Re: [PATCH v1 net-next 1/2] tcp: Do not allow buggy transitions between ehash and lhash2.

["Daniel Zahka" <daniel.zahka@gmail.com>]

On Thu Sep 3, 2026 at 11:35 PM EDT, Kuniyuki Iwashima wrote:
> The following state transitions have long been a playground for
> syzbot, and recently AI joined in, reporting a lot more bugs.
>
>   * listen() + shutdown() + connect()
>   * connect() + connect(AF_UNSPEC) + listen()

Hi there. Thanks for closing these. I'm wondering if connect() ->
listen() via timewait is intentionally left open?

    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
 +.01...0.011 connect(3, ..., ...) = 0
   +0 > S 0:0(0) <...>
   +0 < S. 0:0(0) ack 1 win 32000 <mss 1460,nop,wscale 7>
   +0 > . 1:1(0) ack 1

   +0 shutdown(3, SHUT_WR) = 0
   +0 > F. 1:1(0) ack 1
   +0 < .  1:1(0) ack 2 win 257

   +0 < F. 1:1(0) ack 2 win 257
   +0 > .  2:2(0) ack 2

   +0 connect(3, AF_UNSPEC, ...) = 0
   +0 listen(3, 1) = 0

For PSP, this allows us to end up with a listen socket with PSP state,
because we don't clear it out in tcp_disconnect(). I'm planning a series
to remove PSP on listen sockets, and closing this would make that a lot
easier.