netdev - Re: [RESEND PATCH net-next v7 2/3] inet: Avoid ehash lookup race in inet_ehash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <be003347ec43dba9fbe70d549da45610e1edd399@linux.dev>
Date: Tue, 14 Oct 2025 06:46:00 +0000
From: "Jiayuan Chen" <jiayuan.chen@...ux.dev>
To: xuanqiang.luo@...ux.dev, edumazet@...gle.com, kuniyu@...gle.com,
 pabeni@...hat.com
Cc: kerneljasonxing@...il.com, davem@...emloft.net, kuba@...nel.org,
 netdev@...r.kernel.org, horms@...nel.org, "Xuanqiang Luo"
 <luoxuanqiang@...inos.cn>
Subject: Re: [RESEND PATCH net-next v7 2/3] inet: Avoid ehash lookup race in
 inet_ehash_insert()

October 14, 2025 at 10:27, xuanqiang.luo@...ux.dev mailto:xuanqiang.luo@...ux.dev  wrote:


> 
> From: Xuanqiang Luo <luoxuanqiang@...inos.cn>
> 
> Since ehash lookups are lockless, if one CPU performs a lookup while
> another concurrently deletes and inserts (removing reqsk and inserting sk),
> the lookup may fail to find the socket, an RST may be sent.
> 
> The call trace map is drawn as follows:
>  CPU 0 CPU 1
>  ----- -----
>  inet_ehash_insert()
>  spin_lock()
>  sk_nulls_del_node_init_rcu(osk)
> __inet_lookup_established()
>  (lookup failed)
>  __sk_nulls_add_node_rcu(sk, list)
>  spin_unlock()
> 
> As both deletion and insertion operate on the same ehash chain, this patch
> introduces a new sk_nulls_replace_node_init_rcu() helper functions to
> implement atomic replacement.
> 
> Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions")
> Reviewed-by: Kuniyuki Iwashima <kuniyu@...gle.com>
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@...inos.cn>

Reviewed-by: Jiayuan Chen <jiayuan.chen@...ux.dev>