[PATCH net v2] tcp: Fix fastreuse cache initialization on first bind

[PATCH net v2] tcp: Fix fastreuse cache initialization on first bind

[Zhewei Yuan]

inet_csk_update_fastreuse() initializes the reuse caches only when
tb->bhash2 is empty, but both inet_csk_get_port() and
__inet_inherit_port() link tb2 before calling it, so the first-bind
branch is never taken.

As a result, SO_REUSEADDR binds never get fastreuse=1 and keep
scanning existing owners, and SO_REUSEPORT starts in STRICT instead
of ANY.

Initialize the caches when tb2 is the only entry in tb->bhash2 and has
no owners. Timewait sockets are also linked on tb2->owners, so this is
equivalent to the old hlist_empty(&tb->owners) test.

Found by manual code inspection and confirmed with GDB. Binding 16000
SO_REUSEADDR sockets to one address/port in a KVM guest takes 4.18 s
before and 19.4 ms after this patch. Existing bind/reuse selftests
pass. Analysis and testing were assisted by an AI tool (Codex).

Fixes: 8002d44fe84d ("tcp: Check hlist_empty(&tb->bhash2) instead of hlist_empty(&tb->owners).")
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Zhewei Yuan <yzwlhm@gmail.com>
---
v2: drop the KUnit patch and the cover letter, shorten the changelog,
    add Eric's Reviewed-by.
Link to v1: https://lore.kernel.org/netdev/20261025090048.27870-2-yzwlhm@gmail.com/

 net/ipv4/inet_connection_sock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 8151c638a24..93b306d91b6 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -446,7 +446,8 @@ void inet_csk_update_fastreuse(const struct sock *sk,
 {
 	bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;

-	if (hlist_empty(&tb->bhash2)) {
+	if (hlist_is_singular_node(&tb2->bhash_node, &tb->bhash2) &&
+	    hlist_empty(&tb2->owners)) {
 		tb->fastreuse = reuse;
 		if (sk->sk_reuseport) {
 			tb->fastreuseport = FASTREUSEPORT_ANY;

base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
--
2.52.0

Re: [PATCH net v2] tcp: Fix fastreuse cache initialization on first bind

[Kuniyuki Iwashima]

On Mon, 26 Oct 2026 09:52:07 +0000, Zhewei Yuan wrote:
> inet_csk_update_fastreuse() initializes the reuse caches only when
> tb->bhash2 is empty, but both inet_csk_get_port() and
> __inet_inherit_port() link tb2 before calling it, so the first-bind
> branch is never taken.
> 
> As a result, SO_REUSEADDR binds never get fastreuse=1 and keep
> scanning existing owners, and SO_REUSEPORT starts in STRICT instead
> of ANY.
> 
> Initialize the caches when tb2 is the only entry in tb->bhash2 and has
> no owners. Timewait sockets are also linked on tb2->owners, so this is
> equivalent to the old hlist_empty(&tb->owners) test.
> 
> Found by manual code inspection and confirmed with GDB. Binding 16000
> SO_REUSEADDR sockets to one address/port in a KVM guest takes 4.18 s
> before and 19.4 ms after this patch. Existing bind/reuse selftests
> pass. Analysis and testing were assisted by an AI tool (Codex).
> 
> Fixes: 8002d44fe84d ("tcp: Check hlist_empty(&tb->bhash2) instead of hlist_empty(&tb->owners).")
> Reviewed-by: Eric Dumazet <edumazet@kernel.org>
> Signed-off-by: Zhewei Yuan <yzwlhm@gmail.com>

Good catch, thanks !

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net v2] tcp: Fix fastreuse cache initialization on first bind

[Jason Xing]

On Mon, Oct 26, 2026 at 5:55 PM Zhewei Yuan <yzwlhm@gmail.com> wrote:
>
> inet_csk_update_fastreuse() initializes the reuse caches only when
> tb->bhash2 is empty, but both inet_csk_get_port() and
> __inet_inherit_port() link tb2 before calling it, so the first-bind
> branch is never taken.
>
> As a result, SO_REUSEADDR binds never get fastreuse=1 and keep
> scanning existing owners, and SO_REUSEPORT starts in STRICT instead
> of ANY.
>
> Initialize the caches when tb2 is the only entry in tb->bhash2 and has
> no owners. Timewait sockets are also linked on tb2->owners, so this is
> equivalent to the old hlist_empty(&tb->owners) test.
>
> Found by manual code inspection and confirmed with GDB. Binding 16000

I thought it was discovered by an LLM.

> SO_REUSEADDR sockets to one address/port in a KVM guest takes 4.18 s
> before and 19.4 ms after this patch. Existing bind/reuse selftests
> pass. Analysis and testing were assisted by an AI tool (Codex).
>
> Fixes: 8002d44fe84d ("tcp: Check hlist_empty(&tb->bhash2) instead of hlist_empty(&tb->owners).")
> Reviewed-by: Eric Dumazet <edumazet@kernel.org>
> Signed-off-by: Zhewei Yuan <yzwlhm@gmail.com>

Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>

Thanks!