Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path

[Hyunwoo Kim]

On Thu, Sep 03, 2026 at 12:28:15PM -0700, Kuniyuki Iwashima wrote:
> On Thu, Sep 3, 2026 at 12:17 PM Hyunwoo Kim <imv4bel@xxxxxxxxx> wrote:
> >
> > On Tue, Sep 01, 2026 at 05:57:04PM +0200, Eric Dumazet wrote:
> > > On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
> > > >
> > > > On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:
> > > > > > Looking at this further, unhashing the listener and then calling
> > > > > > synchronize_net() lets the disconnect path handle it. MPTCP needs a fix
> > > > > > too, though, because it closes and reuses the first subflow directly
> > > > > > without going through tcp_disconnect().
> > > > >
> > > > > This looks like a more palatable approach: this patch in the current
> > > > > format looked way too invasive to me.
> > > >
> > > > I likely lack context on this, but I was wondering whether we should
> > > > potentially disallow the transitions between listening and data sockets
> > > > instead of fixing these endless bugs?
> > >
> > > +2 I think I mentioned this at some point.
> > >
> > > Same for IPV6_ADDRFORM : we should not allow transformed socket to
> > > even use tcp_disconnect().
> >
> > So.. do you have a plan for this work?
> 
> I'll post a patch to disallow the buggy transformation.
> https://lore.kernel.org/netdev/CAAVpQUAWjBuF1Rgze0Vt_XvkUT=Ajw-F+Kh+s2iHk38c8iAapg@xxxxxxxxxxxxxx/

Understood. I hope my Reported-by: will be included in that patch.