Re: [PATCH net] tcp: fix use-after-free of the listener's ipv6_pinfo after IPV6_ADDRFORM

On Tue, Aug 11, 2026 at 8:37 PM Hyunwoo Kim <[email protected]> wrote:
>
> IPV6_ADDRFORM moves an established AF_INET6 TCP socket over to tcp_prot
> and ipv4_specific. The socket is still a tcp6_sock though, so ->pinet6
> keeps pointing at the ipv6_pinfo inside it and sk_destruct stays the IPv6
> one; commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6
> sk->sk_destruct().") relies on that to release the IPv6 state.
>
> Once such a socket is disconnected and listen()ed again, its children are
> cloned from an IPv6 parent but allocated from tcp_prot, so they have no
> ipv6_pinfo of their own and inherit the listener's ->pinet6 and its IPv6
> destructor. The only thing that would fix that up is
> tcp_v6_mapped_child_init(), which is not passed to tcp_v4_syn_recv_sock()
> on this path. A child accepted from such a listener can outlive it, and
> its destructor then runs inet6_cleanup_sock() on the freed listener.
>
> Commit 858d2a4f67ff ("tcp: fix potential race in tcp_v6_syn_recv_sock()")
> added opt_child_init for the v4-mapped child; this is the same stale
> ->pinet6 on the path that never gets it.
>
> Clear the IPv6 fields on the child. The converted listener has to keep
> its own, so there is nothing to clear on the IPV6_ADDRFORM side.
>
> Fixes: d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().")
> Cc: [email protected]
> Signed-off-by: Hyunwoo Kim <[email protected]>
> ---
>  net/ipv4/tcp_ipv4.c | 6 +++++-
>  net/ipv6/af_inet6.c | 3 +++
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 7f413f509d7dce..f830b212d38e49 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1730,8 +1730,12 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
>         sk_setup_caps(newsk, dst);
>
>  #if IS_ENABLED(CONFIG_IPV6)
> -       if (opt_child_init)
> +       if (opt_child_init) {
>                 opt_child_init(newsk, sk);
> +       } else {
> +               newinet->pinet6 = NULL;
> +               newinet->ipv6_fl_list = NULL;

Instead of adding a new test in inet6_cleanup_sock(() I would add here :

newsk->sk_destruct = inet_sock_destruct;



> +       }
>  #endif
>         tcp_ca_openreq_child(newsk, dst);
>
> diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
> index 282912a1199992..2090289408c035 100644
> --- a/net/ipv6/af_inet6.c
> +++ b/net/ipv6/af_inet6.c
> @@ -479,6 +479,9 @@ void inet6_cleanup_sock(struct sock *sk)
>         struct sk_buff *skb;
>         struct ipv6_txoptions *opt;
>
> +       if (!np)
> +               return;
> +
>         /* Release rx options */
>
>         skb = xchg(&np->pktoptions, NULL);
> --
> 2.43.0


Also, it seems weird that all these issues caused by tcp_disconnect()
are fixed by AI agents adding code in TCP fast paths.

What about adding code in tcp_disconnect() that only fuzzers are possibly using?

Untested patch:

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 455441f1b694904172cfa1d8e7bac7076b60cb24..9dd44b0a31c4dc751b22558dc6b53ed49598e0b6
100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3501,6 +3501,15 @@ int tcp_disconnect(struct sock *sk, int flags)
                sk->sk_frag.page = NULL;
                sk->sk_frag.offset = 0;
        }
+
+#if IS_ENABLED(CONFIG_IPV6)
+       if (sk->sk_family == PF_INET &&
+           sk->sk_destruct == inet6_sock_destruct) {
+               sk->sk_destruct = inet_sock_destruct;
+               inet->pinet6 = NULL;
+       }
+#endif
+
        sk_error_report(sk);
        return 0;
 }