Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path

On Tue, Sep 01, 2026 at 05:57:04PM +0200, Eric Dumazet wrote:

On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski [off-list ref] wrote:

quoted

On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:

quoted

quoted

Looking at this further, unhashing the listener and then calling
synchronize_net() lets the disconnect path handle it. MPTCP needs a fix
too, though, because it closes and reuses the first subflow directly
without going through tcp_disconnect().

This looks like a more palatable approach: this patch in the current
format looked way too invasive to me.

I likely lack context on this, but I was wondering whether we should
potentially disallow the transitions between listening and data sockets
instead of fixing these endless bugs?

+2 I think I mentioned this at some point.

Same for IPV6_ADDRFORM : we should not allow transformed socket to
even use tcp_disconnect().

So.. do you have a plan for this work?

Or should I send the v3 series first? I am still looking into related
problems, and it looks like this series covers most of the "important"
ones that have to be handled right away. What is left seems to be the
UDP side and other minor problems.


Best regards,
Hyuwnoo Kim