From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-172.mta1.migadu.com (out-172.mta1.migadu.com [95.215.58.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E978D1DED64 for ; Wed, 15 Oct 2025 02:04:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760493860; cv=none; b=Vk3VgZDiznUKI6bXb+IVVvXTC8lIn+y412p2c2G4CpNep8qrqNtLIRNcdqVIfgsb8vSLohNa2l+eRS67Ppb9XSFUpSNyxkn58S/RdtsYiZJkD2kddNGcLgQQd15+jwtxc+h7HKwObIy+L71S7ZKYaMpF/UT7SFWHv/P+OQ5YIYg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760493860; c=relaxed/simple; bh=A0Hbhf1LuTCOQICJ7pWh5ohsb5YnZU3oGqxLkwuNUCs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Twiidk+b9W1AtLpgVwWgT8Tgw+8xmcD6RuTDkzC6U2/m3z4I9RRmrXi1QT+sM2Yit2ClnTQ4v7ennmqfZSc+7MrTVLlIrZuZDQIETQo5HpPGHUKCQJ7LZMt6at88YbV2ArMtIFdtSRSHO2Ovf6SkOk5SvGnWh6ssvrIt/8wCPTk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FW0XcrnI; arc=none smtp.client-ip=95.215.58.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FW0XcrnI" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1760493857; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pAnPJBAybQSLwCuOaYwqStH7InN07AacT/9POxIPPew=; b=FW0XcrnIb9uc0SO8HAgPbvZjv0tnsg+TWGg+Znsx+g2pbYP7bpV6PBjTlCAD5+en8jYmvP Z3qrAskkxLnd60PEgnw3e48rKsiR3QFGDUBFO6txbQdPLSM2bYuvI80OupBuBSckbVuV2D 461L28mE4N/OYeAF46sE3WgJscanDI8= From: xuanqiang.luo@linux.dev To: edumazet@google.com, kuniyu@google.com, pabeni@redhat.com Cc: kerneljasonxing@gmail.com, davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, horms@kernel.org, jiayuan.chen@linux.dev, ncardwell@google.com, dsahern@kernel.org, Xuanqiang Luo Subject: [PATCH net-next v8 2/3] inet: Avoid ehash lookup race in inet_ehash_insert() Date: Wed, 15 Oct 2025 10:02:35 +0800 Message-Id: <20251015020236.431822-3-xuanqiang.luo@linux.dev> In-Reply-To: <20251015020236.431822-1-xuanqiang.luo@linux.dev> References: <20251015020236.431822-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Xuanqiang Luo Since ehash lookups are lockless, if one CPU performs a lookup while another concurrently deletes and inserts (removing reqsk and inserting sk), the lookup may fail to find the socket, an RST may be sent. The call trace map is drawn as follows: CPU 0 CPU 1 ----- ----- inet_ehash_insert() spin_lock() sk_nulls_del_node_init_rcu(osk) __inet_lookup_established() (lookup failed) __sk_nulls_add_node_rcu(sk, list) spin_unlock() As both deletion and insertion operate on the same ehash chain, this patch introduces a new sk_nulls_replace_node_init_rcu() helper functions to implement atomic replacement. Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jiayuan Chen Signed-off-by: Xuanqiang Luo --- include/net/sock.h | 13 +++++++++++++ net/ipv4/inet_hashtables.c | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 60bcb13f045c..ddf7ab55685b 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -858,6 +858,19 @@ static inline bool sk_nulls_del_node_init_rcu(struct sock *sk) return rc; } +static inline bool sk_nulls_replace_node_init_rcu(struct sock *old, + struct sock *new) +{ + if (sk_hashed(old)) { + hlist_nulls_replace_init_rcu(&old->sk_nulls_node, + &new->sk_nulls_node); + __sock_put(old); + return true; + } + + return false; +} + static inline void __sk_add_node(struct sock *sk, struct hlist_head *list) { hlist_add_head(&sk->sk_node, list); diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index b7024e3d9ac3..f5826ec4bcaa 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -720,8 +720,11 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) spin_lock(lock); if (osk) { WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); - ret = sk_nulls_del_node_init_rcu(osk); - } else if (found_dup_sk) { + ret = sk_nulls_replace_node_init_rcu(osk, sk); + goto unlock; + } + + if (found_dup_sk) { *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); if (*found_dup_sk) ret = false; @@ -730,6 +733,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) if (ret) __sk_nulls_add_node_rcu(sk, list); +unlock: spin_unlock(lock); return ret; -- 2.25.1