Re: [PATCH net] tcp: reject TIME_WAIT reopens when SYN queue is full

On Sun, Jul 12, 2026 at 3:26 PM Yizhou Zhao
[off-list ref] wrote:

A valid SYN that matches a TIME_WAIT socket is redirected to the
listener with a non-zero tcp_tw_isn.  tcp_conn_request() deliberately
exempts those requests from normal SYN queue throttling.  A peer can
therefore create victim-side TIME_WAIT entries with short connections,
replay valid reopen SYNs, and withhold the final ACK to allocate
request_sock objects outside the listener's normal SYN-flood controls.

Do not send syncookies for this path: tcp_timewait_state_process()
derives tcp_tw_isn from tw_snd_nxt so that a direct reopen uses an ISN
after the prior connection's sequence space.  A syncookie ISN is a
hash-derived value and has no such ordering guarantee.

Check the selected listener's SYN queue before descheduling the
TIME_WAIT socket.  If it is full, account a request-queue drop, retain
the TIME_WAIT socket, and discard the SYN.  Once the queue has room,
the existing direct-reopen path and its TIME_WAIT ISN are unchanged.
Normal SYNs continue to use syncookies when the listener is full.

I do not see it as a threat, sorry.

Say no to AI hallucinations.