Re: [PATCH net] tcp: avoid double destroy in tcp_abort() of an unaccepted child

[Kuniyuki Iwashima <kuniyu@google.com>]

On Wed, 28 Oct 2026 17:08:47 +0100, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> tcp_abort() checks for TCP_CLOSE while only owning the socket lock,
> then grabs the BH lock before calling tcp_done_with_error().
> 
> For a child still sitting in a listener accept queue (which can be
> reached via SOCK_DESTROY or bpf_sock_destroy()), inet_csk_listen_stop()
> can run in this window: it only holds the child BH lock, and calls
> inet_child_forget(), which disconnects, orphans and destroys the child.
> 
> tcp_abort() then calls tcp_done_with_error() -> tcp_done(), which sees
> SOCK_DEAD and calls inet_csk_destroy_sock() a second time, leading to
> a double sock_put() and a use-after-free.
> 
> Recheck TCP_CLOSE after acquiring the BH lock, unless we just closed
> a listener ourselves, in which case tcp_done_with_error() must still
> run to report the error.
> 
> Note that the WARN_ON(sock_owned_by_user(child)) in
> inet_csk_listen_stop() can still trigger in this window.
> 
> Fixes: bac76cf89816 ("tcp: fix forever orphan socket caused by tcp_abort")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> [edumazet: recheck TCP_CLOSE under the BH lock instead of moving the test, smaller diff]
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>