Re: [PATCH net v2 1/1] udp: diag: bound bucket lock hold time

On Mon, Sep 7, 2026 at 3:07 PM Eric Dumazet [off-list ref] wrote:

On Sun, Sep 6, 2026 at 12:35 PM Zihan Xi [off-list ref] wrote:

quoted

udp_diag_dump() currently keeps the UDP hash bucket spinlock held while
running the request's bytecode filter and filling a netlink response for
every socket in the bucket.  A large filter and a heavily populated bucket
can therefore keep bottom halves disabled for an attacker-scaled amount of
time.

Collect at most SKARR_SZ matching sockets under the bucket lock, taking a
reference for each socket, then run the filter and fill the response after
releasing the lock.  Resume with the existing (slot, s_num) dump state so
the next batch can skip already-walked sockets.  Leave bytecode filtering
until after unlock; unlike tcp_diag, a rejecting inet_diag bytecode program
is the expensive part of this walk.

Fixes: b6d640c2286d ("udp_diag: Implement the dump-all functionality")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: LLM
Signed-off-by: Zihan Xi <redacted>
---
changes in v2:
  - Drop the hash-list cursor, dump_done callback, extra module
    reference, and inet_diag core changes.  Dump state is only
    (slot, s_num), so the existing handler get/put around dump() is
    enough and udp_diag no longer manages its own module lifetime.
  - Batch at most SKARR_SZ matching sockets under the bucket lock
    like tcp_diag, and run bytecode filtering plus netlink fill after
    unlock.
  - v1 Link: https://lore.kernel.org/all/133b6aee9e2c908c9da37d5585b3d2cd016906cd.1788187473.git.zihanx@nebusec.ai (local)

pw-bot: rejected

Please limit the complexity of filters.

Anywone needing complex filters will implement them in user space.

Agreed.  v2 tried to make the dump walk tolerate large bytecode;
that was the wrong approach.

I will drop this patch and send a new series that rejects oversized
programs in inet_diag_bc_audit().  Richer matching can stay in
userspace.