Re: [PATCH v1 net-next 1/2] tcp: Do not allow buggy transitions between ehash and lhash2.

On Thu, Sep 17, 2026 at 5:49 AM Daniel Zahka [off-list ref] wrote:

On Thu Sep 3, 2026 at 11:35 PM EDT, Kuniyuki Iwashima wrote:

quoted

The following state transitions have long been a playground for
syzbot, and recently AI joined in, reporting a lot more bugs.

  * listen() + shutdown() + connect()
  * connect() + connect(AF_UNSPEC) + listen()

Hi there. Thanks for closing these. I'm wondering if connect() ->
listen() via timewait is intentionally left open?

Ah, good catch.  I missed inet_twsk_hashdance_schedule()
unhashes wihtout calling inet_unhash().

I'll post this.

diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c

index d4c781a0667f..5772a64fcdbe 100644

--- a/net/ipv4/inet_timewait_sock.c

+++ b/net/ipv4/inet_timewait_sock.c

@@ -110,6 +110,8 @@ void inet_twsk_hashdance_schedule(struct

inet_timewait_sock *tw,

  spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash);

  struct inet_bind_hashbucket *bhead, *bhead2;



+ inet_csk(sk)->unhashed_state = sk->sk_state;

+

  /* Put TW into bind hash. Original socket stays there too.

  * Note, that any socket with inet->num != 0 MUST be bound in

  * binding cache, even if it is closed.


Thanks !