1 files changed, 14 insertions, 4 deletions

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index d19f32aca6ca..14409f111bc2 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -53,7 +53,7 @@ void inet_get_local_port_range(int *low, int *high)
 EXPORT_SYMBOL(inet_get_local_port_range);
 
 int inet_csk_bind_conflict(const struct sock *sk,
-                           const struct inet_bind_bucket *tb)
+                           const struct inet_bind_bucket *tb, bool relax)
 {
         struct sock *sk2;
         struct hlist_node *node;
@@ -79,6 +79,14 @@ int inet_csk_bind_conflict(const struct sock *sk,
                                     sk2_rcv_saddr == sk_rcv_saddr(sk))
                                         break;
                         }
+                        if (!relax && reuse && sk2->sk_reuse &&
+                            sk2->sk_state != TCP_LISTEN) {
+                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
+
+                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
+                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
+                                        break;
+                        }
                 }
         }
         return node != NULL;
@@ -122,12 +130,13 @@ again:
                                             (tb->num_owners < smallest_size || smallest_size == -1)) {
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
-                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 &&
+                                                    !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) {
                                                         snum = smallest_rover;
                                                         goto tb_found;
                                                 }
                                         }
-                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) {
                                                 snum = rover;
                                                 goto tb_found;
                                         }
@@ -178,12 +187,13 @@ tb_found:
                         goto success;
                 } else {
                         ret = 1;
-                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, true)) {
                                 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
                                     smallest_size != -1 && --attempts >= 0) {
                                         spin_unlock(&head->lock);
                                         goto again;
                                 }
+
                                 goto fail_unlock;
                         }
                 }