Re: [PATCH net v2 6/8] tcp: fix use-after-free in the lockless listener path

[Kuniyuki Iwashima]

On Thu, Sep 3, 2026 at 12:17 PM Hyunwoo Kim <imv4bel@xxxxxxxxx> wrote:
>
> On Tue, Sep 01, 2026 at 05:57:04PM +0200, Eric Dumazet wrote:
> > On Tue, Sep 1, 2026 at 5:51 PM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
> > >
> > > On Tue, 1 Sep 2026 10:03:51 +0200 Paolo Abeni wrote:
> > > > > Looking at this further, unhashing the listener and then calling
> > > > > synchronize_net() lets the disconnect path handle it. MPTCP needs a fix
> > > > > too, though, because it closes and reuses the first subflow directly
> > > > > without going through tcp_disconnect().
> > > >
> > > > This looks like a more palatable approach: this patch in the current
> > > > format looked way too invasive to me.
> > >
> > > I likely lack context on this, but I was wondering whether we should
> > > potentially disallow the transitions between listening and data sockets
> > > instead of fixing these endless bugs?
> >
> > +2 I think I mentioned this at some point.
> >
> > Same for IPV6_ADDRFORM : we should not allow transformed socket to
> > even use tcp_disconnect().
>
> So.. do you have a plan for this work?

I'll post a patch to disallow the buggy transformation.
https://lore.kernel.org/netdev/CAAVpQUAWjBuF1Rgze0Vt_XvkUT=Ajw-F+Kh+s2iHk38c8iAapg@xxxxxxxxxxxxxx/

>
> Or should I send the v3 series first? I am still looking into related
> problems, and it looks like this series covers most of the "important"
> ones that have to be handled right away. What is left seems to be the
> UDP side and other minor problems.
>
>
> Best regards,
> Hyuwnoo Kim