Re: [PATCH net 3/3] tcp: do not inherit out_of_order_queue from parent

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 8/17/26 5:03 PM, Hyunwoo Kim wrote:
> A child gets a copy of the parent's out_of_order_queue, which can be non
> empty when/if parent morphs from listener to active session. Parent and
> child then point at the same rbtree.
>
> The parent is no longer a listener, so inet_csk_reqsk_queue_add() forgets
> the child immediately, and tcp_disconnect() frees the skbs the parent
> still owns. The parent's own root and ooo_last_skb are left alone, so it
> keeps using those skbs. That is a use-after-free, and the parent frees
> them a second time when it closes.
>
> We need to make sure this can not happen, by initializing the queue after
> socket cloning.
>
> Very similar to commit 8b485ce69876 ("tcp: do not inherit fastopen_req
> from parent")
>
> Fixes: 9f5afeae5152 ("tcp: use an RB tree for ooo receive queue")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
>   net/ipv4/tcp_minisocks.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
> index 6ab3e3a0b43173..d13813d50947dd 100644
> --- a/net/ipv4/tcp_minisocks.c
> +++ b/net/ipv4/tcp_minisocks.c
> @@ -591,6 +591,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
>   	newtp->total_retrans = req->num_retrans;
>   
>   	tcp_init_xmit_timers(newsk);
> +	newtp->out_of_order_queue = RB_ROOT;


Does tcp_rtx_queue suffer from the same issue?


>   	WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
>   
>   	if (sock_flag(newsk, SOCK_KEEPOPEN))