Re: [PATCH net] tcp: initialize mapped children before route lookup

[Kuniyuki Iwashima <kuniyu@google.com>]

On Wed, 28 Oct 2026 16:41:01 +0100, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> IPv4 passive opens on a dual-stack listener go through
> tcp_v4_syn_recv_sock() with tcp_v6_mapped_child_init() as the optional
> initializer. The callback currently runs after the output route lookup.
> If that lookup fails, tcp_done() destroys a clone whose pinet6 and
> ipv6_fl_list still refer to the listener's state.
> 
> With the flowlabel list head in inet_sock, fl6_free_socklist() walks
> the clone's list and RCU-frees its nodes without unlinking them from the
> live listener. Subsequent flowlabel operations can use or free the nodes
> again. Commit 858d2a4f67ff ("tcp: fix potential race in
> tcp_v6_syn_recv_sock()") moved the initializer before ehash insertion,
> but did not cover this error path.
> 
> Invoke the existing initializer after the IPv4 fields it consumes have
> been set, but before route lookup can fail. It needs neither the
> destination nor sk_setup_caps(), and all later disposal paths remain
> covered.
> 
> Fixes: 1c17f4373d4d ("ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Thanks!