[PATCH] net: inet: prevent lhash2 lookups from escaping into ehash

[PATCH] net: inet: prevent lhash2 lookups from escaping into ehash

[David Lee]

The lhash2 and ehash tables share sk_nulls_node. When a listening
socket is unhashed and rehashed as a connected socket while an RCU
listener lookup is walking it, the reader can follow the node's new
next pointer into ehash. inet_lhash2_lookup() and
inet6_lhash2_lookup() do not validate the terminal nulls marker, so
they can return an ehash entry under the listener lookup's
unreferenced ownership contract.

In particular, returning a TIME_WAIT socket makes the TCP receive
path consume a reference that the lookup never acquired. Repeated
races can free the object while it remains linked in the hash tables.

Skip non-listening sockets before scoring them. Also restart the walk
when its terminal nulls marker does not match the expected lhash2 slot,
as the established lookup already does.

Fixes: cae3873c5b3a ("net: inet: Retire port only listening_hash")
Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers a
KASAN use-after-free and can share if needed.

 net/ipv4/inet_hashtables.c  | 20 ++++++++++++++++----
 net/ipv6/inet6_hashtables.c | 20 ++++++++++++++++----
 2 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index ba0faa9ae..563c8af44 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -415,16 +415,23 @@ EXPORT_SYMBOL_GPL(inet_lookup_reuseport);
 /* called with rcu_read_lock() : No refcount taken on the socket */
 static struct sock *inet_lhash2_lookup(const struct net *net,
 				struct inet_listen_hashbucket *ilb2,
+				unsigned int slot,
 				struct sk_buff *skb, int doff,
 				const __be32 saddr, __be16 sport,
 				const __be32 daddr, const unsigned short hnum,
 				const int dif, const int sdif)
 {
-	struct sock *sk, *result = NULL;
+	struct sock *sk, *result;
 	struct hlist_nulls_node *node;
-	int score, hiscore = 0;
+	int score, hiscore;
 
+begin:
+	result = NULL;
+	hiscore = 0;
 	sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) {
+		if (READ_ONCE(sk->sk_state) != TCP_LISTEN)
+			continue;
+
 		score = compute_score(sk, net, hnum, daddr, dif, sdif);
 		if (score > hiscore) {
 			result = inet_lookup_reuseport(net, sk, skb, doff,
@@ -437,6 +444,9 @@ static struct sock *inet_lhash2_lookup(const struct net *net,
 		}
 	}
 
+	if (get_nulls_value(node) != slot + LISTENING_NULLS_BASE)
+		goto begin;
+
 	return result;
 }
 
@@ -486,7 +496,8 @@ struct sock *__inet_lookup_listener(const struct net *net,
 	hash2 = ipv4_portaddr_hash(net, daddr, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet_lhash2_lookup(net, ilb2,
+				    hash2 & hashinfo->lhash2_mask, skb, doff,
 				    saddr, sport, daddr, hnum,
 				    dif, sdif);
 	if (result)
@@ -496,7 +507,8 @@ struct sock *__inet_lookup_listener(const struct net *net,
 	hash2 = ipv4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet_lhash2_lookup(net, ilb2,
+				    hash2 & hashinfo->lhash2_mask, skb, doff,
 				    saddr, sport, htonl(INADDR_ANY), hnum,
 				    dif, sdif);
 done:
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index b111b51d6..a9dfd47dd 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -184,16 +184,23 @@ EXPORT_SYMBOL_GPL(inet6_lookup_reuseport);
 /* called with rcu_read_lock() */
 static struct sock *inet6_lhash2_lookup(const struct net *net,
 		struct inet_listen_hashbucket *ilb2,
+		unsigned int slot,
 		struct sk_buff *skb, int doff,
 		const struct in6_addr *saddr,
 		const __be16 sport, const struct in6_addr *daddr,
 		const unsigned short hnum, const int dif, const int sdif)
 {
-	struct sock *sk, *result = NULL;
+	struct sock *sk, *result;
 	struct hlist_nulls_node *node;
-	int score, hiscore = 0;
+	int score, hiscore;
 
+begin:
+	result = NULL;
+	hiscore = 0;
 	sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) {
+		if (READ_ONCE(sk->sk_state) != TCP_LISTEN)
+			continue;
+
 		score = compute_score(sk, net, hnum, daddr, dif, sdif);
 		if (score > hiscore) {
 			result = inet6_lookup_reuseport(net, sk, skb, doff,
@@ -206,6 +213,9 @@ static struct sock *inet6_lhash2_lookup(const struct net *net,
 		}
 	}
 
+	if (get_nulls_value(node) != slot + LISTENING_NULLS_BASE)
+		goto begin;
+
 	return result;
 }
 
@@ -260,7 +270,8 @@ struct sock *inet6_lookup_listener(const struct net *net,
 	hash2 = ipv6_portaddr_hash(net, daddr, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet6_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet6_lhash2_lookup(net, ilb2,
+				     hash2 & hashinfo->lhash2_mask, skb, doff,
 				     saddr, sport, daddr, hnum,
 				     dif, sdif);
 	if (result)
@@ -270,7 +281,8 @@ struct sock *inet6_lookup_listener(const struct net *net,
 	hash2 = ipv6_portaddr_hash(net, &in6addr_any, hnum);
 	ilb2 = inet_lhash2_bucket(hashinfo, hash2);
 
-	result = inet6_lhash2_lookup(net, ilb2, skb, doff,
+	result = inet6_lhash2_lookup(net, ilb2,
+				     hash2 & hashinfo->lhash2_mask, skb, doff,
 				     saddr, sport, &in6addr_any, hnum,
 				     dif, sdif);
 done:

Re: [PATCH] net: inet: prevent lhash2 lookups from escaping into ehash

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 1024 bytes --]

On Friday, 31 July 2026 16:05:12 CEST David Lee wrote:
> Fixes: cae3873c5b3a ("net: inet: Retire port only listening_hash")
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.
> 
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

1. weird text (advertisement) + newlines in the tags section which shouldn't be there
   https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
   (and all these tag/format related sections below)

2. author didn't sign off the patch (see below)

3. odd unrelated Signed-off-by without any obvious connection to 
   the patch

   - I actually would guess that Kyle Zeng <kylebot@openai.com> is the author 
     and David Lee removed its authorship (From: ) before sending the patch.
     But in its current form, David is claiming to be the author. And even
     when it is the case, David must still add the the non-Author SoB at the
     end.

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] net: inet: prevent lhash2 lookups from escaping into ehash

[Kuniyuki Iwashima]

From: David Lee <david.lee@trailofbits.com>
Date: Fri, 31 Jul 2026 14:05:12 +0000
> The lhash2 and ehash tables share sk_nulls_node. When a listening
> socket is unhashed and rehashed as a connected socket

This is only fuzzing scenario, and there is another series trying
to address the same class of issue by touching the fast path as well.

https://lore.kernel.org/netdev/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co/


> while an RCU
> listener lookup is walking it, the reader can follow the node's new
> next pointer into ehash. inet_lhash2_lookup() and
> inet6_lhash2_lookup() do not validate the terminal nulls marker, so
> they can return an ehash entry under the listener lookup's
> unreferenced ownership contract.
> 
> In particular, returning a TIME_WAIT socket makes the TCP receive
> path consume a reference that the lookup never acquired. Repeated
> races can free the object while it remains linked in the hash tables.
> 
> Skip non-listening sockets before scoring them. Also restart the walk
> when its terminal nulls marker does not match the expected lhash2 slot,
> as the established lookup already does.
> 
> Fixes: cae3873c5b3a ("net: inet: Retire port only listening_hash")
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.
> 
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---
> Trail of Bits has a reproducer for this bug that triggers a
> KASAN use-after-free and can share if needed.

Can you test this diff ?

---8<---
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 433c2df23076..903499581db7 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -94,6 +94,7 @@ struct inet_connection_sock {
 	u32			  icsk_rto_max;
 	__u32                     icsk_delack_max;
 	__u32			  icsk_pmtu_cookie;
+	unsigned char		  unhashed_state;
 	const struct tcp_congestion_ops *icsk_ca_ops;
 	const struct inet_connection_sock_af_ops *icsk_af_ops;
 	const struct tcp_ulp_ops  *icsk_ulp_ops;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index ba0faa9ae2bb..3ed8d5833c3b 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -803,6 +803,14 @@ int inet_hash(struct sock *sk)
 	inet_init_ehash_secret();
 
 	WARN_ON(!sk_unhashed(sk));
+
+	if (unlikely(inet_csk(sk)->unhashed_state)) {
+		if (inet_csk(sk)->unhashed_state != TCP_LISTEN)
+			synchronize_rcu();
+
+		inet_csk(sk)->unhashed_state = 0;
+	}
+
 	ilb2 = inet_lhash2_bucket_sk(hashinfo, sk);
 
 	spin_lock(&ilb2->lock);
@@ -832,6 +840,9 @@ void inet_unhash(struct sock *sk)
 		return;
 
 	sock_rps_delete_flow(sk);
+
+	inet_csk(sk)->unhashed_state = sk->sk_state;
+
 	if (sk->sk_state == TCP_LISTEN) {
 		struct inet_listen_hashbucket *ilb2;
 
@@ -1058,6 +1069,13 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	int ret, i, low, high;
 	bool local_ports;
 
+	if (unlikely(inet_csk(sk)->unhashed_state)) {
+		if (inet_csk(sk)->unhashed_state == TCP_LISTEN)
+			synchronize_rcu();
+
+		inet_csk(sk)->unhashed_state = 0;
+	}
+
 	if (port) {
 		local_bh_disable();
 		ret = check_established(death_row, sk, port, NULL, false,
---8<---