Re: [PATCH net] tcp: purge Fast Open RST queue when listen() fails

[Hyunwoo Kim <imv4bel@gmail.com>]

On Sat, Nov 14, 2026 at 12:12:47PM +0100, Eric Dumazet wrote:
> inet_csk_listen_start() moves the socket to TCP_LISTEN before calling
> ->get_port() and ->hash(). If one of them fails, the socket goes back
> to TCP_CLOSE without going through inet_csk_listen_stop().
> 
> If the socket was a Fast Open listener in a previous life, and was
> stopped with shutdown(SHUT_RD) or connect(AF_UNSPEC) while an accepted
> Fast Open child was still in TCP_SYN_RECV state, the request_sock of
> this child still points to the listener.
> 
> A valid RST received for this child while the listener is transiently
> in TCP_LISTEN state makes reqsk_fastopen_remove() queue the
> request_sock in rskq_rst_head. When listen() fails, for instance with
> -EADDRINUSE because another SO_REUSEADDR socket started listening on
> the same port, nothing reclaims it:
> 
> - __tcp_close(), tcp_disconnect() and tcp_abort() only call
>   inet_csk_listen_stop() for sockets in TCP_LISTEN state.
> 
> - A later successful listen() overwrites rskq_rst_head in
>   reqsk_queue_alloc().
> 
> The request_sock is leaked, together with the reference it holds
> on the listener.
> 
> Move the rskq_rst_head purge to a helper, and call it from the
> inet_csk_listen_start() error path as well, after the socket state
> has been set back to TCP_CLOSE: reqsk_fastopen_remove() checks
> sk_state under fastopenq.lock, so it either queued the request before
> the purge acquires the lock, or does not queue it at all.
> 
> Reported-by: Sashiko AI review <netdev-bot+sashiko@kernel.org>
> Closes: https://lore.kernel.org/netdev/179450310167.2199510.18107423940014989443@kernel.org/
> Fixes: 0536fcc039a8 ("tcp: prepare fastopen code for upcoming listener changes")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Hyunwoo Kim <imv4bel@gmail.com>

LGTM.

> ---
> Cc: Hyunwoo Kim <imv4bel@gmail.com>
> ---
>  net/ipv4/inet_connection_sock.c | 35 ++++++++++++++++++++++-----------
>  1 file changed, 24 insertions(+), 11 deletions(-)
> 
> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> index ca3057192e6d..c33b0095468a 100644
> --- a/net/ipv4/inet_connection_sock.c
> +++ b/net/ipv4/inet_connection_sock.c
> @@ -1331,6 +1331,22 @@ static int inet_ulp_can_listen(const struct sock *sk)
>  	return 0;
>  }
>  
> +/* Free all the reqs queued in rskq_rst_head. */
> +static void reqsk_fastopen_purge_rst(struct request_sock_queue *queue)
> +{
> +	struct request_sock *next, *req;
> +
> +	spin_lock_bh(&queue->fastopenq.lock);
> +	req = queue->fastopenq.rskq_rst_head;
> +	queue->fastopenq.rskq_rst_head = NULL;
> +	spin_unlock_bh(&queue->fastopenq.lock);
> +	while (req != NULL) {
> +		next = req->dl_next;
> +		reqsk_put(req);
> +		req = next;
> +	}
> +}
> +
>  static void reqsk_queue_alloc(struct request_sock_queue *queue)
>  {
>  	queue->fastopenq.rskq_rst_head = NULL;
> @@ -1373,6 +1389,12 @@ int inet_csk_listen_start(struct sock *sk)
>  	}
>  
>  	inet_sk_set_state(sk, TCP_CLOSE);
> +
> +	/* A Fast Open child accepted before a previous shutdown() of this
> +	 * listener might have queued its request in rskq_rst_head while
> +	 * we were transiently in TCP_LISTEN state.
> +	 */
> +	reqsk_fastopen_purge_rst(&icsk->icsk_accept_queue);
>  	return err;
>  }
>  
> @@ -1477,7 +1499,7 @@ void inet_csk_listen_stop(struct sock *sk)
>  {
>  	struct inet_connection_sock *icsk = inet_csk(sk);
>  	struct request_sock_queue *queue = &icsk->icsk_accept_queue;
> -	struct request_sock *next, *req;
> +	struct request_sock *req;
>  
>  	/* Following specs, it would be better either to send FIN
>  	 * (and enter FIN-WAIT-1, it is normal close)
> @@ -1533,16 +1555,7 @@ void inet_csk_listen_stop(struct sock *sk)
>  		if (!has_current_bpf_ctx())
>  			cond_resched();
>  	}
> -	/* Free all the reqs queued in rskq_rst_head. */
> -	spin_lock_bh(&queue->fastopenq.lock);
> -	req = queue->fastopenq.rskq_rst_head;
> -	queue->fastopenq.rskq_rst_head = NULL;
> -	spin_unlock_bh(&queue->fastopenq.lock);
> -	while (req != NULL) {
> -		next = req->dl_next;
> -		reqsk_put(req);
> -		req = next;
> -	}
> +	reqsk_fastopen_purge_rst(queue);
>  	WARN_ON_ONCE(sk->sk_ack_backlog);
>  }
>  
> -- 
> 2.53.0
> 


Best regards,
Hyunwoo Kim