From: Xuanqiang Luo <redacted>

Since ehash lookups are lockless, if another CPU is converting sk to tw
concurrently, fetching the newly inserted tw with tw->tw_refcnt == 0 cause
lookup failure.

The call trace map is drawn as follows:
   CPU 0                                CPU 1
   -----                                -----
                                     inet_twsk_hashdance_schedule()
                                     spin_lock()
                                     inet_twsk_add_node_rcu(tw, ...)
__inet_lookup_established()
(find tw, failure due to tw_refcnt = 0)
                                     __sk_nulls_del_node_init_rcu(sk)
                                     refcount_set(&tw->tw_refcnt, 3)
                                     spin_unlock()

By replacing sk with tw atomically via hlist_nulls_replace_init_rcu() after
setting tw_refcnt, we ensure that tw is either fully initialized or not
visible to other CPUs, eliminating the race.

Fixes: 3ab5aee7fe84 ("net: Convert TCP & DCCP hash tables to use RCU / hlist_nulls")
Signed-off-by: Xuanqiang Luo <redacted>
---
 net/ipv4/inet_timewait_sock.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 5b5426b8ee92..4c84a020315d 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c

@@ -115,8 +115,9 @@ void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw,
        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
        spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
        struct inet_bind_hashbucket *bhead, *bhead2;
+       bool ret = false;

-       /* Step 1: Put TW into bind hash. Original socket stays there too.
+       /* Put TW into bind hash. Original socket stays there too.
           Note, that any socket with inet->num != 0 MUST be bound in
           binding cache, even if it is closed.
         */

@@ -140,14 +141,6 @@ void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw,

        spin_lock(lock);

-       /* Step 2: Hash TW into tcp ehash chain */
-       inet_twsk_add_node_rcu(tw, &ehead->chain);
-
-       /* Step 3: Remove SK from hash chain */
-       if (__sk_nulls_del_node_init_rcu(sk))
-               sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-
-
        /* Ensure above writes are committed into memory before updating the
         * refcount.
         * Provides ordering vs later refcount_inc().

@@ -162,6 +155,15 @@ void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw,
         */
        refcount_set(&tw->tw_refcnt, 3);

+       if (sk_hashed(sk)) {