Re: [syzbot] [net?] WARNING in inet_csk_get_port (2)

[Kuniyuki Iwashima]

From: David Wei <dw@xxxxxxxxxxx>
Date: Wed, 8 Nov 2023 08:11:56 -0800
> On 2023-09-20 11:59, Kuniyuki Iwashima wrote:
> > From: syzbot <syzbot+71e724675ba3958edb31@xxxxxxxxxxxxxxxxxxxxxxxxx>
> > Date: Wed, 20 Sep 2023 11:02:55 -0700
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit:    2cf0f7156238 Merge tag 'nfs-for-6.6-2' of git://git.linux-..
> >> git tree:       upstream
> >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=17405ab0680000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=d594086f139d167
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=71e724675ba3958edb31
> >> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16b2e118680000
> >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=127b55c4680000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/456b02029fa8/disk-2cf0f715.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/9f9ff0c00454/vmlinux-2cf0f715.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/0ede19fba30f/bzImage-2cf0f715.xz
> >>
> >> The issue was bisected to:
> >>
> >> commit c48ef9c4aed3632566b57ba66cec6ec78624d4cb
> >> Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> >> Date:   Mon Sep 11 18:36:57 2023 +0000
> >>
> >>     tcp: Fix bind() regression for v4-mapped-v6 non-wildcard address.
> >>
> > 
> > We need this condition to put v4 sk and v4-mapped-v6 sk into
> > the same bucket.
> > 
> > ---8<---
> > diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
> > index dfb1c61c0c2b..6487357d1ddd 100644
> > --- a/net/ipv4/inet_hashtables.c
> > +++ b/net/ipv4/inet_hashtables.c
> > @@ -822,7 +823,8 @@ static bool inet_bind2_bucket_match(const struct inet_bind2_bucket *tb,
> >  			return ipv6_addr_v4mapped(&tb->v6_rcv_saddr) &&
> >  				tb->v6_rcv_saddr.s6_addr32[3] == sk->sk_rcv_saddr;
> >  
> > -		return false;
> > +		return ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr) &&
> > +			sk->sk_v6_rcv_saddr.s6_addr32[3] == tb->rcv_saddr;
> >  	}
> >  
> >  	if (sk->sk_family == AF_INET6)
> > ---8<---
> > 
> > Scenario is like
> > 
> >   1) bind(v4) creates a tb2 bucket
> >   2) bind(v4-mapped-v6) creates another tb2 bucket
> >   3) listen(v4) finds the second tb2 and trigger warning
> > 
> > ---8<---
> > from socket import *
> > 
> > s = socket()
> > s.setsockopt(SOL_SOCKET, SO_REUSEPORT, 1)
> > s.bind(('255.255.255.255', 0))
> > 
> > s2 = socket(AF_INET6, SOCK_STREAM)
> > s2.setsockopt(SOL_SOCKET, SO_REUSEPORT, 1)
> > s2.bind(('::ffff:255.255.255.255', s.getsockname()[1]))
> > s.listen()
> > ---8<---
> > 
> > Will post a formal patch after doing more tests with SO_REUSEPORT.
> > 
> > Thanks!
> 
> Hi Kuniyuki, did you get around to fixing and posting this patch? I
> couldn't find anything on the mailing list.
> 
> Would you like help fixing this?

Hi,

It's fixed by this patch.
https://lore.kernel.org/netdev/20231010013814.70571-1-kuniyu@xxxxxxxxxx/

Thanks