Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path

[Hyunwoo Kim]

On Tue, Sep 01, 2026 at 05:57:04PM +0200, Eric Dumazet wrote:
> On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
> >
> > On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:
> > > > Looking at this further, unhashing the listener and then calling
> > > > synchronize_net() lets the disconnect path handle it. MPTCP needs a fix
> > > > too, though, because it closes and reuses the first subflow directly
> > > > without going through tcp_disconnect().
> > >
> > > This looks like a more palatable approach: this patch in the current
> > > format looked way too invasive to me.
> >
> > I likely lack context on this, but I was wondering whether we should
> > potentially disallow the transitions between listening and data sockets
> > instead of fixing these endless bugs?
> 
> +2 I think I mentioned this at some point.
> 
> Same for IPV6_ADDRFORM : we should not allow transformed socket to
> even use tcp_disconnect().

So.. do you have a plan for this work?

Or should I send the v3 series first? I am still looking into related
problems, and it looks like this series covers most of the "important"
ones that have to be handled right away. What is left seems to be the
UDP side and other minor problems.


Best regards,
Hyuwnoo Kim