Re: [PATCH net v2 0/8] net: fixes for requests completing on a socket that no longer listens
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-08-31 23:35:58
Also in:
lkml
On Mon, 24 Aug 2026 12:32:44 +0900 Hyunwoo Kim wrote:
connect(AF_UNSPEC) and listen() move a socket back and forth between
listener and active session. IPV6_ADDRFORM on top of that turns an
AF_INET6 socket into an AF_INET one.
Two things follow. One is that what the socket had before the change is
left behind: requests still in the ehash, and parent fields a child
inherits. The other is that the socket is used while it is changing.
tcp_check_req() does not hold the listener lock, and tcp_v{4,6}_rcv()
reads sk_state twice without it on the listener path.
Patch 2 is neither. After a reuseport migration the listener that counted
a request and the listener the count is decremented on are not the same.
It goes with patch 3 because patch 3 needs it. Nothing ever resets that
count, so patch 3 on its own has a check that can be bypassed.No reviews? Are people getting tired of the disconnect bugs? Hyunwoo Kim, can any of the fixes be simplified if we move more cleanup / responsibility to the disconnect path? Patch 6 perhaps?