inet_csk_find_open_port() rounds the range length down to an even number but keeps the original exclusive upper bound for wrapping. For an odd-sized range, the two scans can therefore miss a valid port and return EADDRINUSE while an eligible port remains free. For example, restrict a TCP socket to IP_LOCAL_PORT_RANGE [40000, 40002] and hold explicit binds on 40000 and 40001. bind(..., 0) always fails, although an explicit bind to 40002 succeeds. Both IPv4 and IPv6 TCP and MPTCP are affected. A namespace-wide odd-sized ip_local_port_range can also trigger the failure without a per-socket range setting. Keep the full length for the scan bound and wrapping. The two scans then cover every candidate in an odd-sized range, with at most one repeated candidate when exhausted. Even-sized candidate sequences remain unchanged. For odd-sized ranges, subtracting an odd remaining value when wrapping flips parity. The first scan can therefore also select offsets of the parity preferred by __inet_hash_connect(). Namespace-wide ranges with same-parity endpoints already trigger a sysctl warning, while connect() uses step 1 for a per-socket IP_LOCAL_PORT_RANGE. This only fixes bind() allocation. The rounding in __inet_hash_connect() for namespace-wide ranges is unchanged, so connect() can still miss a port in an odd-sized namespace range. The issue was triggered while developing port-range selftests with Codex assistance, then confirmed using userspace reproducers on unmodified kernels. No kernel instrumentation or fault injection was needed. Booted x86-64 KVM kernels were tested against the regression selftest, the full ip_local_port_range suite, and a Go net.Listen reproducer. The Go reproducer fails 100/100 times per IP version before the fix and 0/100 afterwards with a three-port namespace range and two listeners occupying its first two ports. Fixes: ea8add2b1903 ("tcp/dccp: better use of ephemeral ports in bind()") Signed-off-by: Florin Badita-Nistor --- net/ipv4/inet_connection_sock.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index e56beec43..755fcea35 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -343,8 +343,6 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret, low = half; } remaining = high - low; - if (likely(remaining > 1)) - remaining &= ~1U; offset = get_random_u32_below(remaining); /* __inet_hash_connect() favors ports having @low parity -- 2.51.0 Leave each port in three- and five-port socket-local ranges as the only available candidate and verify that bind(..., 0) can allocate it. Cover both lower-bound parities and repeat allocation to vary the random starting offset. Use the existing IPv4/IPv6 TCP, UDP, SCTP and MPTCP fixture variants. This catches the false EADDRINUSE caused by rounding an odd-sized range down during TCP port allocation. Without the preceding fix, the TCP and MPTCP variants fail on both IP versions when the last port in a three-port range is the only free one. With the fix, all eight variants pass. Allow the loopback bind helper to take a port so the test can hold explicit binds on every other candidate. Retain the existing helper for automatic binding and run under the existing isolated-network-namespace wrapper. The regression test was developed with Codex assistance and exercised on booted x86-64 KVM kernels before and after the fix. Signed-off-by: Florin Badita-Nistor --- .../selftests/net/ip_local_port_range.c | 67 ++++++++++++++++++- 1 file changed, 64 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/net/ip_local_port_range.c b/tools/testing/selftests/net/ip_local_port_range.c index 3d32b33cb..c17d95045 100644 --- a/tools/testing/selftests/net/ip_local_port_range.c +++ b/tools/testing/selftests/net/ip_local_port_range.c @@ -44,7 +44,7 @@ static int get_so_domain(int fd) return domain; } -static int bind_to_loopback_any_port(int fd) +static int bind_to_loopback_port(int fd, __u16 port) { union { struct sockaddr sa; @@ -57,13 +57,13 @@ static int bind_to_loopback_any_port(int fd) switch (get_so_domain(fd)) { case AF_INET: addr.v4.sin_family = AF_INET; - addr.v4.sin_port = htons(0); + addr.v4.sin_port = htons(port); addr.v4.sin_addr.s_addr = htonl(INADDR_LOOPBACK); addr_len = sizeof(addr.v4); break; case AF_INET6: addr.v6.sin6_family = AF_INET6; - addr.v6.sin6_port = htons(0); + addr.v6.sin6_port = htons(port); addr.v6.sin6_addr = in6addr_loopback; addr_len = sizeof(addr.v6); break; @@ -74,6 +74,11 @@ static int bind_to_loopback_any_port(int fd) return bind(fd, &addr.sa, addr_len); } +static int bind_to_loopback_any_port(int fd) +{ + return bind_to_loopback_port(fd, 0); +} + static int get_sock_port(int fd) { union { @@ -301,6 +306,62 @@ TEST_F(ip_local_port_range, single_port_range) } } +/* Leave each port in turn as the only available one. An odd-sized range + * must not report exhaustion while a port at either end is still free. + */ +TEST_F(ip_local_port_range, odd_port_range) +{ + const struct { + __u16 low; + __u16 high; + } ranges[] = { + { 40000, 40002 }, + { 40001, 40003 }, + { 40000, 40004 }, + { 40001, 40005 }, + }; + int i, j, port, free_port, fd, err; + __u32 range; + int fds[5]; + + for (i = 0; i < ARRAY_SIZE(ranges); i++) { + range = pack_port_range(ranges[i].low, ranges[i].high); + for (free_port = ranges[i].low; free_port <= ranges[i].high; free_port++) { + for (port = ranges[i].low; port <= ranges[i].high; port++) { + j = port - ranges[i].low; + fds[j] = -1; + if (port == free_port) + continue; + fd = socket(variant->so_domain, variant->so_type, + variant->so_protocol); + ASSERT_GE(fd, 0) TH_LOG("socket failed"); + fds[j] = fd; + err = bind_to_loopback_port(fd, port); + ASSERT_EQ(err, 0) TH_LOG("bind(%d) failed", port); + } + + /* Exercise different random starting offsets. */ + for (j = 0; j < 16; j++) { + fd = socket(variant->so_domain, variant->so_type, + variant->so_protocol); + ASSERT_GE(fd, 0) TH_LOG("socket failed"); + err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, + &range, sizeof(range)); + ASSERT_EQ(err, 0) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed"); + err = bind_to_loopback_any_port(fd); + ASSERT_EQ(err, 0) TH_LOG("range %d-%d, free port %d", + ranges[i].low, ranges[i].high, free_port); + ASSERT_EQ(get_sock_port(fd), free_port); + ASSERT_EQ(close(fd), 0); + } + + for (j = 0; j <= ranges[i].high - ranges[i].low; j++) + if (fds[j] >= 0) + ASSERT_EQ(close(fds[j]), 0); + } + } +} + #define REUSEADDR 0x1 #define REUSEPORT 0x2 -- 2.51.0