Re: [PATCH v1 net-next 1/2] tcp: Do not allow buggy transitions between ehash and lhash2.

[Jakub Sitnicki <jakub@cloudflare.com>]

On Fri, Sep 04, 2026 at 03:35 AM GMT, Kuniyuki Iwashima wrote:
> The following state transitions have long been a playground for
> syzbot, and recently AI joined in, reporting a lot more bugs.
>
>   * listen() + shutdown() + connect()
>   * connect() + connect(AF_UNSPEC) + listen()
>
> All the fix attempts would add more code to the fast path, which
> is not worth it.
>
> Instead of playing whack-a-mole with these edge-case bugs,
> let's disallow these transitions.
>
> Note that unhashed_state is placed in the 4-byte hole after
> icsk_pmtu_cookie.
>
>   $ pahole -C inet_connection_sock vmlinux
>   struct inet_connection_sock {
>   ...
> 	__u32                      icsk_pmtu_cookie;     /*  1208     4 */
> 	unsigned char              unhashed_state;       /*  1212     1 */
>
> 	/* XXX 3 bytes hole, try to pack */
>
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Closes: https://lore.kernel.org/netdev/20260731140512.566464-1-david.lee@trailofbits.com/
> Reported-by: Michal Luczaj <mhal@rbox.co>
> Closes: https://lore.kernel.org/netdev/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co/
> Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260824033331.1084971-1-imv4bel@gmail.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
>  include/net/inet_connection_sock.h |  1 +
>  net/ipv4/inet_connection_sock.c    |  1 +
>  net/ipv4/inet_hashtables.c         | 11 +++++++++++
>  3 files changed, 13 insertions(+)
>
> diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
> index 433c2df23076..903499581db7 100644
> --- a/include/net/inet_connection_sock.h
> +++ b/include/net/inet_connection_sock.h
> @@ -94,6 +94,7 @@ struct inet_connection_sock {
>  	u32			  icsk_rto_max;
>  	__u32                     icsk_delack_max;
>  	__u32			  icsk_pmtu_cookie;
> +	unsigned char		  unhashed_state;
>  	const struct tcp_congestion_ops *icsk_ca_ops;
>  	const struct inet_connection_sock_af_ops *icsk_af_ops;
>  	const struct tcp_ulp_ops  *icsk_ulp_ops;

Glad we went in that direction in the end. Makes like easier.

Nit: Could be a flag, like CAN_LISTEN or CAN_CONNECT?
Either INET_FLAGS_* or maybe we need ICSK_FLAGS_*?

Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>