* [PATCH net-next v2 1/2] tcp: avoid false bind exhaustion with odd-sized port ranges
2026-11-06 17:14 [PATCH net-next v2 0/2] tcp: fix false exhaustion of odd-sized bind port ranges Florin Badita-Nistor
@ 2026-11-06 17:14 ` Florin Badita-Nistor
2026-11-06 17:14 ` [PATCH net-next v2 2/2] selftests/net: cover odd-sized local port ranges with one free port Florin Badita-Nistor
1 sibling, 0 replies; 3+ messages in thread
From: Florin Badita-Nistor @ 2026-11-06 17:14 UTC (permalink / raw)
To: netdev
Cc: edumazet, ncardwell, kuniyu, davem, kuba, pabeni, horms, shuah,
linux-kernel, linux-kselftest
inet_csk_find_open_port() rounds the range length down to an even
number but keeps the original exclusive upper bound for wrapping.
For an odd-sized range, the two scans can therefore miss a valid port
and return EADDRINUSE while an eligible port remains free.
For example, restrict a TCP socket to IP_LOCAL_PORT_RANGE [40000, 40002]
and hold explicit binds on 40000 and 40001. bind(..., 0) always fails,
although an explicit bind to 40002 succeeds. Both IPv4 and IPv6 TCP and
MPTCP are affected. A namespace-wide odd-sized ip_local_port_range can
also trigger the failure without a per-socket range setting.
Keep the full length for the scan bound and wrapping. The two scans
then cover every candidate in an odd-sized range, with at most one
repeated candidate when exhausted. Even-sized candidate sequences
remain unchanged.
For odd-sized ranges, subtracting an odd remaining value when wrapping
flips parity. The first scan can therefore also select offsets of the
parity preferred by __inet_hash_connect(). Namespace-wide ranges with
same-parity endpoints already trigger a sysctl warning, while connect()
uses step 1 for a per-socket IP_LOCAL_PORT_RANGE.
This only fixes bind() allocation. The rounding in __inet_hash_connect()
for namespace-wide ranges is unchanged, so connect() can still miss a
port in an odd-sized namespace range.
The issue was triggered while developing port-range selftests with
Codex assistance, then confirmed using userspace reproducers on
unmodified kernels. No kernel instrumentation or fault injection was
needed. Booted x86-64 KVM kernels were tested against the regression
selftest, the full ip_local_port_range suite, and a Go net.Listen
reproducer. The Go reproducer fails 100/100 times per IP version before
the fix and 0/100 afterwards with a three-port namespace range and two
listeners occupying its first two ports.
Fixes: ea8add2b1903 ("tcp/dccp: better use of ephemeral ports in bind()")
Signed-off-by: Florin Badita-Nistor <baditaflorin@gmail.com>
---
net/ipv4/inet_connection_sock.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index e56beec43..755fcea35 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -343,8 +343,6 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret,
low = half;
}
remaining = high - low;
- if (likely(remaining > 1))
- remaining &= ~1U;
offset = get_random_u32_below(remaining);
/* __inet_hash_connect() favors ports having @low parity
--
2.51.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH net-next v2 2/2] selftests/net: cover odd-sized local port ranges with one free port
2026-11-06 17:14 [PATCH net-next v2 0/2] tcp: fix false exhaustion of odd-sized bind port ranges Florin Badita-Nistor
2026-11-06 17:14 ` [PATCH net-next v2 1/2] tcp: avoid false bind exhaustion with odd-sized " Florin Badita-Nistor
@ 2026-11-06 17:14 ` Florin Badita-Nistor
1 sibling, 0 replies; 3+ messages in thread
From: Florin Badita-Nistor @ 2026-11-06 17:14 UTC (permalink / raw)
To: netdev
Cc: edumazet, ncardwell, kuniyu, davem, kuba, pabeni, horms, shuah,
linux-kernel, linux-kselftest
Leave each port in three- and five-port socket-local ranges as the only
available candidate and verify that bind(..., 0) can allocate it. Cover
both lower-bound parities and repeat allocation to vary the random
starting offset. Use the existing IPv4/IPv6 TCP, UDP, SCTP and MPTCP
fixture variants.
This catches the false EADDRINUSE caused by rounding an odd-sized range
down during TCP port allocation. Without the preceding fix, the TCP
and MPTCP variants fail on both IP versions when the last port in a
three-port range is the only free one. With the fix, all eight variants
pass.
Allow the loopback bind helper to take a port so the test can hold
explicit binds on every other candidate. Retain the existing helper for
automatic binding and run under the existing isolated-network-namespace
wrapper.
The regression test was developed with Codex assistance and exercised
on booted x86-64 KVM kernels before and after the fix.
Signed-off-by: Florin Badita-Nistor <baditaflorin@gmail.com>
---
.../selftests/net/ip_local_port_range.c | 67 ++++++++++++++++++-
1 file changed, 64 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/net/ip_local_port_range.c b/tools/testing/selftests/net/ip_local_port_range.c
index 3d32b33cb..c17d95045 100644
--- a/tools/testing/selftests/net/ip_local_port_range.c
+++ b/tools/testing/selftests/net/ip_local_port_range.c
@@ -44,7 +44,7 @@ static int get_so_domain(int fd)
return domain;
}
-static int bind_to_loopback_any_port(int fd)
+static int bind_to_loopback_port(int fd, __u16 port)
{
union {
struct sockaddr sa;
@@ -57,13 +57,13 @@ static int bind_to_loopback_any_port(int fd)
switch (get_so_domain(fd)) {
case AF_INET:
addr.v4.sin_family = AF_INET;
- addr.v4.sin_port = htons(0);
+ addr.v4.sin_port = htons(port);
addr.v4.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
addr_len = sizeof(addr.v4);
break;
case AF_INET6:
addr.v6.sin6_family = AF_INET6;
- addr.v6.sin6_port = htons(0);
+ addr.v6.sin6_port = htons(port);
addr.v6.sin6_addr = in6addr_loopback;
addr_len = sizeof(addr.v6);
break;
@@ -74,6 +74,11 @@ static int bind_to_loopback_any_port(int fd)
return bind(fd, &addr.sa, addr_len);
}
+static int bind_to_loopback_any_port(int fd)
+{
+ return bind_to_loopback_port(fd, 0);
+}
+
static int get_sock_port(int fd)
{
union {
@@ -301,6 +306,62 @@ TEST_F(ip_local_port_range, single_port_range)
}
}
+/* Leave each port in turn as the only available one. An odd-sized range
+ * must not report exhaustion while a port at either end is still free.
+ */
+TEST_F(ip_local_port_range, odd_port_range)
+{
+ const struct {
+ __u16 low;
+ __u16 high;
+ } ranges[] = {
+ { 40000, 40002 },
+ { 40001, 40003 },
+ { 40000, 40004 },
+ { 40001, 40005 },
+ };
+ int i, j, port, free_port, fd, err;
+ __u32 range;
+ int fds[5];
+
+ for (i = 0; i < ARRAY_SIZE(ranges); i++) {
+ range = pack_port_range(ranges[i].low, ranges[i].high);
+ for (free_port = ranges[i].low; free_port <= ranges[i].high; free_port++) {
+ for (port = ranges[i].low; port <= ranges[i].high; port++) {
+ j = port - ranges[i].low;
+ fds[j] = -1;
+ if (port == free_port)
+ continue;
+ fd = socket(variant->so_domain, variant->so_type,
+ variant->so_protocol);
+ ASSERT_GE(fd, 0) TH_LOG("socket failed");
+ fds[j] = fd;
+ err = bind_to_loopback_port(fd, port);
+ ASSERT_EQ(err, 0) TH_LOG("bind(%d) failed", port);
+ }
+
+ /* Exercise different random starting offsets. */
+ for (j = 0; j < 16; j++) {
+ fd = socket(variant->so_domain, variant->so_type,
+ variant->so_protocol);
+ ASSERT_GE(fd, 0) TH_LOG("socket failed");
+ err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE,
+ &range, sizeof(range));
+ ASSERT_EQ(err, 0) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
+ err = bind_to_loopback_any_port(fd);
+ ASSERT_EQ(err, 0) TH_LOG("range %d-%d, free port %d",
+ ranges[i].low, ranges[i].high, free_port);
+ ASSERT_EQ(get_sock_port(fd), free_port);
+ ASSERT_EQ(close(fd), 0);
+ }
+
+ for (j = 0; j <= ranges[i].high - ranges[i].low; j++)
+ if (fds[j] >= 0)
+ ASSERT_EQ(close(fds[j]), 0);
+ }
+ }
+}
+
#define REUSEADDR 0x1
#define REUSEPORT 0x2
--
2.51.0
^ permalink raw reply [flat|nested] 3+ messages in thread