Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[Matthieu Baerts <matttbe@kernel.org>]

Hi Jiayuan, Yilin,

Thank you for the patch and the review!

On 02/09/2026 16:12, Jiayuan Chen wrote:
> 
> on 9/2/26 8:12 PM, Yilin Zhang wrote:
>> subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
>> SYN under the fatal fallback and hands it back with drop_req=true to
>> tell the caller to drop both the request and the child. Of the three
>> syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
>> contract; tcp_fastopen_create_child() only checks child != NULL.
>>
>> With an MPTCP listener and server-side Fast Open enabled, this can
>> become a use-after-free:
>>
>>    1. fetch a TFO cookie,
>>    2. complete a normal MP_CAPABLE handshake to learn the server's key
>>       and compute the token offline,
>>    3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
>>    4. a subsequent accept() hands the freed socket to userspace, and
>>       any fd operation triggers slab-use-after-free, leading to a
>>       denial of service.

(...)

> BTW, since this is reported by LLM I think it is not difficult to have
> the LLM write a     reproducer and test this patch.

That would be great to use the MPTCP packetdrill fork for that:

  https://github.com/multipath-tcp/packetdrill/

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.