Re: [PATCH net v2 0/8] net: fixes for requests completing on a socket that no longer listens

[Hyunwoo Kim]

On Mon, Aug 31, 2026 at 04:35:56PM -0700, Jakub Kicinski wrote:
> On Mon, 24 Aug 2026 12:32:44 +0900 Hyunwoo Kim wrote:
> > connect(AF_UNSPEC) and listen() move a socket back and forth between
> > listener and active session. IPV6_ADDRFORM on top of that turns an
> > AF_INET6 socket into an AF_INET one.
> > 
> > Two things follow. One is that what the socket had before the change is
> > left behind: requests still in the ehash, and parent fields a child
> > inherits. The other is that the socket is used while it is changing.
> > tcp_check_req() does not hold the listener lock, and tcp_v{4,6}_rcv()
> > reads sk_state twice without it on the listener path.
> > 
> > Patch 2 is neither. After a reuseport migration the listener that counted
> > a request and the listener the count is decremented on are not the same.
> > It goes with patch 3 because patch 3 needs it. Nothing ever resets that
> > count, so patch 3 on its own has a check that can be bypassed.
> 
> No reviews? Are people getting tired of the disconnect bugs?
> 
> Hyunwoo Kim, can any of the fixes be simplified if we move more
> cleanup / responsibility to the disconnect path? Patch 6 perhaps?

Fixing it like this [1] lets the disconnect path handle it, and also
closes the trigger path for patches 4, 5 and 8.

What do you think?

[1]: https://lore.kernel.org/all/apaAskNL-IvdcR7h@v4bel/


Best regards,
Hyuwnoo Kim