Re: [PATCH net-next v8 1/2] tcp: rehash onto different local ECMP path on retransmit timeout

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] IPv6 flowlabel reflection (REPFLOW) is broken for SYN-ACKs when syncookies are triggered.
--

commit b64f3a9b6e1ac0e884a330cb07667e97df46001c
Author: Neil Spring <ntspring@meta.com>

tcp: rehash onto different local ECMP path on retransmit timeout

This commit updates the TCP transmit hashing logic to re-roll the txhash on
RTO, PLB, and spurious retransmission events. It additionally ensures the
cached destination route is invalidated and sets up the routing lookup to
use the new txhash for selecting a different local ECMP path.

> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c

[ ... ]

> @@ -7656,6 +7659,11 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
>  	/* Note: tcp_v6_init_req() might override ir_iif for link locals */
>  	inet_rsk(req)->ir_iif = inet_request_bound_dev_if(sk, skb);
>  
> +	if (want_cookie) {
> +		isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
> +		tcp_rsk(req)->txhash = isn;
> +	}
> +
>  	dst = af_ops->route_req(sk, skb, &fl, req, isn);

[Severity: High]
Could this change break IPv6 flowlabel reflection (REPFLOW) for SYN-ACKs when
syncookies are active?

By moving the cookie initialization before the route_req() call, isn is now
a non-zero cookie value rather than zero when a SYN flood is detected.

For IPv6, af_ops->route_req() maps to tcp_v6_route_req(), which passes this
isn value as the tw_isn parameter to tcp_v6_init_req().

Because tw_isn is now the generated syncookie (a non-zero value) rather than 0,
the if (!tw_isn && ...) check inside tcp_v6_init_req() evaluates to false.
This causes it to skip saving the SYN packet's ireq->pktopts.

Later, when tcp_v6_send_synack() attempts to send the SYN-ACK, it checks:

	if (inet6_test_bit(REPFLOW, sk) && ireq->pktopts)

Since ireq->pktopts was not saved and is NULL, the SYN-ACK fails to reflect
the IPv6 flowlabel during SYN floods.

>  	if (!dst)
>  		goto drop_and_free;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260522215733.929238-1-ntspring@meta.com?part=1