On 12/16/2018 03:42 PM, Peter Oskolkov wrote:
> Commit d9fbc7f6431f "net: tcp: prefer listeners bound to an address"
> removes port-only listener lookups. This caused segfaults in DCCP
> lookups because DCCP did not initialize the (addr,port) hashtable.
>
> This patch adds said initialization.
>
> The only non-trivial issue here is the size of the new hashtable.
> It seemed reasonable to make it match the size of the port-only
> hashtable (= INET_LHTABLE_SIZE) that was used previously. Other
> parameters to inet_hashinfo2_init() match those used in TCP.
>
> V2 changes: marked inet_hashinfo2_init as an exported symbol
> so that DCCP compiles when configured as a module.
>
> Tested: syzcaller issues fixed; the second patch in the patchset
> tests that DCCP lookups work correctly.
>
> Fixes: d9fbc7f6431f "net: tcp: prefer listeners bound to an address"
Strange, I would say bug was brought by commit 61b7c691c731
("inet: Add a 2nd listener hashtable (port+addr)")
The secondary hash table would have been used anyway if some application
(syzkaller-like)
had been using DCCP a bit more, to the point the second hash table would have
been used.
With more than 10 listeners on one bucket, code in inet6_lookup_listener() would
have attempted to deref a NULL pointer.
