Re: [PATCH v2] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Eric Dumazet]

On Thu, Sep 24, 2026 at 6:49 AM Yilin Zhang <yilinzhang@xxxxxxxxxxx> wrote:
>
> When tcp_send_synack() replaces the cloned SYN skb at the head of the
> retransmit queue with a copy, it frees the original with
> tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
> tp->retransmit_skb_hint keeps pointing at the freed
> skbuff_fclone_cache object.
>
> The dangling hint is read in tcp_verify_retransmit_hint() and used as
> the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
> unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
> an attacker-supplied ICMP fragmentation-needed message, after which a
> simultaneous open frees the armed SYN skb:
>
>   BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>   Read of size 4 at addr ffff88800604d928 by task swapper/1/0
>   Call Trace:
>    tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>    tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
>    tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
>
> Sync the hint to the copy.
>
> Fixes: c31b70c9968f ("tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit")
> Reported-by: Kimi Security Team <bug-report@xxxxxxxxxxx>
> Tested-by: Weiming Shi <shiweiming@xxxxxxxxxxx>
> Signed-off-by: Yilin Zhang <yilinzhang@xxxxxxxxxxx>
> ---
> Changes in v2:
> - Correct the Fixes: tag (Eric Dumazet).
> ---

Thanks for the fix.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>