[PATCH net 1/2] udp: fix auto-selected port colliding with an existing SO_REUSEPORT socket

[Jiayuan Chen <jiayuan.chen@linux.dev>]

Observed with two independent servers in the same process:

  fd1 = socket(AF_INET, SOCK_DGRAM, 0);
  setsockopt(fd1, SOL_SOCKET, SO_REUSEPORT, ...);
  bind(fd1, port 0);          /* got 40000 */

  fd2 = socket(AF_INET, SOCK_DGRAM, 0);
  setsockopt(fd2, SOL_SOCKET, SO_REUSEPORT, ...);
  bind(fd2, port 0);          /* got 40000 as well */

Both sockets end up on the same port and join the same reuseport
group, so each of them takes part of the other's datagrams. TCP does
not do this.

udp_lib_lport_inuse() keeps the reuseport rule when it scans for a
free port: a socket with the same uid and SO_REUSEPORT set is not a
conflict, so its port is never marked in the bitmap and the scan can
hand it out again. That rule only makes sense when the user asks for
a specific port.

TCP fixed the same thing in commit 0643ee4fd1b7 ("inet: Fix get port
to handle zero port number with soreuseport set"): reuseport is only
honoured for an explicit port, not during a port scan.

Do the same for UDP. Mark compatible reuseport sockets in the bitmap
during a scan and only skip them when checking a specific port. Using
bitmap to tell the two modes apart is not explicit, but
udp_lib_lport_inuse() already does that for the port match itself.

Note that this still collides when both sockets also have SO_REUSEADDR
set: udp_lib_lport_inuse() skips such a pair before it reaches the
reuseport check, so the port is never marked either. That is not a
common setup and is left as is here.

Fixes: ba418fa357a7 ("soreuseport: UDP/IPv4 implementation")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/ipv4/udp.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b3887c42adfd..61cb1e3f5d93 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -147,11 +147,10 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
 		    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
 		     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
 		    inet_rcv_saddr_equal(sk, sk2, true)) {
-			if (sk2->sk_reuseport && sk->sk_reuseport &&
+			if (!bitmap && sk2->sk_reuseport && sk->sk_reuseport &&
 			    !rcu_access_pointer(sk->sk_reuseport_cb) &&
 			    uid_eq(uid, sk_uid(sk2))) {
-				if (!bitmap)
-					return 0;
+				return 0;
 			} else {
 				if (!bitmap)
 					return 1;
-- 
2.43.0