Re: [PATCH net v3] tcp: reset late connection after listening socket close

On Tue, Aug 11, 2026 at 2:10 PM Asbjørn Sloth Tønnesen [off-list ref] wrote:

When __inet_inherit_port() returns -ENOENT, the new connection is
dropped silently.

In that case the client sees the connection as ESTABLISHED, however in
tcp_v{4,6}_syn_recv_sock() the call to __inet_inherit_port() returns
-ENOENT, and the new connection is dropped by put_and_exit.

A client may therefore hang indefinitely on a blocking read() if the
used data communication protocol is initiated by the server, like SMTP
and the reporter[1]'s MariaDB protocol both are.

Had the new connection been processed before the listening socket was
closed, it would either have been added to the accept queue, or
inet_csk_reqsk_queue_add() should have sent RST.

The call to __inet_inherit_port() returns -ENOENT because
inet_csk(sk)->icsk_bind_hash is NULL, after inet_put_port() has been
called by tcp_set_state(sk, TCP_CLOSE).

This patch adds -ENOENT handling to both __inet_inherit_port() call
sites, and ensures that RST is sent before the connection is dropped.

Reproducer:
  https://files.fiberby.net/ast/2026/kernel/socket_teardown_test.c

Reported-by: Kristian Nielsen <redacted>
Link: https://lore.kernel.org/87sf0ldk41.fsf@urd.knielsen-hq.org (local) # [1]
Fixes: c2f34a65a61c ("tcp/dccp: fix potential NULL deref in __inet_inherit_port()")
Cc: <redacted>
Signed-off-by: Asbjørn Sloth Tønnesen <redacted>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Thanks !