From 404381b4f1053a271a85679cc76a543b10ae043e Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Thu, 17 Sep 2026 19:15:52 +0000 Subject: [PATCH] tcp: Set unhashed_state in inet_twsk_hashdance_schedule(). inet_unhash() sets inet_csk(sk)->unhashed_state only when the socket is hashed because tcp_set_state(sk, TCP_CLOSE) could be called multiple times, e.g. tcp_abort() calls it directly and tcp_done_with_error(). However, inet_twsk_hashdance_schedule() also unhashes a socket when replacing it with twsk, allowing the socket to bypass checks for inet_csk(sk)->unhashed_state. Let's update inet_csk(sk)->unhashed_state there as well. Fixes: 8cc3aef0cb19 ("tcp: Do not allow buggy transitions between ehash and lhash2.") Reported-by: Daniel Zahka Closes: https://lore.kernel.org/netdev/DLHLRA8GVI5B.2Q1IRQG5BVJNZ@gmail.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Daniel Zahka Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917191554.1600494-1-kuniyu@google.com Signed-off-by: Jakub Kicinski --- net/ipv4/inet_timewait_sock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index d4c781a0667f..a1d86026aefb 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -105,10 +105,12 @@ void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw, struct inet_hashinfo *hashinfo, int timeo) { - const struct inet_sock *inet = inet_sk(sk); - const struct inet_connection_sock *icsk = inet_csk(sk); spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash); + struct inet_connection_sock *icsk = inet_csk(sk); struct inet_bind_hashbucket *bhead, *bhead2; + const struct inet_sock *inet = inet_sk(sk); + + icsk->unhashed_state = sk->sk_state; /* Put TW into bind hash. Original socket stays there too. * Note, that any socket with inet->num != 0 MUST be bound in