Patch "inet: fix fast path in __inet_hash_connect()" has been added to the 4.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    inet: fix fast path in __inet_hash_connect()

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     inet-fix-fast-path-in-__inet_hash_connect.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bcfdfc986a9ba69eb7a4e1508a28115d397eab9a
Author: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
Date:   Sat Jan 14 13:11:41 2023 +0000

    inet: fix fast path in __inet_hash_connect()
    
    [ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ]
    
    __inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is
    equal to the sk parameter.
    sk_head() returns the hlist_entry() with respect to the sk_node field.
    However entries in the tb->owners list are inserted with respect to the
    sk_bind_node field with sk_add_bind_node().
    Thus the check would never pass and the fast path never execute.
    
    This fast path has never been executed or tested as this bug seems
    to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus
    remove it to reduce code complexity.
    
    Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd212b93@xxxxxxxxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 590801a7487f7..c5092e2b5933e 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -616,17 +616,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	u32 index;
 
 	if (port) {
-		head = &hinfo->bhash[inet_bhashfn(net, port,
-						  hinfo->bhash_size)];
-		tb = inet_csk(sk)->icsk_bind_hash;
-		spin_lock_bh(&head->lock);
-		if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-			inet_ehash_nolisten(sk, NULL, NULL);
-			spin_unlock_bh(&head->lock);
-			return 0;
-		}
-		spin_unlock(&head->lock);
-		/* No definite answer... Walk to established hash table */
+		local_bh_disable();
 		ret = check_established(death_row, sk, port, NULL);
 		local_bh_enable();
 		return ret;