[PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[Yilin Zhang]

subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
SYN under the fatal fallback and hands it back with drop_req=true to
tell the caller to drop both the request and the child. Of the three
syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
contract; tcp_fastopen_create_child() only checks child != NULL.

With an MPTCP listener and server-side Fast Open enabled, this can
become a use-after-free:

  1. fetch a TFO cookie,
  2. complete a normal MP_CAPABLE handshake to learn the server's key
     and compute the token offline,
  3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
  4. a subsequent accept() hands the freed socket to userspace, and
     any fd operation triggers slab-use-after-free, leading to a
     denial of service.

Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
 net/ipv4/tcp_fastopen.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 6a031a1a6c9f..7a0b58b39a2c 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
 	if (!child)
 		return NULL;
 
+	if (own_req && rsk_drop_req(req)) {
+		sock_put(child);
+		return NULL;
+	}
+
 	spin_lock(&queue->fastopenq.lock);
 	queue->fastopenq.qlen++;
 	spin_unlock(&queue->fastopenq.lock);
-- 
2.43.0

Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Missing `bh_unlock_sock(child)` before `sock_put(child)` causes a locked spinlock and preemption/softirq-disable leak.
- [High] Returning NULL from `tcp_fastopen_create_child()` fails to abort the request, causing a rejected MPTCP MP_JOIN request to incorrectly fall back to standard SYN processing, leading to a spurious SYN-ACK and resource waste.
--

commit c3cab231705bf3a0b9db9f8531e40d30d546e830
Author: Yilin Zhang <yilinzhang@moonshot.ai>

tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

This commit addresses a use-after-free vulnerability by checking
rsk_drop_req(req) in tcp_fastopen_create_child(). If an MPTCP MP_JOIN SYN
with a valid Fast Open cookie triggers the fatal fallback in
subflow_syn_recv_sock(), the request and child socket are now dropped.

> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> index 471c78be55137..b8b3abbee253d 100644
> --- a/net/ipv4/tcp_fastopen.c
> +++ b/net/ipv4/tcp_fastopen.c
> @@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
>  	if (!child)
>  		return NULL;
>  
> +	if (own_req && rsk_drop_req(req)) {
> +		sock_put(child);

[Severity: Critical]
Does this code leak the socket lock?

When a child socket is created and returned by syn_recv_sock(), it is
returned with the socket spinlock held. If we call sock_put(child) here
without first calling bh_unlock_sock(child), does this leave the spinlock
locked and softirqs disabled, leading to a soft lockup?

> +		return NULL;

[Severity: High]
Does returning NULL here cause the dropped request to be incorrectly retained?

When NULL is returned, tcp_fastopen_create_child() signals a normal Fast Open
failure rather than a hard drop. tcp_conn_request() will then assume Fast Open
failed, proceed to the standard SYN processing path, link the dropped request
into the SYN queue, and send a SYN-ACK:

net/ipv4/tcp_input.c:tcp_conn_request() {
    ...
	} else {
		tcp_rsk(req)->tfo_listener = false;
		if (!want_cookie &&
		    unlikely(!inet_csk_reqsk_queue_hash_add(sk, req))) {
			reqsk_free(req);
			dst_release(dst);
			return 0;
		}
		af_ops->send_synack(sk, dst, &fl, req, &foc,
				    !want_cookie ? TCP_SYNACK_NORMAL :
						   TCP_SYNACK_COOKIE,
				    skb);
    ...
}

Should this path return an error pointer or use a drop mechanism to ensure the
request is completely aborted, rather than triggering the fallback path?

> +	}
> +
>  	spin_lock(&queue->fastopenq.lock);
>  	queue->fastopenq.qlen++;
>  	spin_unlock(&queue->fastopenq.lock);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902121247.3248539-1-yilinzhang@moonshot.ai?part=1

Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[MPTCP CI]

Hi Yilin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: 
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33631744638

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/f9058346dca3
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1156129


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[Jiayuan Chen]

on 9/2/26 8:12 PM, Yilin Zhang wrote:
> subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
> SYN under the fatal fallback and hands it back with drop_req=true to
> tell the caller to drop both the request and the child. Of the three
> syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
> contract; tcp_fastopen_create_child() only checks child != NULL.
>
> With an MPTCP listener and server-side Fast Open enabled, this can
> become a use-after-free:
>
>    1. fetch a TFO cookie,
>    2. complete a normal MP_CAPABLE handshake to learn the server's key
>       and compute the token offline,
>    3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
>    4. a subsequent accept() hands the freed socket to userspace, and
>       any fd operation triggers slab-use-after-free, leading to a
>       denial of service.
>
> Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
> Reported-by: Kimi Security Team <bug-report@moonshot.ai>
> Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
> ---
>   net/ipv4/tcp_fastopen.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> index 6a031a1a6c9f..7a0b58b39a2c 100644
> --- a/net/ipv4/tcp_fastopen.c
> +++ b/net/ipv4/tcp_fastopen.c
> @@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
>   	if (!child)
>   		return NULL;
>   
> +	if (own_req && rsk_drop_req(req)) {
> +		sock_put(child);


The child is still locked by inet_csk_clone_lock.


We should do this instead:

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 471c78be5513..22494ff746c7 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -337,6 +337,12 @@ static struct sock 
*tcp_fastopen_create_child(struct sock *sk,
         if (!child)
                 return NULL;

+       if (own_req && rsk_drop_req(req)) {
+               bh_unlock_sock(child);
+               sock_put(child);
+               return NULL;
+       }
+
         spin_lock(&queue->fastopenq.lock);
         queue->fastopenq.qlen++;
         spin_unlock(&queue->fastopenq.lock);


> +		return NULL;


tcp_conn_request will still send a SYN-ACK, but the RST was already sent


It's not clean. Maybe we should do something like this instead (untested)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0f60a1dbf927..d371845d601a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7775,6 +7775,10 @@ int tcp_conn_request(struct request_sock_ops 
*rsk_ops,
                 READ_ONCE(sk->sk_data_ready)(sk);
                 bh_unlock_sock(fastopen_sk);
                 sock_put(fastopen_sk);
+       } else if (rsk_drop_req(req)) {
+               reqsk_free(req);
+               dst_release(dst);
+               return 0;
         } else {
                 tcp_rsk(req)->tfo_listener = false;
                 if (!want_cookie &&



BTW, since this is reported by LLM I think it is not difficult to have 
the LLM write a     reproducer and test this patch.

Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[Matthieu Baerts]

Hi Jiayuan, Yilin,

Thank you for the patch and the review!

On 02/09/2026 16:12, Jiayuan Chen wrote:
> 
> on 9/2/26 8:12 PM, Yilin Zhang wrote:
>> subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
>> SYN under the fatal fallback and hands it back with drop_req=true to
>> tell the caller to drop both the request and the child. Of the three
>> syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
>> contract; tcp_fastopen_create_child() only checks child != NULL.
>>
>> With an MPTCP listener and server-side Fast Open enabled, this can
>> become a use-after-free:
>>
>>    1. fetch a TFO cookie,
>>    2. complete a normal MP_CAPABLE handshake to learn the server's key
>>       and compute the token offline,
>>    3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
>>    4. a subsequent accept() hands the freed socket to userspace, and
>>       any fd operation triggers slab-use-after-free, leading to a
>>       denial of service.

(...)

> BTW, since this is reported by LLM I think it is not difficult to have
> the LLM write a     reproducer and test this patch.

That would be great to use the MPTCP packetdrill fork for that:

  https://github.com/multipath-tcp/packetdrill/

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

[Yilin Zhang]

Here is a packetdrill reproducer for the MPTCP subflow/TFO issue.

It first obtains a TFO cookie and the server key during an MP_CAPABLE
handshake, then sends an MP_JOIN SYN from a new source port with the
corresponding token and cookie. The final ACK is intentionally omitted.

With the fix, the request remains in the SYN queue: the MPTCP reset is
followed by a normal SYN/ACK that echoes the cookie, and the second
accept() returns EAGAIN. Without the fix, tcp_fastopen_create_child()
ignores drop_req=true after subflow_syn_recv_sock() destroys the cloned
child. The TFO path queues that child instead; the SYN/ACK omits the
cookie, and closing the listener reports a refcount/use-after-free
warning.

-- >8 -- gtests/net/mptcp/fastopen/server-tfo-mpjoin-syn_v4.pkt -- >8 --

// Regression test: an MP_JOIN SYN with a valid TFO cookie must not queue
// a destroyed child.
--tolerance_usecs=100000
`../common/defaults.sh`

// MPTCP listener with server-side Fast Open enabled.
+0.0  socket(..., SOCK_STREAM, IPPROTO_MPTCP) = 3
+0.0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0.0  setsockopt(3, SOL_TCP, TCP_FASTOPEN, [2], 4) = 0
+0.0  fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
+0.0  fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
+0.0  bind(3, ..., ...) = 0
+0.0  listen(3, 1) = 0

// Obtain a TFO cookie and learn the server key.
+0.1  <  S   0:0(0)         win 65535  <mss 1460, sackOK, TS val 100 ecr 0,   nop, wscale 8, FO,            nop, nop, mpcapable v1 flags[flag_h] nokey>
+0.0  >  S.  0:0(0)  ack 1             <mss 1460, nop, nop, sackOK,           nop, wscale 8, FO TFO_COOKIE, nop, nop, mpcapable v1 flags[flag_h] key[skey]>
+0.2  <  .   1:1(0)  ack 1     win 450  <                                                                              mpcapable v1 flags[flag_h] key[ckey=2, skey]>
+0.0  accept(3, ..., ...) = 4

// Use a new source port with the same address; the cookie remains valid.
+0.1  <  192.0.2.1:15000 > 192.168.0.1:8080  S  0:0(0)  win 65535  <mss 1460, sackOK, nop, wscale 8, FO TFO_COOKIE, nop, nop, mp_join_syn address_id=1 token=sha256_32(skey), nop, nop>
// The fatal MPTCP fallback destroys the cloned child and resets the flow.
+0.0  >  192.168.0.1:8080 > 192.0.2.1:15000  R.  0:0(0)  ack 1  <mp_reset 1>
// Normal SYN processing sends a SYN/ACK and echoes the TFO cookie.
+0.0  >  192.168.0.1:8080 > 192.0.2.1:15000  S.  0:0(0)  ack 1  <mss 1460, nop, nop, sackOK, nop, wscale 8, FO TFO_COOKIE, nop, nop, mp_join_syn_ack address_id=0 sender_hmac=auto>

// Without the final ACK, the request must remain in the SYN queue.
+0.2  accept(3, ..., ...) = -1 EAGAIN (Resource temporarily unavailable)

-- >8 --

For the MPTCP packetdrill fork, save this as
`gtests/net/mptcp/fastopen/server-tfo-mpjoin-syn_v4.pkt` and run it with
that fork's packetdrill binary.

Tested on Linux 7.3.0-rc1 (defconfig + MPTCP + KASAN, QEMU guest): the
unpatched kernel sends a SYN/ACK without the TFO cookie and reports
`refcount_t: underflow; use-after-free` when the listener closes; the
fixed kernel passes, with the second `accept()` returning EAGAIN.