Re: [PATCH net v3] tcp: reset late connection after listening socket close

[Kuniyuki Iwashima]

On Tue, Aug 11, 2026 at 2:10 PM Asbjørn Sloth Tønnesen <ast@xxxxxxxxxxx> wrote:
>
> When __inet_inherit_port() returns -ENOENT, the new connection is
> dropped silently.
>
> In that case the client sees the connection as ESTABLISHED, however in
> tcp_v{4,6}_syn_recv_sock() the call to __inet_inherit_port() returns
> -ENOENT, and the new connection is dropped by put_and_exit.
>
> A client may therefore hang indefinitely on a blocking read() if the
> used data communication protocol is initiated by the server, like SMTP
> and the reporter[1]'s MariaDB protocol both are.
>
> Had the new connection been processed before the listening socket was
> closed, it would either have been added to the accept queue, or
> inet_csk_reqsk_queue_add() should have sent RST.
>
> The call to __inet_inherit_port() returns -ENOENT because
> inet_csk(sk)->icsk_bind_hash is NULL, after inet_put_port() has been
> called by tcp_set_state(sk, TCP_CLOSE).
>
> This patch adds -ENOENT handling to both __inet_inherit_port() call
> sites, and ensures that RST is sent before the connection is dropped.
>
> Reproducer:
>   https://files.fiberby.net/ast/2026/kernel/socket_teardown_test.c
>
> Reported-by: Kristian Nielsen <knielsen@xxxxxxxxxxxxxxx>
> Link: https://lore.kernel.org/87sf0ldk41.fsf@xxxxxxxxxxxxxxxxxxx # [1]
> Fixes: c2f34a65a61c ("tcp/dccp: fix potential NULL deref in __inet_inherit_port()")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Asbjørn Sloth Tønnesen <ast@xxxxxxxxxxx>

Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>

Thanks !