[PATCH net 1/2] udp4: Rescan udp hash chains if cross-linked.

From: David Laight
Date: Mon Jan 27 2025 - 14:40:57 EST


udp_lib_rehash() can get called at any time and will move a
socket to a different hash2 chain.
This can cause udp4_lib_lookup2() (processing incoming UDP) to
fail to find a socket and an ICMP port unreachable be sent.

Prior to ca065d0cf80fa the lookup used 'hlist_nulls' and checked
that the 'end if list' marker was on the correct list.

Signed-off-by: David Laight <david.laight.linux@xxxxxxxxx>
---
net/ipv4/udp.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 86d282618515..a8e2b431d348 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -425,16 +425,21 @@ static struct sock *udp4_lib_lookup2(const struct net *net,
__be32 saddr, __be16 sport,
__be32 daddr, unsigned int hnum,
int dif, int sdif,
+ unsigned int hash2, unsigned int mask,
struct udp_hslot *hslot2,
struct sk_buff *skb)
{
+ unsigned int hash2_rescan;
struct sock *sk, *result;
int score, badness;
bool need_rescore;

+rescan:
+ hash2_rescan = hash2;
result = NULL;
badness = 0;
udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
+ hash2_rescan = udp_sk(sk)->udp_portaddr_hash;
need_rescore = false;
rescore:
score = compute_score(need_rescore ? result : sk, net, saddr,
@@ -475,6 +480,16 @@ static struct sock *udp4_lib_lookup2(const struct net *net,
goto rescore;
}
}
+
+ /* udp sockets can get moved to a different hash chain.
+ * If the chains have got crossed then rescan.
+ */
+ if ((hash2_rescan ^ hash2) & mask) {
+ /* Ensure hslot2->head is reread */
+ barrier();
+ goto rescan;
+ }
+
return result;
}

@@ -654,7 +669,7 @@ struct sock *__udp4_lib_lookup(const struct net *net, __be32 saddr,
/* Lookup connected or non-wildcard socket */
result = udp4_lib_lookup2(net, saddr, sport,
daddr, hnum, dif, sdif,
- hslot2, skb);
+ hash2, udptable->mask, hslot2, skb);
if (!IS_ERR_OR_NULL(result) && result->sk_state == TCP_ESTABLISHED)
goto done;

@@ -680,7 +695,7 @@ struct sock *__udp4_lib_lookup(const struct net *net, __be32 saddr,

result = udp4_lib_lookup2(net, saddr, sport,
htonl(INADDR_ANY), hnum, dif, sdif,
- hslot2, skb);
+ hash2, udptable->mask, hslot2, skb);
done:
if (IS_ERR(result))
return NULL;
--
2.39.5