From: Jakub Kicinski <kuba@kernel.org>
To: xuanqiang.luo@linux.dev
Cc: edumazet@google.com, kuniyu@google.com,
kerneljasonxing@gmail.com, davem@davemloft.net,
netdev@vger.kernel.org, Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Subject: Re: [PATCH net-next v5 3/3] inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
Date: Wed, 24 Sep 2025 17:55:27 -0700 [thread overview]
Message-ID: <20250924175527.4642e32a@kernel.org> (raw)
In-Reply-To: <20250924015034.587056-4-xuanqiang.luo@linux.dev>
On Wed, 24 Sep 2025 09:50:34 +0800 xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> Since ehash lookups are lockless, if another CPU is converting sk to tw
> concurrently, fetching the newly inserted tw with tw->tw_refcnt == 0 cause
> lookup failure.
>
> The call trace map is drawn as follows:
> CPU 0 CPU 1
> ----- -----
> inet_twsk_hashdance_schedule()
> spin_lock()
> inet_twsk_add_node_rcu(tw, ...)
> __inet_lookup_established()
> (find tw, failure due to tw_refcnt = 0)
> __sk_nulls_del_node_init_rcu(sk)
> refcount_set(&tw->tw_refcnt, 3)
> spin_unlock()
>
> By replacing sk with tw atomically via hlist_nulls_replace_init_rcu() after
> setting tw_refcnt, we ensure that tw is either fully initialized or not
> visible to other CPUs, eliminating the race.
This one doesn't build cleanly
net/ipv4/inet_timewait_sock.c:116:28: warning: unused variable 'ehead' [-Wunused-variable]
116 | struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
| ^~~~~
net/ipv4/inet_timewait_sock.c:91:13: warning: unused function 'inet_twsk_add_node_rcu' [-Wunused-function]
91 | static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw,
| ^~~~~~~~~~~~~~~~~~~~~~
--
pw-bot: cr
next prev parent reply other threads:[~2025-09-25 0:55 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-24 1:50 [PATCH net-next v5 0/3] net: Avoid ehash lookup races xuanqiang.luo
2025-09-24 1:50 ` [PATCH net-next v5 1/3] rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() xuanqiang.luo
2025-09-25 0:54 ` Jakub Kicinski
2025-09-25 1:50 ` luoxuanqiang
2025-09-24 1:50 ` [PATCH net-next v5 2/3] inet: Avoid ehash lookup race in inet_ehash_insert() xuanqiang.luo
2025-09-24 1:50 ` [PATCH net-next v5 3/3] inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() xuanqiang.luo
2025-09-25 0:55 ` Jakub Kicinski [this message]
2025-09-25 1:51 ` luoxuanqiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250924175527.4642e32a@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kerneljasonxing@gmail.com \
--cc=kuniyu@google.com \
--cc=luoxuanqiang@kylinos.cn \
--cc=netdev@vger.kernel.org \
--cc=xuanqiang.luo@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).