From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B92A12D595B; Thu, 15 Jan 2026 17:41:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498887; cv=none; b=VxxjIx+az0oJuLF+zob/pX6VuCHT/nlip4txTMNOtE8owfKAEkZRGE3EloW2zGMR0k7VSSo6GRVjD961cX2btYhZO/edj95HK8z+E9uw5E1mibMZH/PDRKmGv9UWeOaa1a+IMGo2oA8NVt4jxeSieT8+CAtG4lRBHG6SucSOHMA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498887; c=relaxed/simple; bh=nevJNNS2VyINsZj6lcGbjI6Uqew0t9OBDbddpwpIE0Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qL0J+D/JlWAJU+4ygGIMNJlomtjo7JIi4HlbNclsmLa7BZmMAGyXoGL/1W12mzP2VWIZTWF5dm9hsbpDJC+cXAE9xF6TKeOyaX+NsFPGAxkHJ98ncG7zyA+eDRp2PkVhp2Mp/1jA4vCath5CjSo+bRT9YhGDbA2xib3+QtbSwf8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=08mK2JGw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="08mK2JGw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4398BC19422; Thu, 15 Jan 2026 17:41:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498887; bh=nevJNNS2VyINsZj6lcGbjI6Uqew0t9OBDbddpwpIE0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=08mK2JGw68DlpfYTMlI9byVkT/zW2kFxfrYb4/3N/HsIFaSWHF39zCY64pMBtmQ7y 00mz4CqFA0EmuzqXwLqppo1f9cqH4M8WcTth+ei9LnTgA93IlElwF1SH7d4eG1hmLk 4xAiHj+9pboUQaQDBOgjtHOSDmgjU2UCEld4RE5M= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kuniyuki Iwashima , Jiayuan Chen , Xuanqiang Luo , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 034/451] inet: Avoid ehash lookup race in inet_ehash_insert() Date: Thu, 15 Jan 2026 17:43:55 +0100 Message-ID: <20260115164232.126674027@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164230.864985076@linuxfoundation.org> References: <20260115164230.864985076@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xuanqiang Luo [ Upstream commit 1532ed0d0753c83e72595f785f82b48c28bbe5dc ] Since ehash lookups are lockless, if one CPU performs a lookup while another concurrently deletes and inserts (removing reqsk and inserting sk), the lookup may fail to find the socket, an RST may be sent. The call trace map is drawn as follows: CPU 0 CPU 1 ----- ----- inet_ehash_insert() spin_lock() sk_nulls_del_node_init_rcu(osk) __inet_lookup_established() (lookup failed) __sk_nulls_add_node_rcu(sk, list) spin_unlock() As both deletion and insertion operate on the same ehash chain, this patch introduces a new sk_nulls_replace_node_init_rcu() helper functions to implement atomic replacement. Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jiayuan Chen Signed-off-by: Xuanqiang Luo Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251015020236.431822-3-xuanqiang.luo@linux.dev Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- include/net/sock.h | 13 +++++++++++++ net/ipv4/inet_hashtables.c | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index bfba1c312a553..4e5386cdb09cd 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -769,6 +769,19 @@ static inline bool sk_nulls_del_node_init_rcu(struct sock *sk) return rc; } +static inline bool sk_nulls_replace_node_init_rcu(struct sock *old, + struct sock *new) +{ + if (sk_hashed(old)) { + hlist_nulls_replace_init_rcu(&old->sk_nulls_node, + &new->sk_nulls_node); + __sock_put(old); + return true; + } + + return false; +} + static inline void __sk_add_node(struct sock *sk, struct hlist_head *list) { hlist_add_head(&sk->sk_node, list); diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index ac2d185c04ef8..9b7c845245274 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -578,8 +578,11 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) spin_lock(lock); if (osk) { WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); - ret = sk_nulls_del_node_init_rcu(osk); - } else if (found_dup_sk) { + ret = sk_nulls_replace_node_init_rcu(osk, sk); + goto unlock; + } + + if (found_dup_sk) { *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); if (*found_dup_sk) ret = false; @@ -588,6 +591,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) if (ret) __sk_nulls_add_node_rcu(sk, list); +unlock: spin_unlock(lock); return ret; -- 2.51.0