Re: [PATCH net] ipv4: free inet_opt after an RCU grace period

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 9/30/26 5:43 AM, Eric Dumazet wrote:
> tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
> child socket (newinet->inet_opt) without copying it.
>
> Another cpu can concurrently retransmit a SYNACK for the same request
> socket (either from a retransmitted SYN, or from the SYNACK timer).
> tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
> under rcu_read_lock() only, and ip_build_and_send_pkt() and
> ip_options_build() then read opt->optlen twice.
>
> Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
> into ehash table"), request sockets are processed without holding
> the listener lock, so nothing prevents the child socket from being
> freed while the SYNACK is still being built. TCP child sockets do
> not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
> with a plain kfree(), leading to a use-after-free in
> ip_options_build().
>
> Readers of inet_opt already use RCU, and other paths replacing
> inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
> kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() as well.
>
> IPv6 is not affected, tcp_v6_syn_recv_sock() duplicates the options.
>
> Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
> Reported-by: Xinyang Ge <xinyang@anthropic.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>



For the SYNACK timer case, inet_csk_complete_hashdance() calls
timer_delete_sync() before the child can be freed, so I don't see how
that one can race. The retransmitted SYN path is the real one I think.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

> ---
>   net/ipv4/af_inet.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
> index 4ce38c99fef9ef2a24edff34cd5b110dddfec193..14ce01092fda65dbcf835662c03d78f4de0301f2 100644
> --- a/net/ipv4/af_inet.c
> +++ b/net/ipv4/af_inet.c
> @@ -161,7 +161,7 @@ void inet_sock_destruct(struct sock *sk)
>   	WARN_ON_ONCE(sk->sk_wmem_queued);
>   	WARN_ON_ONCE(sk->sk_forward_alloc);
>   
> -	kfree(rcu_dereference_protected(inet->inet_opt, 1));
> +	kfree_rcu(rcu_dereference_protected(inet->inet_opt, 1), rcu);
>   	dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
>   	dst_release(rcu_dereference_protected(sk->sk_rx_dst, 1));
>   	psp_sk_assoc_free(sk);