[PATCH v2 net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF

[PATCH v2 net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF

[Eric Dumazet]

After listen() + shutdown(), a TCP socket is moved to the closed
section of its reuseport group, while TCP_NEW_SYN_RECV requests
can still reference it as rsk_listener.

If SO_ATTACH_REUSEPORT_[CE]BPF is then used on this socket,
reuseport_attach_prog() calls reuseport_alloc(), which resurrects
it into the listening section of a new group, even though the
socket is still in TCP_CLOSE.

After close(), the socket stays in that group and the pending
requests keep it allocated. When the final ACK arrives,
reuseport_migrate_sock() can select this dead socket and
inet_csk_clone_lock() clones it. With a ULP like espintcp installed
while in TCP_CLOSE, the child inherits icsk_ulp_data and sk_destruct
after tcp_cleanup_ulp() cleared icsk_ulp_ops, leading to a
use-after-free in espintcp_destruct().

As done in commit 8cc3aef0cb19 ("tcp: Do not allow buggy transitions
between ehash and lhash2."), deny this transition instead of adding
checks to the fast path.

Only an unhashed former listener is affected. Applications can still
attach a reuseport prog to a socket that never listened, or to a
listener (including one that called listen() again after shutdown()).

Fixes: 333bb73f620e ("tcp: Keep TCP_CLOSE sockets in the reuseport group.")
Reported-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
---
v2: use sk_is_tcp() instead of checking sk_protocol, as raw sockets
    can have sk_protocol == IPPROTO_TCP (Jiayuan Chen, Sashiko)
    Add discovery, validation and testing info to the changelog (netdev-bot)
v1: https://lore.kernel.org/netdev/20261105164830.1682714-1-edumazet@kernel.org/

This was reported by OpenAI Security Research. The report does not
state the discovery method, it was likely found by an AI-assisted scan.

Validated with the reporter's PoC on a KASAN kernel: run as an
unprivileged user in its own user and network namespaces, it triggers
a slab-use-after-free in espintcp_destruct(). No kernel modification
or error injection is needed. With this patch, SO_ATTACH_REUSEPORT_CBPF
fails with -EINVAL and no splat is seen.

The following selftests pass: net/reuseport_bpf, reuseport_bpf_cpu,
reuseport_bpf_numa, reuseport_dualstack, reuseport_addr_any.sh,
stress_reuseport_listen.sh, and bpf test_progs migrate_reuseport and
select_reuseport.

 net/core/sock_reuseport.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
index fccbdd0430b05984e82c19b17b6b723b0a3a03a1..b9e5648fa4c515a578fffd375c5214b3d5de6645 100644
--- a/net/core/sock_reuseport.c
+++ b/net/core/sock_reuseport.c
@@ -6,6 +6,7 @@
  * selecting the socket index from the array of available sockets.
  */
 
+#include <net/inet_connection_sock.h>
 #include <net/ip.h>
 #include <net/sock_reuseport.h>
 #include <linux/bpf.h>
@@ -692,6 +693,14 @@ int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog)
 		if (!sk->sk_reuseport)
 			return -EINVAL;
 
+		/* Do not put a shutdown()ed TCP listener back into the
+		 * listening section of a reuseport group while it is in
+		 * TCP_CLOSE: requests can still migrate to it.
+		 */
+		if (sk_is_tcp(sk) &&
+		    inet_csk(sk)->unhashed_state == TCP_LISTEN)
+			return -EINVAL;
+
 		err = reuseport_alloc(sk, false);
 		if (err)
 			return err;
-- 
2.53.0

Re: [PATCH v2 net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF

[Jiayuan Chen]

On 11/6/26 4:42 PM, Eric Dumazet wrote:
> After listen() + shutdown(), a TCP socket is moved to the closed
> section of its reuseport group, while TCP_NEW_SYN_RECV requests
> can still reference it as rsk_listener.
>
> If SO_ATTACH_REUSEPORT_[CE]BPF is then used on this socket,
> reuseport_attach_prog() calls reuseport_alloc(), which resurrects
> it into the listening section of a new group, even though the
> socket is still in TCP_CLOSE.
>
> After close(), the socket stays in that group and the pending
> requests keep it allocated. When the final ACK arrives,
> reuseport_migrate_sock() can select this dead socket and
> inet_csk_clone_lock() clones it. With a ULP like espintcp installed
> while in TCP_CLOSE, the child inherits icsk_ulp_data and sk_destruct
> after tcp_cleanup_ulp() cleared icsk_ulp_ops, leading to a
> use-after-free in espintcp_destruct().
>
> As done in commit 8cc3aef0cb19 ("tcp: Do not allow buggy transitions
> between ehash and lhash2."), deny this transition instead of adding
> checks to the fast path.
>
> Only an unhashed former listener is affected. Applications can still
> attach a reuseport prog to a socket that never listened, or to a
> listener (including one that called listen() again after shutdown()).
>
> Fixes: 333bb73f620e ("tcp: Keep TCP_CLOSE sockets in the reuseport group.")
> Reported-by: Kyle Zeng <kylebot@openai.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> v2: use sk_is_tcp() instead of checking sk_protocol, as raw sockets
>     can have sk_protocol == IPPROTO_TCP (Jiayuan Chen, Sashiko)
>     Add discovery, validation and testing info to the changelog (netdev-bot)
> v1: https://lore.kernel.org/netdev/20261105164830.1682714-1-edumazet@kernel.org/
>
> This was reported by OpenAI Security Research. The report does not
> state the discovery method, it was likely found by an AI-assisted scan.
>
> Validated with the reporter's PoC on a KASAN kernel: run as an
> unprivileged user in its own user and network namespaces, it triggers
> a slab-use-after-free in espintcp_destruct(). No kernel modification
> or error injection is needed. With this patch, SO_ATTACH_REUSEPORT_CBPF
> fails with -EINVAL and no splat is seen.
>
> The following selftests pass: net/reuseport_bpf, reuseport_bpf_cpu,
> reuseport_bpf_numa, reuseport_dualstack, reuseport_addr_any.sh,
> stress_reuseport_listen.sh, and bpf test_progs migrate_reuseport and
> select_reuseport.
>
>  net/core/sock_reuseport.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
> index fccbdd0430b05984e82c19b17b6b723b0a3a03a1..b9e5648fa4c515a578fffd375c5214b3d5de6645 100644
> --- a/net/core/sock_reuseport.c
> +++ b/net/core/sock_reuseport.c
> @@ -6,6 +6,7 @@
>   * selecting the socket index from the array of available sockets.
>   */
>  
> +#include <net/inet_connection_sock.h>
>  #include <net/ip.h>
>  #include <net/sock_reuseport.h>
>  #include <linux/bpf.h>
> @@ -692,6 +693,14 @@ int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog)
>  		if (!sk->sk_reuseport)
>  			return -EINVAL;
>  
> +		/* Do not put a shutdown()ed TCP listener back into the
> +		 * listening section of a reuseport group while it is in
> +		 * TCP_CLOSE: requests can still migrate to it.
> +		 */
> +		if (sk_is_tcp(sk) &&
> +		    inet_csk(sk)->unhashed_state == TCP_LISTEN)
> +			return -EINVAL;
> +
>  		err = reuseport_alloc(sk, false);
>  		if (err)
>  			return err;

Re: [PATCH v2 net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF

[Kuniyuki Iwashima]

On Fri, 06 Nov 2026 09:42:59 +0100, Eric Dumazet wrote:
> After listen() + shutdown(), a TCP socket is moved to the closed
> section of its reuseport group, while TCP_NEW_SYN_RECV requests
> can still reference it as rsk_listener.
> 
> If SO_ATTACH_REUSEPORT_[CE]BPF is then used on this socket,
> reuseport_attach_prog() calls reuseport_alloc(), which resurrects
> it into the listening section of a new group, even though the
> socket is still in TCP_CLOSE.
> 
> After close(), the socket stays in that group and the pending
> requests keep it allocated. When the final ACK arrives,
> reuseport_migrate_sock() can select this dead socket and
> inet_csk_clone_lock() clones it. With a ULP like espintcp installed
> while in TCP_CLOSE, the child inherits icsk_ulp_data and sk_destruct
> after tcp_cleanup_ulp() cleared icsk_ulp_ops, leading to a
> use-after-free in espintcp_destruct().
> 
> As done in commit 8cc3aef0cb19 ("tcp: Do not allow buggy transitions
> between ehash and lhash2."), deny this transition instead of adding
> checks to the fast path.
> 
> Only an unhashed former listener is affected. Applications can still
> attach a reuseport prog to a socket that never listened, or to a
> listener (including one that called listen() again after shutdown()).
> 
> Fixes: 333bb73f620e ("tcp: Keep TCP_CLOSE sockets in the reuseport group.")
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Thanks !

Re: [PATCH v2 net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  6 Nov 2026 09:42:59 +0100 you wrote:
> After listen() + shutdown(), a TCP socket is moved to the closed
> section of its reuseport group, while TCP_NEW_SYN_RECV requests
> can still reference it as rsk_listener.
> 
> If SO_ATTACH_REUSEPORT_[CE]BPF is then used on this socket,
> reuseport_attach_prog() calls reuseport_alloc(), which resurrects
> it into the listening section of a new group, even though the
> socket is still in TCP_CLOSE.
> 
> [...]

Here is the summary with links:
  - [v2,net] tcp: do not resurrect a former listener with SO_ATTACH_REUSEPORT_[CE]BPF
    https://git.kernel.org/netdev/net/c/8c011697f76a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html