk_get_port()
> skips the bind conflict check if sk_reuseport_match() finds the new
> socket's address covered by the socket cached in tb->fast_*.
> 
> This is only safe if both sockets match on everything
> inet_bind_conflict() reads. The cache misses some of it:
> 
> - It does not record sk_bound_dev_if or sk_reuse.
> - It records the family and IPV6_V6ONLY but never compares them with
>   the new socket, so a cached v6only [::] (or 0.0.0.0) socket covers
>   a dual-stack [::] socket.
> 
> As a result, an unprivileged user can bind and listen on a port that
> another user is listening on, for example a dual-stack [::] socket on
> top of a 0.0.0.0 listener:
> 
>   victim:   bind(0.0.0.0:P), listen()
>   attacker: SO_REUSEPORT + IPV6_V6ONLY, bind([::]:P)   /* fills cache */
>   attacker: SO_REUSEPORT, bind([::]:P), listen()       /* should fail */
> 
> Only take the fast path when the new socket matches the cached one in
> family, IPV6_V6ONLY, bound device and SO_REUSEADDR. Identical
> SO_REUSEPORT listeners, the workload this cache was added for, still
> skip the scan (binding 16384 of them: 9.80 ms before, 9.86 ms after,
> 5874 ms with the full check every time).
> 
> Fixes: 637bc8bbe6c0 ("inet: reset tb->fastreuseport when adding a reuseport sk")
> Cc: stable@vger.kernel.org
> Signed-off-by: Juan Agustin Niccolini <juanagusnicco@gmail.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>