Re: [PATCH net 1/2] tcp: avoid false bind exhaustion with odd-sized port ranges

[Florin Badita-Nistor]

Hi Eric,

> Please mention the side effect: with an odd @remaining, the wrap
> (port -= remaining) flips parity, so the first scan is no longer
> restricted to odd offsets.

Agreed. I will state that wrapping an odd-sized range can select ports
of the parity preferred by __inet_hash_connect(), while even-sized
candidate sequences remain unchanged.

> Also note that __inet_hash_connect() has the same rounding for
> netns-wide ranges, so connect() still misses a port there.

Understood. I will make the scope explicitly bind() allocation only.
The netns-wide connect() behavior remains unchanged; I will not suggest
that odd-sized namespace ranges are fully handled.

> This has been there since 2016 and needs an odd-sized range, I would
> target net-next and drop the stable Cc.

I will retarget both patches to net-next and remove the stable Cc.

> Both patches are mangled by your mailer [...] Please use
> git send-email for v2.
>
> Also, please trim the cover letter to the problem and the test
> results.

Sorry for the malformed patches. The raw Sent copies applied locally,
but that did not establish that the copies received by the list were
intact. I will use git send-email for v2 and verify the received copies.
I will also shorten the cover letter to the problem and test results.

I will allow at least 24 hours from v1 for further feedback before
posting v2 as a new thread, with a link to v1.

Thanks for reviewing the change.

Florin


On Thu, 05 Nov 2026 12:17:56 +0100, Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> Le jeu. 5 nov. 2026 à 12:04, Florin Badita-Nistor
> <baditaflorin@xxxxxxxxx> a écrit :
> >
> > inet_csk_find_open_port() rounds the range length down to an even
> > number but keeps the original exclusive upper bound for wrapping.
> > For an odd-sized range, the two scans can therefore miss a valid port
> > and return EADDRINUSE while an eligible port remains free.
> >
> > For example, restrict a TCP socket to IP_LOCAL_PORT_RANGE [40000, 40002]
> > and hold explicit binds on 40000 and 40001. bind(..., 0) always fails,
> > although an explicit bind to 40002 succeeds. Both IPv4 and IPv6 TCP and
> > MPTCP are affected. A namespace-wide odd-sized ip_local_port_range can
> > also trigger the failure without a per-socket range setting.
> >
> > Keep the full length for the scan bound and wrapping. The two scans
> > then cover every candidate in an odd-sized range, with at most one
> > repeated candidate when exhausted. Even-sized candidate sequences
> > remain unchanged.
> >
>
> Please mention the side effect: with an odd @remaining, the wrap
> (port -= remaining) flips parity, so the first scan is no longer
> restricted to odd offsets. For odd-sized ranges, bind() will now pick
> ports of the parity __inet_hash_connect() prefers.
>
> I think this is fine: same-parity netns ranges already trigger
> "ip_local_port_range: prefer different parity for start/end values",
> and __inet_hash_connect() ignores parity (step == 1) for per-socket
> IP_LOCAL_PORT_RANGE. But the changelog should say so.
>
> Also note that __inet_hash_connect() has the same rounding for
> netns-wide ranges, so connect() still misses a port there. This is
> fine since the sysctl already warns about this setup, but the
> changelog should not suggest netns-wide odd ranges are now fully
> handled.
>
>
> > The issue was triggered while developing port-range selftests with
> > Codex assistance, then confirmed using userspace reproducers on
> > unmodified kernels. No kernel instrumentation or fault injection was
> > needed. Booted x86-64 KVM kernels were tested against the regression
> > selftest, the full ip_local_port_range suite, and a Go net.Listen
> > reproducer. The Go reproducer fails 100/100 times per IP version before
> > the fix and 0/100 afterwards with a three-port namespace range and two
> > listeners occupying its first two ports.
> >
> > Fixes: ea8add2b1903 ("tcp/dccp: better use of ephemeral ports in bind()")
> > Cc: stable@xxxxxxxxxxxxxxx
>
> This has been there since 2016 and needs an odd-sized range, I would
> target net-next and drop the stable Cc.
>
> > Signed-off-by: Florin Badita-Nistor <baditaflorin@xxxxxxxxx>
> > ---
> >  net/ipv4/inet_connection_sock.c | 2 --
> >  1 file changed, 2 deletions(-)
> >
> > diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> > index e56beec43..755fcea35 100644
> > --- a/net/ipv4/inet_connection_sock.c
> > +++ b/net/ipv4/inet_connection_sock.c
> > @@ -343,8 +343,6 @@ inet_csk_find_open_port(const struct sock *sk,
> > struct inet_bind_bucket **tb_ret,
>
> Both patches are mangled by your mailer (wrapped hunk header here,
> wrapped diff --git line in 2/2), they do not apply. Please use
> git send-email for v2.
>
> Also, please trim the cover letter to the problem and the test
> results.
>
> The code change itself looks good to me.
>
> pw-bot:cr