[PATCH net-next v5 0/3] net: Avoid ehash lookup races

[xuanqiang.luo@linux.dev]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

After replacing R/W locks with RCU in commit 3ab5aee7fe84 ("net: Convert
TCP & DCCP hash tables to use RCU / hlist_nulls"), a race window emerged
during the switch from reqsk/sk to sk/tw.

Now that both timewait sock (tw) and full sock (sk) reside on the same
ehash chain, it is appropriate to introduce hlist_nulls replace
operations, to eliminate the race conditions caused by this window.

Before this series of patches, I previously sent another version of the
patch, attempting to avoid the issue using a lock mechanism. However, it
seems there are some problems with that approach now, so I've switched to
the "replace" method in the current patches to resolve the issue.
For details, refer to:
https://lore.kernel.org/netdev/20250903024406.2418362-1-xuanqiang.luo@linux.dev/

Before I encountered this type of issue recently, I found there had been
several historical discussions about it. Therefore, I'm adding this
background information for those interested to reference:
1. https://lore.kernel.org/lkml/20230118015941.1313-1-kerneljasonxing@gmail.com/
2. https://lore.kernel.org/netdev/20230606064306.9192-1-duanmuquan@baidu.com/

---

Changes:
  v5:
    * Patch 1
	* Rename __hlist_nulls_replace_rcu() to hlist_nulls_replace_rcu()
	  and update the description of hlist_nulls_replace_init_rcu().
    * Patch 2
	* Remove __sk_nulls_replace_node_init_rcu() and inline it into
	  sk_nulls_replace_node_init_rcu().
	* Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON().
    * Patch 3
	* Move smp_wmb() after setting the refcount.

  v4: https://lore.kernel.org/all/20250920105945.538042-1-xuanqiang.luo@linux.dev/
    * Patch 1
	* Use WRITE_ONCE() for ->next in __hlist_nulls_replace_rcu(), and
	  add why in the commit message.
	* Remove the node hash check in hlist_nulls_replace_init_rcu() to
	  avoid redundancy. Also remove the return value, as it serves no
	  purpose in this patch series.
    * Patch 3
	* Remove the check of hlist_nulls_replace_init_rcu() return value
	  in inet_twsk_hashdance_schedule() as it is unnecessary.
          Thanks to Kuni for clarifying this.

  v3: https://lore.kernel.org/all/20250916103054.719584-1-xuanqiang.luo@linux.dev/
    * Add more background information on this type of issue to the letter
      cover.

  v2: https://lore.kernel.org/all/20250916064614.605075-1-xuanqiang.luo@linux.dev/
    * Patch 1
	* Use WRITE_ONCE() to initialize old->pprev.
    * Patch 2&3
	* Optimize sk hashed check. Thanks Kuni for pointing it out!

  v1: https://lore.kernel.org/all/20250915070308.111816-1-xuanqiang.luo@linux.dev/

Xuanqiang Luo (3):
  rculist: Add hlist_nulls_replace_rcu() and
    hlist_nulls_replace_init_rcu()
  inet: Avoid ehash lookup race in inet_ehash_insert()
  inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()

 include/linux/rculist_nulls.h | 52 +++++++++++++++++++++++++++++++++++
 include/net/sock.h            | 14 ++++++++++
 net/ipv4/inet_hashtables.c    |  4 ++-
 net/ipv4/inet_timewait_sock.c | 24 +++++++---------
 4 files changed, 79 insertions(+), 15 deletions(-)

-- 
2.25.1