Re: [PATCH net] tcp: restore IPv6 af_ops on disconnect of a v4-mapped socket

[Kuniyuki Iwashima]

On Thu, 29 Oct 2026 23:23:14 -0400, Zhiyu Zhang wrote:
> From: Eric Dumazet <edumazet@xxxxxxxxxx>
> 
> A successful connect() of an IPv6 socket to a v4-mapped address switches
> icsk_af_ops, sk_backlog_rcv and af_specific to their IPv4-mapped variants.
> These are only restored if the connect() fails.
> 
> After connect(AF_UNSPEC), the socket can be reused for listen() or for a
> native IPv6 connect while still using the mapped handlers. IPv6 packets
> processed from the socket backlog are then handled by tcp_v4_do_rcv().
> tcp_v4_send_reset() and tcp_v4_send_ack() interpret
> TCP_SKB_CB(skb)->header.h6 as IPv4 options, and __ip_options_echo() can
> overflow its 40-byte destination buffer.
> 
> Commit 8cc3aef0cb19 ("tcp: Do not allow buggy transitions between ehash
> and lhash2.") prevents listen() after connect(AF_UNSPEC), but a native IPv6
> connect is still allowed.
> 
> Add tcp_v6_disconnect() to restore the IPv6 handlers when a v4-mapped
> socket is disconnected, and use the same helper in the connect error path.
> 
> MPTCP subflows override sk_prot, and two teardown paths call
> tcp_disconnect() directly. Route those calls through the protocol-specific
> disconnect operation so IPv6 MPTCP subflows receive the same restoration.
> 
> Tested with TCP and MPTCP by reconnecting an AF_INET6 socket from a
> v4-mapped peer to a native IPv6 peer after connect(AF_UNSPEC).
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Tong Liu <lyutoon@xxxxxxxxx>
> Reported-by: Qi Tang <tpluszz77@xxxxxxxxx>
> Reported-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>

This is not needed when you add Co-developed-by.

> Closes: https://lore.kernel.org/netdev/CALf2hKvp0NPVLwr=a3+jUHtPohxbra8gox+aYAfWathJnn-J+Q@xxxxxxxxxxxxxx/
> Link: https://lore.kernel.org/netdev/CAL4WiiqFJpmcV4=TWRpukCq6q=-729658FwGvieNcPXe97kLvQ@xxxxxxxxxxxxxx/
> Link: https://lore.kernel.org/lkml/20261029054136.1174216-1-zhiyuzhang999@xxxxxxxxx/

This link is not directly related, remove it.


> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Co-developed-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>
> Signed-off-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>

Otherwise looks good.

Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>