[PATCH net 0/2] udp: two fixes for the 4-tuple hash table

[PATCH net 0/2] udp: two fixes for the 4-tuple hash table

[Shardul Bankar]

Two ways a UDP socket ends up in the wrong place in the 4-tuple hash table.
The patches are independent, with different Fixes: tags and no dependency
between them.

Patch 1: a socket that connects a second time is not relocated, so it stays
filed under its first peer's hash and packets for it fall back to scoring
the hash2 chain for its address and port.

Patch 2: a socket bound to a specific address and port is not taken out of
the table when it disconnects, because __udp_disconnect() only does that
via ->rehash() or ->unhash() and neither runs for it.

Both are in code shared by IPv4 and IPv6.

Patch 1's cost, with N sockets sharing a port and one of them misfiled,
200k packets sent to its 4-tuple:

	N	without		with
	200	1,061,652	2,093,259 pps
	500	  522,553	2,055,078 pps
	1000	  279,729	2,136,606 pps

Correctly filed sockets measure ~2.1M pps throughout, so the cost scales
with the number of sockets on the port, as the fallback scan does. For
comparison, commit 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash for connected
socket") measured 290,860 pps without the table and 1,889,658 with it at
500 connected sockets.

Patch 2's cost is not in throughput. Its stale entry keeps hash4_cnt raised
for the life of the socket, so every packet for that address and port is
sent through the 4-tuple lookup first; on IPv6 the entry is also matchable,
because __udp_disconnect() does not clear sk_v6_daddr. That last one is a
separate defect, which I will send on its own.

Neither patch has a selftest. Nothing in tree reports which 4-tuple bucket
a socket is filed under, so a test can only measure the cost indirectly.
What I did instead was add pr_info() to the hash4 paths and a knob that
dumps bucket occupancy, then run the same scenarios on two kernels
differing only by these patches; that is where the numbers above come from.
The instrumentation, the reproducers and the benchmark are at [1]. If
exposing the bucket through diag would be welcome, that would make both
defects testable in tree and I am glad to do it for net-next.

Removing the connect(AF_UNSPEC) limitation described in 644f9108f3a5 is a
side effect of patch 1 fixing the general case. I can make it narrower if
you would rather that limitation stayed.

Tooling, per Documentation/process/generated-content.rst: this series was
developed in an assisted session with an LLM. The assistant did most of
the code reading, wrote the instrumentation and reproducers behind [1],
drafted these changelogs, and ran the A/B builds and the regression
suites below. Every claim in these messages was checked against the
source, and the IPv6 behaviour described in patch 2 was confirmed at
runtime.

Tested on x86-64, IPv4 and IPv6. No regressions across reuseport_bpf,
reuseport_bpf_cpu, reuseport_addr_any.sh, reuseport_dualstack,
udpgso_bench.sh, udpgro_bench.sh and socket.

[1] https://github.com/shardulsdk-mpiric/linux/tree/udp-hash4-fix-verification

To: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: "David S. Miller" <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
To: Jakub Kicinski <kuba@kernel.org>
To: Paolo Abeni <pabeni@redhat.com>
To: Simon Horman <horms@kernel.org>
To: Philo Lu <lulie@linux.alibaba.com>
To: Fred Chen <fred.cc@alibaba-inc.com>
To: Yubing Qiu <yubing.qiuyubing@alibaba-inc.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Cambda Zhu <cambda@linux.alibaba.com>
Cc: Janak Bhatt <janak@mpiric.us>
Cc: Kalpan Jani <kalpan.jani@mpiricsoftware.com>
Cc: Shardul Bankar <shardulsb08@gmail.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
Shardul Bankar (2):
      udp: relocate a connected socket in the 4-tuple hash table on re-connect
      udp: remove a disconnected socket from the 4-tuple hash table

 net/ipv4/udp.c | 42 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)
---
base-commit: c9151088f1674fd29ff26a20f5fc687acf53a2f0
change-id: 20260911-udp_hash4_fix_v1-ac7e020d4089

Best regards,
--  
Shardul Bankar <shardul.b@mpiricsoftware.com>

[PATCH net 1/2] udp: relocate a connected socket in the 4-tuple hash table on re-connect

[Shardul Bankar]

A connected UDP socket that connects again to a different peer is not
re-filed in the 4-tuple hash table:

    sk binds to 127.0.0.1:21001
    sk connects to 127.0.0.2:20001	// filed under hash(sk, peer1)
    sk connects to 127.0.0.3:20002	// still filed under hash(sk, peer1)
    packet from 127.0.0.3:20002		// hash(sk, peer2) misses, so the
					// lookup falls back to scoring the
					// hash2 chain for this address
					// and port

udp_lib_hash4() returns early when the socket is already hashed, assuming
->rehash() relocates it. ->rehash() runs from __ip{4,6}_datagram_connect()
only while the receive address is unset, which a second connect never is:
the first connect assigns it, whether the socket was bound to a specific
address or to the wildcard. commit 644f9108f3a5 ("udp: Make rehash4
independent in udp_lib_rehash()") added that early return and named
connect(AF_UNSPEC) as the way around it. That workaround does not help a
socket with both SOCK_BINDADDR_LOCK and SOCK_BINDPORT_LOCK set, because
__udp_disconnect() skips ->rehash() for the first and ->unhash() for the
second.

Delivery is correct either way.

Relocate the socket when the hash it is filed under differs from the one
requested, which is what commit 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash
for connected socket") did before the early return became unconditional. It
is done here under hslot->lock, which that version did not take, to match
udp_lib_rehash() and udp_lib_unhash(). hslot2 is unchanged, so hash4_cnt
needs no adjustment, as in udp_lib_rehash(). A first connect is unaffected,
and IPv6 shares the code.

With 500 sockets on the port, a re-connected socket measured 522,553 pps
without this change and 2,055,078 with it. The UDP side was noted as
remaining work in [1].

Link: https://lore.kernel.org/netdev/apnHqmYZQ4yzOP4N@v4bel/ [1]
Fixes: 644f9108f3a5 ("udp: Make rehash4 independent in udp_lib_rehash()")
Assisted-by: LLM
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
 net/ipv4/udp.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bb8cfc62cb00..0fa3cdbdcc21 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -617,14 +617,23 @@ void udp_lib_hash4(struct sock *sk, u16 hash)
 	struct net *net = sock_net(sk);
 	struct udp_table *udptable;
 
-	/* Connected udp socket can re-connect to another remote address, which
-	 * will be handled by rehash. Thus no need to redo hash4 here.
+	udptable = net->ipv4.udp_table;
+	hslot = udp_hashslot(udptable, net, udp_sk(sk)->udp_port_hash);
+
+	/* A connected socket can re-connect to another address. rehash()
+	 * relocates it, but only runs when the local address changes, so a
+	 * socket bound to a specific address would stay filed under the
+	 * previous peer's hash. Move it here.
 	 */
-	if (udp_hashed4(sk))
+	if (udp_hashed4(sk)) {
+		if (udp_sk(sk)->udp_lrpa_hash != hash) {
+			spin_lock_bh(&hslot->lock);
+			udp_rehash4(udptable, sk, hash);
+			spin_unlock_bh(&hslot->lock);
+		}
 		return;
+	}
 
-	udptable = net->ipv4.udp_table;
-	hslot = udp_hashslot(udptable, net, udp_sk(sk)->udp_port_hash);
 	hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
 	hslot4 = udp_hashslot4(udptable, hash);
 	udp_sk(sk)->udp_lrpa_hash = hash;

-- 
2.34.1

[PATCH net 2/2] udp: remove a disconnected socket from the 4-tuple hash table

[Shardul Bankar]

A UDP socket bound to a specific address and port keeps its entry in the
4-tuple hash table after it is disconnected:

    sk binds to 127.0.0.1:21001
    sk connects to 127.0.0.2:20001	// filed in the 4-tuple table
    sk disconnects, connect(AF_UNSPEC)	// still filed, peer now 0.0.0.0:0

__udp_disconnect() takes a socket out of that table only as a side effect
of ->rehash() or ->unhash(), and it skips ->rehash() when
SOCK_BINDADDR_LOCK is set and ->unhash() when SOCK_BINDPORT_LOCK is set.
commit 6996a2d2d0a6 ("udp: Unhash auto-bound connected sk from 4-tuple hash
table when disconnected.") fixed the same end state for a wildcard-bound
socket, by a path this one does not take.

The entry is counted whether or not anything hits it. hash4_cnt on the
hash2 slot stays raised for as long as the socket lives, so udp_has_hash4()
keeps sending every packet for that address and port through the 4-tuple
lookup first.

On IPv6 it can also be hit. __udp_disconnect() does not clear sk_v6_daddr,
so udp_v6_rehash() files the entry under the peer the socket was connected
to with a zero dport, and inet6_match() compares that same
field: a datagram from the former peer with a zero source port matches,
and source port zero is accepted on receive. On IPv4 the peer is cleared,
so a match would need a zero source address as well, which the routing
layer rejects as martian. The stale sk_v6_daddr is a separate defect, not
addressed here; removing the entry closes this path either way.

The entry can also be relocated. __udp_disconnect() clears sk_bound_dev_if,
so a subsequent SO_BINDTODEVICE calls ->rehash(), and because the receive
address is still specific udp_lib_rehash() moves the entry instead of
removing it, into the bucket that (rcv_saddr, num, 0, 0) hashes to -- a
pure function of the address and port, so every socket reaching this state
on one address and port collects in one bucket. The bucket cannot be chosen
from outside, as udp_ehashfn() is seeded with a per-boot secret. This last
one became reachable only with commit 644f9108f3a5 ("udp: Make rehash4
independent in udp_lib_rehash()"), which moved the hash4 handling out of a
branch a disconnected socket does not take; the stale entry itself dates
from the commit in Fixes.

Take the socket out of the table before __udp_disconnect() runs, while it
still matches how it was filed. This also reaches the wildcard case ahead
of udp_lib_rehash()'s udp_unhash4() branch, leaving that branch unreachable
from udp_disconnect(); removing it belongs in net-next. udp_disconnect()
and udp_abort() are the only UDP entries into __udp_disconnect(), which is
shared with raw, ping and l2tp sockets that are not struct udp_sock:
ping_prot.obj_size is sizeof(struct inet_sock), so udp_hashed4() on one
would read past the allocation.

Fixes: 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash for connected socket")
Assisted-by: LLM
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
 net/ipv4/udp.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0fa3cdbdcc21..b090bd1f59e8 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2206,9 +2206,31 @@ int __udp_disconnect(struct sock *sk, int flags)
 }
 EXPORT_SYMBOL(__udp_disconnect);
 
+/* __udp_disconnect() takes a socket out of the 4-tuple hash table only via
+ * ->rehash() or ->unhash(), and neither runs for a socket bound to a
+ * specific address and port. Remove it here, before its peer is cleared.
+ */
+static void udp_unhash4_on_disconnect(struct sock *sk)
+{
+	struct net *net = sock_net(sk);
+	struct udp_table *udptable;
+	struct udp_hslot *hslot;
+
+	if (!udp_hashed4(sk))
+		return;
+
+	udptable = net->ipv4.udp_table;
+	hslot = udp_hashslot(udptable, net, udp_sk(sk)->udp_port_hash);
+
+	spin_lock_bh(&hslot->lock);
+	udp_unhash4(udptable, sk);
+	spin_unlock_bh(&hslot->lock);
+}
+
 int udp_disconnect(struct sock *sk, int flags)
 {
 	lock_sock(sk);
+	udp_unhash4_on_disconnect(sk);
 	__udp_disconnect(sk, flags);
 	release_sock(sk);
 	return 0;
@@ -3140,6 +3162,7 @@ int udp_abort(struct sock *sk, int err)
 
 	sk->sk_err = err;
 	sk_error_report(sk);
+	udp_unhash4_on_disconnect(sk);
 	__udp_disconnect(sk, 0);
 
 out:

-- 
2.34.1

Re: [PATCH net 1/2] udp: relocate a connected socket in the 4-tuple hash table on re-connect

[Kuniyuki Iwashima]

On Thu, Sep 17, 2026 at 2:26 AM Shardul Bankar
<shardul.b@mpiricsoftware.com> wrote:
>
> A connected UDP socket that connects again to a different peer is not
> re-filed in the 4-tuple hash table:
>
>     sk binds to 127.0.0.1:21001
>     sk connects to 127.0.0.2:20001      // filed under hash(sk, peer1)
>     sk connects to 127.0.0.3:20002      // still filed under hash(sk, peer1)
>     packet from 127.0.0.3:20002         // hash(sk, peer2) misses, so the
>                                         // lookup falls back to scoring the
>                                         // hash2 chain for this address
>                                         // and port
>
> udp_lib_hash4() returns early when the socket is already hashed, assuming
> ->rehash() relocates it. ->rehash() runs from __ip{4,6}_datagram_connect()
> only while the receive address is unset, which a second connect never is:
> the first connect assigns it, whether the socket was bound to a specific
> address or to the wildcard. commit 644f9108f3a5 ("udp: Make rehash4
> independent in udp_lib_rehash()") added that early return and named
> connect(AF_UNSPEC) as the way around it. That workaround does not help a
> socket with both SOCK_BINDADDR_LOCK and SOCK_BINDPORT_LOCK set, because
> __udp_disconnect() skips ->rehash() for the first and ->unhash() for the
> second.
>
> Delivery is correct either way.
>
> Relocate the socket when the hash it is filed under differs from the one
> requested, which is what commit 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash
> for connected socket") did before the early return became unconditional. It
> is done here under hslot->lock, which that version did not take, to match
> udp_lib_rehash() and udp_lib_unhash(). hslot2 is unchanged, so hash4_cnt
> needs no adjustment, as in udp_lib_rehash(). A first connect is unaffected,
> and IPv6 shares the code.
>
> With 500 sockets on the port, a re-connected socket measured 522,553 pps
> without this change and 2,055,078 with it. The UDP side was noted as
> remaining work in [1].
>
> Link: https://lore.kernel.org/netdev/apnHqmYZQ4yzOP4N@v4bel/ [1]

This link looks random to me.

> Fixes: 644f9108f3a5 ("udp: Make rehash4 independent in udp_lib_rehash()")
> Assisted-by: LLM
> Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>

The change itself looks good.

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net 2/2] udp: remove a disconnected socket from the 4-tuple hash table

[Kuniyuki Iwashima]

On Thu, Sep 17, 2026 at 2:26 AM Shardul Bankar
<shardul.b@mpiricsoftware.com> wrote:
>
> A UDP socket bound to a specific address and port keeps its entry in the
> 4-tuple hash table after it is disconnected:
>
>     sk binds to 127.0.0.1:21001
>     sk connects to 127.0.0.2:20001      // filed in the 4-tuple table
>     sk disconnects, connect(AF_UNSPEC)  // still filed, peer now 0.0.0.0:0
>
> __udp_disconnect() takes a socket out of that table only as a side effect
> of ->rehash() or ->unhash(), and it skips ->rehash() when
> SOCK_BINDADDR_LOCK is set and ->unhash() when SOCK_BINDPORT_LOCK is set.
> commit 6996a2d2d0a6 ("udp: Unhash auto-bound connected sk from 4-tuple hash
> table when disconnected.") fixed the same end state for a wildcard-bound
> socket, by a path this one does not take.
>
> The entry is counted whether or not anything hits it. hash4_cnt on the
> hash2 slot stays raised for as long as the socket lives, so udp_has_hash4()
> keeps sending every packet for that address and port through the 4-tuple
> lookup first.
>
> On IPv6 it can also be hit. __udp_disconnect() does not clear sk_v6_daddr,
> so udp_v6_rehash() files the entry under the peer the socket was connected
> to with a zero dport, and inet6_match() compares that same
> field: a datagram from the former peer with a zero source port matches,
> and source port zero is accepted on receive. On IPv4 the peer is cleared,
> so a match would need a zero source address as well, which the routing
> layer rejects as martian. The stale sk_v6_daddr is a separate defect, not
> addressed here; removing the entry closes this path either way.
>
> The entry can also be relocated. __udp_disconnect() clears sk_bound_dev_if,
> so a subsequent SO_BINDTODEVICE calls ->rehash(), and because the receive
> address is still specific udp_lib_rehash() moves the entry instead of
> removing it, into the bucket that (rcv_saddr, num, 0, 0) hashes to -- a
> pure function of the address and port, so every socket reaching this state
> on one address and port collects in one bucket. The bucket cannot be chosen
> from outside, as udp_ehashfn() is seeded with a per-boot secret. This last
> one became reachable only with commit 644f9108f3a5 ("udp: Make rehash4
> independent in udp_lib_rehash()"), which moved the hash4 handling out of a
> branch a disconnected socket does not take; the stale entry itself dates
> from the commit in Fixes.
>
> Take the socket out of the table before __udp_disconnect() runs, while it
> still matches how it was filed. This also reaches the wildcard case ahead
> of udp_lib_rehash()'s udp_unhash4() branch, leaving that branch unreachable
> from udp_disconnect(); removing it belongs in net-next. udp_disconnect()
> and udp_abort() are the only UDP entries into __udp_disconnect(), which is
> shared with raw, ping and l2tp sockets that are not struct udp_sock:
> ping_prot.obj_size is sizeof(struct inet_sock), so udp_hashed4() on one
> would read past the allocation.
>
> Fixes: 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash for connected socket")
> Assisted-by: LLM
> Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net 0/2] udp: two fixes for the 4-tuple hash table

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 17 Sep 2026 14:55:31 +0530 you wrote:
> Two ways a UDP socket ends up in the wrong place in the 4-tuple hash table.
> The patches are independent, with different Fixes: tags and no dependency
> between them.
> 
> Patch 1: a socket that connects a second time is not relocated, so it stays
> filed under its first peer's hash and packets for it fall back to scoring
> the hash2 chain for its address and port.
> 
> [...]

Here is the summary with links:
  - [net,1/2] udp: relocate a connected socket in the 4-tuple hash table on re-connect
    https://git.kernel.org/netdev/net/c/5fd0783b99d4
  - [net,2/2] udp: remove a disconnected socket from the 4-tuple hash table
    https://git.kernel.org/netdev/net/c/9e95b1a94c9c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html