Re: [PATCH net v2 0/8] net: fixes for requests completing on a socket that no longer listens

[Jakub Kicinski]

On Mon, 24 Aug 2026 12:32:44 +0900 Hyunwoo Kim wrote:
> connect(AF_UNSPEC) and listen() move a socket back and forth between
> listener and active session. IPV6_ADDRFORM on top of that turns an
> AF_INET6 socket into an AF_INET one.
> 
> Two things follow. One is that what the socket had before the change is
> left behind: requests still in the ehash, and parent fields a child
> inherits. The other is that the socket is used while it is changing.
> tcp_check_req() does not hold the listener lock, and tcp_v{4,6}_rcv()
> reads sk_state twice without it on the listener path.
> 
> Patch 2 is neither. After a reuseport migration the listener that counted
> a request and the listener the count is decremented on are not the same.
> It goes with patch 3 because patch 3 needs it. Nothing ever resets that
> count, so patch 3 on its own has a check that can be bypassed.

No reviews? Are people getting tired of the disconnect bugs?

Hyunwoo Kim, can any of the fixes be simplified if we move more
cleanup / responsibility to the disconnect path? Patch 6 perhaps?