Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path
From: Hyunwoo Kim <hidden>
Date: 2026-09-03 19:31:51
Also in:
lkml, stable
On Thu, Sep 03, 2026 at 12:28:15PM -0700, Kuniyuki Iwashima wrote:
On Thu, Sep 3, 2026 at 12:17 PM Hyunwoo Kim [off-list ref] wrote:quoted
On Tue, Sep 01, 2026 at 05:57:04PM +0200, Eric Dumazet wrote:quoted
On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski [off-list ref] wrote:quoted
On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:quoted
quoted
Looking at this further, unhashing the listener and then calling synchronize_net() lets the disconnect path handle it. MPTCP needs a fix too, though, because it closes and reuses the first subflow directly without going through tcp_disconnect().This looks like a more palatable approach: this patch in the current format looked way too invasive to me.I likely lack context on this, but I was wondering whether we should potentially disallow the transitions between listening and data sockets instead of fixing these endless bugs?+2 I think I mentioned this at some point. Same for IPV6_ADDRFORM : we should not allow transformed socket to even use tcp_disconnect().So.. do you have a plan for this work?I'll post a patch to disallow the buggy transformation. https://lore.kernel.org/netdev/CAAVpQUAWjBuF1Rgze0Vt_XvkUT=Ajw-F+Kh+s2iHk38c8iAapg@mail.gmail.com/ (local)
Understood. I hope my Reported-by: will be included in that patch.