* [PATCH net 2/2] selftests/net: check auto-selected port with SO_REUSEPORT
2026-09-23 6:05 [PATCH net 1/2] udp: fix auto-selected port colliding with an existing SO_REUSEPORT socket Jiayuan Chen
@ 2026-09-23 6:05 ` Jiayuan Chen
2026-09-23 10:24 ` [PATCH net 1/2] udp: fix auto-selected port colliding with an existing SO_REUSEPORT socket Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Jiayuan Chen @ 2026-09-23 6:05 UTC (permalink / raw)
To: netdev
Cc: Jiayuan Chen, Willem de Bruijn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan,
Tom Herbert, linux-kernel, linux-kselftest
Use IP_LOCAL_PORT_RANGE to limit a socket to 8 ports and bind 8
SO_REUSEPORT sockets to port 0. They must get 8 distinct ports and
the 9th bind must fail with EADDRINUSE. TCP and UDP should both
behave this way.
# ./ip_local_port_range.sh
Before the udp fix:
ok 5 ip_local_port_range.ip4_tcp.exhaust_8_port_range_reuseport
not ok 12 ip_local_port_range.ip4_udp.exhaust_8_port_range_reuseport
ok 33 ip_local_port_range.ip6_tcp.exhaust_8_port_range_reuseport
not ok 40 ip_local_port_range.ip6_udp.exhaust_8_port_range_reuseport
After:
ok 5 ip_local_port_range.ip4_tcp.exhaust_8_port_range_reuseport
ok 12 ip_local_port_range.ip4_udp.exhaust_8_port_range_reuseport
ok 33 ip_local_port_range.ip6_tcp.exhaust_8_port_range_reuseport
ok 40 ip_local_port_range.ip6_udp.exhaust_8_port_range_reuseport
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
.../selftests/net/ip_local_port_range.c | 27 ++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/ip_local_port_range.c b/tools/testing/selftests/net/ip_local_port_range.c
index e6834a6cfc8f..04feb702fff4 100644
--- a/tools/testing/selftests/net/ip_local_port_range.c
+++ b/tools/testing/selftests/net/ip_local_port_range.c
@@ -301,7 +301,9 @@ TEST_F(ip_local_port_range, single_port_range)
}
}
-TEST_F(ip_local_port_range, exhaust_8_port_range)
+static void exhaust_8_port_range(struct __test_metadata *_metadata,
+ const FIXTURE_VARIANT(ip_local_port_range) *variant,
+ bool reuseport)
{
__u8 port_set = 0;
int i, fd, err;
@@ -313,6 +315,11 @@ TEST_F(ip_local_port_range, exhaust_8_port_range)
fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
ASSERT_GE(fd, 0) TH_LOG("socket failed");
+ if (reuseport) {
+ err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &(int){ 1 }, sizeof(int));
+ ASSERT_TRUE(!err) TH_LOG("setsockopt(SO_REUSEPORT) failed");
+ }
+
range = pack_port_range(40000, 40007);
err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
@@ -335,6 +342,11 @@ TEST_F(ip_local_port_range, exhaust_8_port_range)
fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
ASSERT_GE(fd, 0) TH_LOG("socket failed");
+ if (reuseport) {
+ err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &(int){ 1 }, sizeof(int));
+ ASSERT_TRUE(!err) TH_LOG("setsockopt(SO_REUSEPORT) failed");
+ }
+
range = pack_port_range(40000, 40007);
err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
@@ -352,6 +364,19 @@ TEST_F(ip_local_port_range, exhaust_8_port_range)
}
}
+TEST_F(ip_local_port_range, exhaust_8_port_range)
+{
+ exhaust_8_port_range(_metadata, variant, false);
+}
+
+/* Auto-selected port must not land on a port already taken by a
+ * SO_REUSEPORT socket, so all 8 sockets must get distinct ports.
+ */
+TEST_F(ip_local_port_range, exhaust_8_port_range_reuseport)
+{
+ exhaust_8_port_range(_metadata, variant, true);
+}
+
TEST_F(ip_local_port_range, late_bind)
{
union {
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net 1/2] udp: fix auto-selected port colliding with an existing SO_REUSEPORT socket
2026-09-23 6:05 [PATCH net 1/2] udp: fix auto-selected port colliding with an existing SO_REUSEPORT socket Jiayuan Chen
2026-09-23 6:05 ` [PATCH net 2/2] selftests/net: check auto-selected port with SO_REUSEPORT Jiayuan Chen
@ 2026-09-23 10:24 ` Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2026-09-23 10:24 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, Willem de Bruijn, David S. Miller, Jakub Kicinski,
Paolo Abeni, Simon Horman, Shuah Khan, Tom Herbert, linux-kernel,
linux-kselftest
On Wed, Sep 23, 2026 at 8:06 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> Observed with two independent servers in the same process:
>
> fd1 = socket(AF_INET, SOCK_DGRAM, 0);
> setsockopt(fd1, SOL_SOCKET, SO_REUSEPORT, ...);
> bind(fd1, port 0); /* got 40000 */
>
> fd2 = socket(AF_INET, SOCK_DGRAM, 0);
> setsockopt(fd2, SOL_SOCKET, SO_REUSEPORT, ...);
> bind(fd2, port 0); /* got 40000 as well */
>
> Both sockets end up on the same port and join the same reuseport
> group, so each of them takes part of the other's datagrams. TCP does
> not do this.
>
> udp_lib_lport_inuse() keeps the reuseport rule when it scans for a
> free port: a socket with the same uid and SO_REUSEPORT set is not a
> conflict, so its port is never marked in the bitmap and the scan can
> hand it out again. That rule only makes sense when the user asks for
> a specific port.
>
> TCP fixed the same thing in commit 0643ee4fd1b7 ("inet: Fix get port
> to handle zero port number with soreuseport set"): reuseport is only
> honoured for an explicit port, not during a port scan.
>
> Do the same for UDP. Mark compatible reuseport sockets in the bitmap
> during a scan and only skip them when checking a specific port. Using
> bitmap to tell the two modes apart is not explicit, but
> udp_lib_lport_inuse() already does that for the port match itself.
>
> Note that this still collides when both sockets also have SO_REUSEADDR
> set: udp_lib_lport_inuse() skips such a pair before it reaches the
> reuseport check, so the port is never marked either. That is not a
> common setup and is left as is here.
>
> Fixes: ba418fa357a7 ("soreuseport: UDP/IPv4 implementation")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> net/ipv4/udp.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index b3887c42adfd..61cb1e3f5d93 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -147,11 +147,10 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
> (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
> sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
> inet_rcv_saddr_equal(sk, sk2, true)) {
> - if (sk2->sk_reuseport && sk->sk_reuseport &&
> + if (!bitmap && sk2->sk_reuseport && sk->sk_reuseport &&
> !rcu_access_pointer(sk->sk_reuseport_cb) &&
> uid_eq(uid, sk_uid(sk2))) {
> - if (!bitmap)
> - return 0;
> + return 0;
> } else {
> if (!bitmap)
> return 1;
> --
> 2.43.0
>
The fix is right and matches what TCP does in inet_csk_find_open_port(),
but it only covers one of the three cases where UDP's scan differs from TCP's.
On an unpatched kernel, binding 8 sockets to port 0 inside an 8-port
IP_LOCAL_PORT_RANGE:
udp SO_REUSEPORT 7 distinct ports, 9th bind succeeds udp SO_REUSEADDR
7 distinct ports,
9th bind succeeds udp REUSEADDR+REUSEPORT 6 distinct ports, 9th bind succeeds
(TCP gets 8 distinct and EADDRINUSE in all three.) Your patch only
fixes the first one;
the SO_REUSEADDR cases bail out of the conflict test before the reuseport check
so the bitmap is never marked. SO_REUSEADDR on its own is pretty common for UDP,
so I don't think we should leave it.
TCP handles all three because inet_csk_find_open_port() passes relax=false,
which disables both relaxations.
Please add a comment on top of the loop saying that @bitmap means "scanning",
since it is not obvious — or use !num, which is equivalent here since
udp_lib_get_port()
passes snum == 0 on the scan path.
Please also extend patch 2 to cover SO_REUSEADDR and SO_REUSEADDR|SO_REUSEPORT;
the helper refactor is already there, just make the bool a flags argument.
Given this is a 13 year old bind() behaviour change and the collision
window is tiny
with the default ephemeral range, net-next seems like the better target.
Perhaps a good candidate for "Cc: stable+noautosel@kernel.org # lets
not break applications..."
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bb8cfc62cb00431faefd0371a9de9346b9bb..8628b723ec946eed6337209f62f683ba4252
100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -143,21 +143,18 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
if (net_eq(sock_net(sk2), net) &&
sk2 != sk &&
(bitmap || udp_sk(sk2)->udp_port_hash == num) &&
- (!sk2->sk_reuse || !sk->sk_reuse) &&
+ (bitmap || !sk2->sk_reuse || !sk->sk_reuse) &&
(!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
inet_rcv_saddr_equal(sk, sk2, true)) {
- if (sk2->sk_reuseport && sk->sk_reuseport &&
- !rcu_access_pointer(sk->sk_reuseport_cb) &&
- uid_eq(uid, sk_uid(sk2))) {
- if (!bitmap)
+ if (!bitmap) {
+ if (sk2->sk_reuseport && sk->sk_reuseport &&
+ !rcu_access_pointer(sk->sk_reuseport_cb) &&
+ uid_eq(uid, sk_uid(sk2)))
return 0;
- } else {
- if (!bitmap)
- return 1;
- __set_bit(udp_sk(sk2)->udp_port_hash >> log,
- bitmap);
+ return 1;
}
+ __set_bit(udp_sk(sk2)->udp_port_hash >> log, bitmap);
}
}
return 0;
^ permalink raw reply [flat|nested] 3+ messages in thread