inet_csk_update_fastreuse() initializes the reuse caches only when tb->bhash2 is empty, but both inet_csk_get_port() and __inet_inherit_port() link tb2 before calling it, so the first-bind branch is never taken. As a result, SO_REUSEADDR binds never get fastreuse=1 and keep scanning existing owners, and SO_REUSEPORT starts in STRICT instead of ANY. Initialize the caches when tb2 is the only entry in tb->bhash2 and has no owners. Timewait sockets are also linked on tb2->owners, so this is equivalent to the old hlist_empty(&tb->owners) test. Found by manual code inspection and confirmed with GDB. Binding 16000 SO_REUSEADDR sockets to one address/port in a KVM guest takes 4.18 s before and 19.4 ms after this patch. Existing bind/reuse selftests pass. Analysis and testing were assisted by an AI tool (Codex). Fixes: 8002d44fe84d ("tcp: Check hlist_empty(&tb->bhash2) instead of hlist_empty(&tb->owners).") Reviewed-by: Eric Dumazet Signed-off-by: Zhewei Yuan --- v2: drop the KUnit patch and the cover letter, shorten the changelog, add Eric's Reviewed-by. Link to v1: https://lore.kernel.org/netdev/20261025090048.27870-2-yzwlhm@gmail.com/ net/ipv4/inet_connection_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 8151c638a24..93b306d91b6 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -446,7 +446,8 @@ void inet_csk_update_fastreuse(const struct sock *sk, { bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; - if (hlist_empty(&tb->bhash2)) { + if (hlist_is_singular_node(&tb2->bhash_node, &tb->bhash2) && + hlist_empty(&tb2->owners)) { tb->fastreuse = reuse; if (sk->sk_reuseport) { tb->fastreuseport = FASTREUSEPORT_ANY; base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5 -- 2.52.0