Re: [PATCH 2/2] Rescan the hash2 list if the hash chains have got cross-linked.

[Paolo Abeni <pabeni@redhat.com>]

Hi,

On Wed, 2023-07-26 at 12:05 +0000, David Laight wrote:
> udp_lib_rehash() can get called at any time and will move a
> socket to a different hash2 chain.
> This can cause udp4_lib_lookup2() (processing incoming UDP) to
> fail to find a socket and an ICMP port unreachable be sent.
> 
> Prior to ca065d0cf80fa the lookup used 'hlist_nulls' and checked
> that the 'end if list' marker was on the correct list.
> 
> Rather than re-instate the 'nulls' list just check that the final
> socket is on the correct list.
> 
> The cross-linking can definitely happen (see earlier issues with
> it looping forever because gcc cached the list head).
> 
> Fixes: ca065d0cf80fa ("udp: no longer use SLAB_DESTROY_BY_RCU")
> Signed-off-by: David Laight <david.laight@aculab.com>
> ---
>  net/ipv4/udp.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index ad64d6c4cd99..ed92ba7610b0 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -443,6 +443,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
>  				     struct sk_buff *skb)
>  {
>  	unsigned int hash2, slot2;
> +	unsigned int hash2_rescan;
>  	struct udp_hslot *hslot2;
>  	struct sock *sk, *result;
>  	int score, badness;
> @@ -451,9 +452,12 @@ static struct sock *udp4_lib_lookup2(struct net *net,
>  	slot2 = hash2 & udptable->mask;
>  	hslot2 = &udptable->hash2[slot2];
>  
> +rescan:
> +	hash2_rescan = hash2;
>  	result = NULL;
>  	badness = 0;
>  	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
> +		hash2_rescan = udp_sk(sk)->udp_portaddr_hash;
>  		score = compute_score(sk, net, saddr, sport,
>  				      daddr, hnum, dif, sdif);
>  		if (score > badness) {
> @@ -467,6 +471,16 @@ static struct sock *udp4_lib_lookup2(struct net *net,
>  			badness = score;
>  		}
>  	}
> +
> +	/* udp sockets can get moved to a different hash chain.
> +	 * If the chains have got crossed then rescan.
> +	 */
> +	if ((hash2_rescan & udptable->mask) != slot2) {
> +		/* Ensure hslot2->head is reread */
> +		barrier();

udp_portaddr_for_each_entry_rcu() uses (indirectly)
rcu_dereference_raw() to access the head. That implies a READ_ONCE().
Additional barriers for re-read should not be necessary.

What about IPV6?

Cheers,

Paolo