[PATCH net] tcp: reject TIME_WAIT reopens when SYN queue is full

A valid SYN that matches a TIME_WAIT socket is redirected to the
listener with a non-zero tcp_tw_isn.  tcp_conn_request() deliberately
exempts those requests from normal SYN queue throttling.  A peer can
therefore create victim-side TIME_WAIT entries with short connections,
replay valid reopen SYNs, and withhold the final ACK to allocate
request_sock objects outside the listener's normal SYN-flood controls.

Do not send syncookies for this path: tcp_timewait_state_process()
derives tcp_tw_isn from tw_snd_nxt so that a direct reopen uses an ISN
after the prior connection's sequence space.  A syncookie ISN is a
hash-derived value and has no such ordering guarantee.

Check the selected listener's SYN queue before descheduling the
TIME_WAIT socket.  If it is full, account a request-queue drop, retain
the TIME_WAIT socket, and discard the SYN.  Once the queue has room,
the existing direct-reopen path and its TIME_WAIT ISN are unchanged.
Normal SYNs continue to use syncookies when the listener is full.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <redacted>
Reported-by: Yuxiang Yang <redacted>
Reported-by: Ao Wang <redacted>
Reported-by: Xuewei Feng <redacted>
Reported-by: Qi Li <redacted>
Reported-by: Ke Xu <redacted>
Assisted-by: Claude-Code:GLM-5.2-special
Signed-off-by: Yizhou Zhao <redacted>
---
 net/ipv4/tcp_ipv4.c | 8 ++++++++
 net/ipv6/tcp_ipv6.c | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 209ef7522508fcc3974ae71d35dd66cba96b73d0..ddb5daede802d355b51b802b29b2e1ead3597bd2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c

@@ -2310,6 +2310,14 @@ int tcp_v4_rcv(struct sk_buff *skb)
 							inet_iif(skb),
 							sdif);
 		if (sk2) {
+			if (inet_csk_reqsk_queue_is_full(sk2)) {
+				drop_reason = SKB_DROP_REASON_TCP_LISTEN_OVERFLOW;
+				__NET_INC_STATS(net, LINUX_MIB_TCPREQQFULLDROP);
+				tcp_listendrop(sk2);
+				inet_twsk_put(inet_twsk(sk));
+				goto discard_it;
+			}
+
 			inet_twsk_deschedule_put(inet_twsk(sk));
 			sk = sk2;
 			tcp_v4_restore_cb(skb);

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ebe161d72fbd07a13d92812b45b5a3ce2464a015..8d3ff7184d03f5dd81f9a9c20e3ebbf174efc43a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c

@@ -1969,6 +1969,15 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
 					    sdif);
 		if (sk2) {
 			struct inet_timewait_sock *tw = inet_twsk(sk);
+
+			if (inet_csk_reqsk_queue_is_full(sk2)) {
+				drop_reason = SKB_DROP_REASON_TCP_LISTEN_OVERFLOW;
+				__NET_INC_STATS(net, LINUX_MIB_TCPREQQFULLDROP);
+				tcp_listendrop(sk2);
+				inet_twsk_put(tw);
+				goto discard_it;
+			}
+
 			inet_twsk_deschedule_put(tw);
 			sk = sk2;
 			tcp_v6_restore_cb(skb);

--

2.47.3