lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 21 Jul 2020 15:15:30 +0900
From:   Kuniyuki Iwashima <>
To:     "David S . Miller" <>,
        Alexey Kuznetsov <>,
        Hideaki YOSHIFUJI <>,
        "Jakub Kicinski" <>
CC:     Willem de Bruijn <>,
        Eric Dumazet <>,
        Craig Gallek <>,
        Paolo Abeni <>, <>,
        Kuniyuki Iwashima <>,
        "Kuniyuki Iwashima" <>,
        Benjamin Herrenschmidt <>,
Subject: [PATCH net 1/2] udp: Copy has_conns in reuseport_grow().

If an unconnected socket in a UDP reuseport group connect()s, has_conns is
set to 1. Then, when a packet is received, udp[46]_lib_lookup2() scans all
sockets in udp_hslot looking for the connected socket with the highest

However, when the number of sockets bound to the port exceeds max_socks,
reuseport_grow() resets has_conns to 0. It can cause udp[46]_lib_lookup2()
to return without scanning all sockets, resulting in that packets sent to
connected sockets may be distributed to unconnected sockets.

Therefore, reuseport_grow() should copy has_conns.

Fixes: acdcecc61285 ("udp: correct reuseport selection with connected sockets")
CC: Willem de Bruijn <>
Reviewed-by: Benjamin Herrenschmidt <>
Signed-off-by: Kuniyuki Iwashima <>
 net/core/sock_reuseport.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
index adcb3aea576d..bbdd3c7b6cb5 100644
--- a/net/core/sock_reuseport.c
+++ b/net/core/sock_reuseport.c
@@ -101,6 +101,7 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse)
 	more_reuse->prog = reuse->prog;
 	more_reuse->reuseport_id = reuse->reuseport_id;
 	more_reuse->bind_inany = reuse->bind_inany;
+	more_reuse->has_conns = reuse->has_conns;
 	memcpy(more_reuse->socks, reuse->socks,
 	       reuse->num_socks * sizeof(struct sock *));
2.17.2 (Apple Git-113)

Powered by blists - more mailing lists