Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path

[Eric Dumazet]

On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
>
> On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:
> > > Looking at this further, unhashing the listener and then calling
> > > synchronize_net() lets the disconnect path handle it. MPTCP needs a fix
> > > too, though, because it closes and reuses the first subflow directly
> > > without going through tcp_disconnect().
> >
> > This looks like a more palatable approach: this patch in the current
> > format looked way too invasive to me.
>
> I likely lack context on this, but I was wondering whether we should
> potentially disallow the transitions between listening and data sockets
> instead of fixing these endless bugs?

+2 I think I mentioned this at some point.

Same for IPV6_ADDRFORM : we should not allow transformed socket to
even use tcp_disconnect().