On Wed, Sep 23, 2026 at 8:06 AM Jiayuan Chen <[email protected]> wrote: > > Observed with two independent servers in the same process: > > fd1 = socket(AF_INET, SOCK_DGRAM, 0); > setsockopt(fd1, SOL_SOCKET, SO_REUSEPORT, ...); > bind(fd1, port 0); /* got 40000 */ > > fd2 = socket(AF_INET, SOCK_DGRAM, 0); > setsockopt(fd2, SOL_SOCKET, SO_REUSEPORT, ...); > bind(fd2, port 0); /* got 40000 as well */ > > Both sockets end up on the same port and join the same reuseport > group, so each of them takes part of the other's datagrams. TCP does > not do this. > > udp_lib_lport_inuse() keeps the reuseport rule when it scans for a > free port: a socket with the same uid and SO_REUSEPORT set is not a > conflict, so its port is never marked in the bitmap and the scan can > hand it out again. That rule only makes sense when the user asks for > a specific port. > > TCP fixed the same thing in commit 0643ee4fd1b7 ("inet: Fix get port > to handle zero port number with soreuseport set"): reuseport is only > honoured for an explicit port, not during a port scan. > > Do the same for UDP. Mark compatible reuseport sockets in the bitmap > during a scan and only skip them when checking a specific port. Using > bitmap to tell the two modes apart is not explicit, but > udp_lib_lport_inuse() already does that for the port match itself. > > Note that this still collides when both sockets also have SO_REUSEADDR > set: udp_lib_lport_inuse() skips such a pair before it reaches the > reuseport check, so the port is never marked either. That is not a > common setup and is left as is here. > > Fixes: ba418fa357a7 ("soreuseport: UDP/IPv4 implementation") > Signed-off-by: Jiayuan Chen <[email protected]> > --- > net/ipv4/udp.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c > index b3887c42adfd..61cb1e3f5d93 100644 > --- a/net/ipv4/udp.c > +++ b/net/ipv4/udp.c > @@ -147,11 +147,10 @@ static int udp_lib_lport_inuse(struct net *net, __u16 > num, > (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if || > sk2->sk_bound_dev_if == sk->sk_bound_dev_if) && > inet_rcv_saddr_equal(sk, sk2, true)) { > - if (sk2->sk_reuseport && sk->sk_reuseport && > + if (!bitmap && sk2->sk_reuseport && sk->sk_reuseport > && > !rcu_access_pointer(sk->sk_reuseport_cb) && > uid_eq(uid, sk_uid(sk2))) { > - if (!bitmap) > - return 0; > + return 0; > } else { > if (!bitmap) > return 1; > -- > 2.43.0 >
The fix is right and matches what TCP does in inet_csk_find_open_port(), but it only covers one of the three cases where UDP's scan differs from TCP's. On an unpatched kernel, binding 8 sockets to port 0 inside an 8-port IP_LOCAL_PORT_RANGE: udp SO_REUSEPORT 7 distinct ports, 9th bind succeeds udp SO_REUSEADDR 7 distinct ports, 9th bind succeeds udp REUSEADDR+REUSEPORT 6 distinct ports, 9th bind succeeds (TCP gets 8 distinct and EADDRINUSE in all three.) Your patch only fixes the first one; the SO_REUSEADDR cases bail out of the conflict test before the reuseport check so the bitmap is never marked. SO_REUSEADDR on its own is pretty common for UDP, so I don't think we should leave it. TCP handles all three because inet_csk_find_open_port() passes relax=false, which disables both relaxations. Please add a comment on top of the loop saying that @bitmap means "scanning", since it is not obvious — or use !num, which is equivalent here since udp_lib_get_port() passes snum == 0 on the scan path. Please also extend patch 2 to cover SO_REUSEADDR and SO_REUSEADDR|SO_REUSEPORT; the helper refactor is already there, just make the bool a flags argument. Given this is a 13 year old bind() behaviour change and the collision window is tiny with the default ephemeral range, net-next seems like the better target. Perhaps a good candidate for "Cc: [email protected] # lets not break applications..." diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index bb8cfc62cb00431faefd0371a9de9346b9bb..8628b723ec946eed6337209f62f683ba4252 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -143,21 +143,18 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num, if (net_eq(sock_net(sk2), net) && sk2 != sk && (bitmap || udp_sk(sk2)->udp_port_hash == num) && - (!sk2->sk_reuse || !sk->sk_reuse) && + (bitmap || !sk2->sk_reuse || !sk->sk_reuse) && (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) && inet_rcv_saddr_equal(sk, sk2, true)) { - if (sk2->sk_reuseport && sk->sk_reuseport && - !rcu_access_pointer(sk->sk_reuseport_cb) && - uid_eq(uid, sk_uid(sk2))) { - if (!bitmap) + if (!bitmap) { + if (sk2->sk_reuseport && sk->sk_reuseport && + !rcu_access_pointer(sk->sk_reuseport_cb) && + uid_eq(uid, sk_uid(sk2))) return 0; - } else { - if (!bitmap) - return 1; - __set_bit(udp_sk(sk2)->udp_port_hash >> log, - bitmap); + return 1; } + __set_bit(udp_sk(sk2)->udp_port_hash >> log, bitmap); } } return 0;
