net/ipv4/tcp_fastopen.c | 5 +++++ 1 file changed, 5 insertions(+)
subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
SYN under the fatal fallback and hands it back with drop_req=true to
tell the caller to drop both the request and the child. Of the three
syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
contract; tcp_fastopen_create_child() only checks child != NULL.
With an MPTCP listener and server-side Fast Open enabled, this can
become a use-after-free:
1. fetch a TFO cookie,
2. complete a normal MP_CAPABLE handshake to learn the server's key
and compute the token offline,
3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
4. a subsequent accept() hands the freed socket to userspace, and
any fd operation triggers slab-use-after-free, leading to a
denial of service.
Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
net/ipv4/tcp_fastopen.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 6a031a1a6c9f..7a0b58b39a2c 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
if (!child)
return NULL;
+ if (own_req && rsk_drop_req(req)) {
+ sock_put(child);
+ return NULL;
+ }
+
spin_lock(&queue->fastopenq.lock);
queue->fastopenq.qlen++;
spin_unlock(&queue->fastopenq.lock);
--
2.43.0
on 9/2/26 8:12 PM, Yilin Zhang wrote:
> subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
> SYN under the fatal fallback and hands it back with drop_req=true to
> tell the caller to drop both the request and the child. Of the three
> syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
> contract; tcp_fastopen_create_child() only checks child != NULL.
>
> With an MPTCP listener and server-side Fast Open enabled, this can
> become a use-after-free:
>
> 1. fetch a TFO cookie,
> 2. complete a normal MP_CAPABLE handshake to learn the server's key
> and compute the token offline,
> 3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
> 4. a subsequent accept() hands the freed socket to userspace, and
> any fd operation triggers slab-use-after-free, leading to a
> denial of service.
>
> Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
> Reported-by: Kimi Security Team <bug-report@moonshot.ai>
> Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
> ---
> net/ipv4/tcp_fastopen.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> index 6a031a1a6c9f..7a0b58b39a2c 100644
> --- a/net/ipv4/tcp_fastopen.c
> +++ b/net/ipv4/tcp_fastopen.c
> @@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
> if (!child)
> return NULL;
>
> + if (own_req && rsk_drop_req(req)) {
> + sock_put(child);
The child is still locked by inet_csk_clone_lock.
We should do this instead:
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 471c78be5513..22494ff746c7 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -337,6 +337,12 @@ static struct sock
*tcp_fastopen_create_child(struct sock *sk,
if (!child)
return NULL;
+ if (own_req && rsk_drop_req(req)) {
+ bh_unlock_sock(child);
+ sock_put(child);
+ return NULL;
+ }
+
spin_lock(&queue->fastopenq.lock);
queue->fastopenq.qlen++;
spin_unlock(&queue->fastopenq.lock);
> + return NULL;
tcp_conn_request will still send a SYN-ACK, but the RST was already sent
It's not clean. Maybe we should do something like this instead (untested)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0f60a1dbf927..d371845d601a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7775,6 +7775,10 @@ int tcp_conn_request(struct request_sock_ops
*rsk_ops,
READ_ONCE(sk->sk_data_ready)(sk);
bh_unlock_sock(fastopen_sk);
sock_put(fastopen_sk);
+ } else if (rsk_drop_req(req)) {
+ reqsk_free(req);
+ dst_release(dst);
+ return 0;
} else {
tcp_rsk(req)->tfo_listener = false;
if (!want_cookie &&
BTW, since this is reported by LLM I think it is not difficult to have
the LLM write a reproducer and test this patch.
Hi Jiayuan, Yilin, Thank you for the patch and the review! On 02/09/2026 16:12, Jiayuan Chen wrote: > > on 9/2/26 8:12 PM, Yilin Zhang wrote: >> subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN >> SYN under the fatal fallback and hands it back with drop_req=true to >> tell the caller to drop both the request and the child. Of the three >> syn_recv_sock() callers, tcp_check_req() and the cookie path honor that >> contract; tcp_fastopen_create_child() only checks child != NULL. >> >> With an MPTCP listener and server-side Fast Open enabled, this can >> become a use-after-free: >> >> 1. fetch a TFO cookie, >> 2. complete a normal MP_CAPABLE handshake to learn the server's key >> and compute the token offline, >> 3. send an MP_JOIN SYN carrying that token and the valid TFO cookie, >> 4. a subsequent accept() hands the freed socket to userspace, and >> any fd operation triggers slab-use-after-free, leading to a >> denial of service. (...) > BTW, since this is reported by LLM I think it is not difficult to have > the LLM write a reproducer and test this patch. That would be great to use the MPTCP packetdrill fork for that: https://github.com/multipath-tcp/packetdrill/ Cheers, Matt -- Sponsored by the NGI0 Core fund.
Hi Yilin,
Thank you for your modifications, that's great!
Our CI did some validations and here is its report:
- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf:
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33631744638
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/f9058346dca3
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1156129
If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:
$ cd [kernel source code]
$ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
--pull always mptcp/mptcp-upstream-virtme-docker:latest \
auto-normal
For more details:
https://github.com/multipath-tcp/mptcp-upstream-virtme-docker
Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)
Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Missing `bh_unlock_sock(child)` before `sock_put(child)` causes a locked spinlock and preemption/softirq-disable leak.
- [High] Returning NULL from `tcp_fastopen_create_child()` fails to abort the request, causing a rejected MPTCP MP_JOIN request to incorrectly fall back to standard SYN processing, leading to a spurious SYN-ACK and resource waste.
--
commit c3cab231705bf3a0b9db9f8531e40d30d546e830
Author: Yilin Zhang <yilinzhang@moonshot.ai>
tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()
This commit addresses a use-after-free vulnerability by checking
rsk_drop_req(req) in tcp_fastopen_create_child(). If an MPTCP MP_JOIN SYN
with a valid Fast Open cookie triggers the fatal fallback in
subflow_syn_recv_sock(), the request and child socket are now dropped.
> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> index 471c78be55137..b8b3abbee253d 100644
> --- a/net/ipv4/tcp_fastopen.c
> +++ b/net/ipv4/tcp_fastopen.c
> @@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
> if (!child)
> return NULL;
>
> + if (own_req && rsk_drop_req(req)) {
> + sock_put(child);
[Severity: Critical]
Does this code leak the socket lock?
When a child socket is created and returned by syn_recv_sock(), it is
returned with the socket spinlock held. If we call sock_put(child) here
without first calling bh_unlock_sock(child), does this leave the spinlock
locked and softirqs disabled, leading to a soft lockup?
> + return NULL;
[Severity: High]
Does returning NULL here cause the dropped request to be incorrectly retained?
When NULL is returned, tcp_fastopen_create_child() signals a normal Fast Open
failure rather than a hard drop. tcp_conn_request() will then assume Fast Open
failed, proceed to the standard SYN processing path, link the dropped request
into the SYN queue, and send a SYN-ACK:
net/ipv4/tcp_input.c:tcp_conn_request() {
...
} else {
tcp_rsk(req)->tfo_listener = false;
if (!want_cookie &&
unlikely(!inet_csk_reqsk_queue_hash_add(sk, req))) {
reqsk_free(req);
dst_release(dst);
return 0;
}
af_ops->send_synack(sk, dst, &fl, req, &foc,
!want_cookie ? TCP_SYNACK_NORMAL :
TCP_SYNACK_COOKIE,
skb);
...
}
Should this path return an error pointer or use a drop mechanism to ensure the
request is completely aborted, rather than triggering the fallback path?
> + }
> +
> spin_lock(&queue->fastopenq.lock);
> queue->fastopenq.qlen++;
> spin_unlock(&queue->fastopenq.lock);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902121247.3248539-1-yilinzhang@moonshot.ai?part=1
© 2016 - 2026 Red Hat, Inc.