@@ -174,16 +174,22 @@ static int compute_score(struct sock *sk, const struct net *net,
static struct sock *udp6_lib_lookup2(const struct net *net,
const struct in6_addr *saddr, __be16 sport,
const struct in6_addr *daddr, unsigned int hnum,
- int dif, int sdif, struct udp_hslot *hslot2,
+ int dif, int sdif,
+ unsigned int hash2, unsigned int mask,
+ struct udp_hslot *hslot2,
struct sk_buff *skb)
{
+ unsigned int hash2_rescan;
struct sock *sk, *result;
int score, badness;
bool need_rescore;
+rescan:
+ hash2_rescan = hash2;
result = NULL;
badness = -1;
udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
+ hash2_rescan = udp_sk(sk)->udp_portaddr_hash;
need_rescore = false;
rescore:
score = compute_score(need_rescore ? result : sk, net, saddr,
@@ -224,6 +230,16 @@ static struct sock *udp6_lib_lookup2(const struct net *net,
goto rescore;
}
}
+
+ /* udp sockets can get moved to a different hash chain.
+ * If the chains have got crossed then rescan.
+ */
+ if ((hash2_rescan ^ hash2) & mask) {
+ /* Ensure hslot2->head is reread */
+ barrier();
+ goto rescan;
+ }
+
return result;
}
@@ -320,7 +336,7 @@ struct sock *__udp6_lib_lookup(const struct net *net,
/* Lookup connected or non-wildcard sockets */
result = udp6_lib_lookup2(net, saddr, sport,
daddr, hnum, dif, sdif,
- hslot2, skb);
+ hash2, udptable->mask, hslot2, skb);
if (!IS_ERR_OR_NULL(result) && result->sk_state == TCP_ESTABLISHED)
goto done;
@@ -346,7 +362,7 @@ struct sock *__udp6_lib_lookup(const struct net *net,
result = udp6_lib_lookup2(net, saddr, sport,
&in6addr_any, hnum, dif, sdif,
- hslot2, skb);
+ hash2, udptable->mask, hslot2, skb);
done:
if (IS_ERR(result))
return NULL;
udp_lib_rehash() can get called at any time and will move a socket to a different hash2 chain. This can cause udp6_lib_lookup2() (processing incoming UDP) to fail to find a socket and an ICMP port unreachable be sent. Prior to ca065d0cf80fa the lookup used 'hlist_nulls' and checked that the 'end if list' marker was on the correct list. Signed-off-by: David Laight <david.laight.linux@gmail.com> --- net/ipv6/udp.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)