Re: [PATCH v1 net 1/3] tcp: Clear DEFER_CONNECT before tcp_connect() and in tcp_abort().

[Matthieu Baerts <matttbe@kernel.org>]

Hi Kuniyuki,

On 08/11/2026 00:56, Kuniyuki Iwashima wrote:
> When TFO is enabled, tcp_v[46]_connect() sets sk->sk_state to
> TCP_SYN_SENT and puts the socket into ehash without calling
> tcp_connect().
> 
> Then, tcp_fastopen_defer_connect() sets DEFER_CONNECT, and
> the first write()/sendmsg() will call tcp_connect() and send
> SYN with data if possible.
> 
> If tcp_abort() kills a socket before the first write()/sendmsg(),
> the unhashed socket can still call it and send SYN in TCP_CLOSE.
> 
> Also, DEFER_CONNECT is cleared after __inet_stream_connect().
> 
> So, blocking write()/sendmsg() can release lock_sock() in
> inet_wait_for_connect() while DEFER_CONNECT is set, and
> tcp_poll() could set EPOLLOUT even after SYN is sent.
> 
> Let's clear DEFER_CONNECT in tcp_abort() and right before
> tcp_connect() in tcp_sendmsg_fastopen().

Thank you for the fix!

It looks like we can still have the race with MPTCP:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261107235720.3129212-1-kuniyu%40google.com

But that's not blocking this series here, so for the MPTCP part:

Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>


Just to avoid a deadlock, are you planning to fix the issue on MPTCP
side as well? If not, I can look at that later on when I can.

(Perhaps by checking if the msk and ssk's DEFER_CONNECT flag is no
longer aligned in mptcp_sendmsg_fastopen(), under the ssk lock? If not,
clear the msk one, report the error, release the lock and return? BTW,
it looks like we also forgot to clear the DEFER_CONNECT flag in
mptcp_disconnect() as well...)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.