Re: [PATCH v1 net 1/3] tcp: Clear DEFER_CONNECT before tcp_connect() and in tcp_abort().

[Matthieu Baerts <matttbe@kernel.org>]

On 10/11/2026 20:12, Kuniyuki Iwashima wrote:
> On Tue, Nov 10, 2026 at 10:46 AM Matthieu Baerts <matttbe@kernel.org> wrote:
>>
>> Hi Kuniyuki,
>>
>> On 08/11/2026 00:56, Kuniyuki Iwashima wrote:
>>> When TFO is enabled, tcp_v[46]_connect() sets sk->sk_state to
>>> TCP_SYN_SENT and puts the socket into ehash without calling
>>> tcp_connect().
>>>
>>> Then, tcp_fastopen_defer_connect() sets DEFER_CONNECT, and
>>> the first write()/sendmsg() will call tcp_connect() and send
>>> SYN with data if possible.
>>>
>>> If tcp_abort() kills a socket before the first write()/sendmsg(),
>>> the unhashed socket can still call it and send SYN in TCP_CLOSE.
>>>
>>> Also, DEFER_CONNECT is cleared after __inet_stream_connect().
>>>
>>> So, blocking write()/sendmsg() can release lock_sock() in
>>> inet_wait_for_connect() while DEFER_CONNECT is set, and
>>> tcp_poll() could set EPOLLOUT even after SYN is sent.
>>>
>>> Let's clear DEFER_CONNECT in tcp_abort() and right before
>>> tcp_connect() in tcp_sendmsg_fastopen().
>>
>> Thank you for the fix!
>>
>> It looks like we can still have the race with MPTCP:
>>
>> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261107235720.3129212-1-kuniyu%40google.com
>>
>> But that's not blocking this series here, so for the MPTCP part:
>>
>> Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> 
> Thanks Matt !
> 
>>
>>
>> Just to avoid a deadlock, are you planning to fix the issue on MPTCP
>> side as well? If not, I can look at that later on when I can.
> 
> I would appreciate it if you could look into it.

Sure, I will wait for this series to be applied first.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.