Re: [PATCH net v2 1/1] udp: diag: bound bucket lock hold time

[Eric Dumazet]

On Sun, Sep 6, 2026 at 12:35 PM Zihan Xi <zihanx@xxxxxxxxxx> wrote:
>
> udp_diag_dump() currently keeps the UDP hash bucket spinlock held while
> running the request's bytecode filter and filling a netlink response for
> every socket in the bucket.  A large filter and a heavily populated bucket
> can therefore keep bottom halves disabled for an attacker-scaled amount of
> time.
>
> Collect at most SKARR_SZ matching sockets under the bucket lock, taking a
> reference for each socket, then run the filter and fill the response after
> releasing the lock.  Resume with the existing (slot, s_num) dump state so
> the next batch can skip already-walked sockets.  Leave bytecode filtering
> until after unlock; unlike tcp_diag, a rejecting inet_diag bytecode program
> is the expensive part of this walk.
>
> Fixes: b6d640c2286d ("udp_diag: Implement the dump-all functionality")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Vega <vega@xxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Zihan Xi <zihanx@xxxxxxxxxx>
> ---
> changes in v2:
>   - Drop the hash-list cursor, dump_done callback, extra module
>     reference, and inet_diag core changes.  Dump state is only
>     (slot, s_num), so the existing handler get/put around dump() is
>     enough and udp_diag no longer manages its own module lifetime.
>   - Batch at most SKARR_SZ matching sockets under the bucket lock
>     like tcp_diag, and run bytecode filtering plus netlink fill after
>     unlock.
>   - v1 Link: https://lore.kernel.org/all/133b6aee9e2c908c9da37d5585b3d2cd016906cd.1788187473.git.zihanx@xxxxxxxxxx

pw-bot: rejected

Please limit the complexity of filters.

Anywone needing complex filters will implement them in user space.