Eric Dumazet 1bbf0ced1d tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction ... Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00% Fixes: 41eecbd712 ("tcp: replace TCP_SKB_CB(skb)->tcp_tw_isn with a per-cpu field") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260519084611.2485277-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-05-20 19:14:06 -07:00
..
9p	9p: document missing enum values in kernel-doc comments	2026-04-16 02:57:01 +00:00
bluetooth	Bluetooth: serialize accept_q access	2026-05-14 09:49:56 -04:00
iucv	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
libeth	libeth, idpf: use truesize as XDP RxQ info frag_size	2026-03-05 08:02:05 -08:00
mana	net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR	2026-05-05 15:43:08 +02:00
netfilter	netfilter: nf_queue: hold bridge skb->dev while queued	2026-05-16 13:23:01 +02:00
netns	ipv6: flowlabel: enforce per-netns limit for unprivileged callers	2026-05-08 14:59:14 -07:00
nfc
page_pool	net: Slightly simplify net_mp_{open,close}_rxq	2026-04-09 18:21:46 -07:00
phonet
phy
psp
sctp
tc_act	net/sched: act_ife: Fix metalist update behavior	2026-03-05 07:54:08 -08:00
6lowpan.h
act_api.h	net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks	2026-02-27 19:06:21 -08:00
addrconf.h	ipv6: addrconf: reduce default temp_valid_lft to 2 days	2026-02-17 17:12:06 -08:00
af_ieee802154.h
af_rxrpc.h
af_unix.h
af_vsock.h	vsock: add G2H fallback for CIDs not owned by H2G transport	2026-03-12 10:59:36 +01:00
ah.h
aligned_data.h
amt.h
arp.h
ax25.h	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
ax88796.h
bareudp.h
bond_3ad.h	bonding: 3ad: implement proper RCU rules for port->aggregator	2026-04-29 18:32:02 -07:00
bond_alb.h
bond_options.h
bonding.h	bonding: remove unused bond_is_first_slave and bond_is_last_slave macros	2026-04-08 19:07:08 -07:00
bpf_sk_storage.h
busy_poll.h
calipso.h
can.h	can: add CAN skb extension infrastructure	2026-02-05 11:58:39 +01:00
cfg80211-wext.h
cfg80211.h	wifi: nl80211: Add a notification to notify NAN channel evacuation	2026-03-25 20:56:55 +01:00
cfg802154.h
checksum.h
cipso_ipv4.h
cls_cgroup.h
codel_impl.h	codel: annotate data-races in codel_dump_stats()	2026-04-08 19:18:52 -07:00
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Add port-level resource registration infrastructure	2026-04-08 19:55:38 -07:00
dropreason-core.h	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
dropreason-qdisc.h	net: sched: sch_dualpi2: use qdisc_dequeue_drop() for dequeue drops	2026-02-28 15:31:35 -08:00
dropreason.h	net: sched: introduce qdisc-specific drop reason tracing	2026-02-28 15:31:34 -08:00
dsa_stubs.h
dsa.h	net: dsa: add bridge member iteration macro	2026-04-06 18:30:33 -07:00
dscp.h
dsfield.h
dst_cache.h
dst_metadata.h
dst_ops.h
dst.h	inet: add dst4_mtu() and dst6_mtu() helpers	2026-02-02 17:49:29 -08:00
eee.h
erspan.h
esp.h
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h
firewire.h
flow_dissector.h
flow_offload.h	net: dsa: eliminate local type for tc policers	2026-02-10 15:30:11 +01:00
flow.h
fou.h
fq_impl.h	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fq.h
garp.h
gen_stats.h
genetlink.h	genetlink: free the skb on 'group >= family->n_mcgrps'	2026-05-08 15:43:29 -07:00
geneve.h
gre.h
gro_cells.h
gro.h
gso.h
gtp.h
gue.h
handshake.h
hotdata.h	net-sysfs: use rps_tag_ptr and remove metadata from rps_sock_flow_table	2026-03-04 16:54:09 -08:00
hwbm.h
icmp.h
ieee8021q.h
ieee80211_radiotap.h
ieee802154_netdev.h
if_inet6.h
ife.h
inet_common.h	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
inet_connection_sock.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-02-26 10:23:00 -08:00
inet_dscp.h
inet_ecn.h	tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers	2026-02-03 15:13:24 +01:00
inet_frag.h
inet_hashtables.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-03-26 12:09:57 -07:00
inet_sock.h	ipv6: colocate inet6_cork in inet_cork_full	2026-02-02 17:49:30 -08:00
inet_timewait_sock.h
inet6_connection_sock.h	tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c	2026-02-24 17:47:27 -08:00
inet6_hashtables.h	tcp: Initialise ehash secrets during connect() and listen().	2026-03-05 18:50:05 -08:00
inetpeer.h
ioam6.h	ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()	2026-02-13 12:24:05 -08:00
ip_fib.h	net: ipv4: fix ARM64 alignment fault in multipath hash seed	2026-03-03 17:20:37 -08:00
ip_tunnels.h	net: increase IP_TUNNEL_RECURSION_LIMIT to 5	2026-04-03 15:52:10 -07:00
ip_vs.h	ipvs: avoid possible loop in ip_vs_dst_event on resizing	2026-05-16 12:19:56 +02:00
ip.h	net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros	2026-03-29 11:21:22 -07:00
ip6_checksum.h	udp: move udp6_csum_init() back to net/ipv6/udp.c	2026-02-24 16:30:40 -08:00
ip6_fib.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
ip6_route.h	ipv6: prepare headers for ipv6_stub removal	2026-03-29 11:21:23 -07:00
ip6_tunnel.h	net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT	2026-03-14 08:38:06 -07:00
ipcomp.h
ipconfig.h
ipv6_frag.h
ipv6.h	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
iw_handler.h
kcm.h
l3mdev.h	net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()	2026-02-02 17:09:11 -08:00
lag.h
lapb.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h
mac80211.h	wifi: mac80211: add NAN peer schedule support	2026-04-07 15:36:03 +02:00
mac802154.h
macsec.h	macsec: use rcu_work to defer TX SA crypto cleanup out of softirq	2026-05-13 19:03:05 -07:00
mctp.h	net: mctp: fix don't require received header reserved bits to be zero	2026-04-20 11:46:57 -07:00
mctpdevice.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h
mrp.h
ncsi.h
ndisc.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
neighbour_tables.h
neighbour.h	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()	2026-05-16 13:22:50 +02:00
net_debug.h
net_failover.h
net_namespace.h	kernfs: pass struct ns_common instead of const void * for namespace tags	2026-04-09 14:36:52 +02:00
net_ratelimit.h
net_shaper.h	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
net_trackers.h
netdev_lock.h
netdev_netlink.h
netdev_queues.h	net: Proxy netdev_queue_get_dma_dev for leased queues	2026-04-09 18:21:46 -07:00
netdev_rx_queue.h	net: remove the netif_get_rx_queue_lease_locked() helpers	2026-04-09 18:26:28 -07:00
netevent.h
netkit.h
netlabel.h
netlink.h	netlink: add a nla_nest_end_safe() helper	2026-04-12 11:23:50 -07:00
netmem.h	net: add net_iov_init() and use it to initialize ->page_type	2026-04-29 16:40:08 -07:00
netprio_cgroup.h
nexthop.h
nl802154.h
nsh.h	net: nsh: fix incorrect header length macros	2026-05-08 15:32:59 -07:00
pfcp.h
pie.h	net/sched: sch_pie: annotate data-races in pie_dump_stats()	2026-04-22 21:12:47 -07:00
ping.h	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
pkt_cls.h
pkt_sched.h	net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue	2026-02-05 09:32:45 -08:00
pptp.h
proto_memory.h
protocol.h
psample.h
psnap.h
psp.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	tcp: move __reqsk_free() out of line	2026-02-05 09:23:06 -08:00
rose.h	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
route.h
rpl.h
rps-types.h	net: add rps_tag_ptr type and helpers	2026-03-04 16:54:09 -08:00
rps.h	net-sysfs: use rps_tag_ptr and remove metadata from rps_dev_flow_table	2026-03-04 16:54:10 -08:00
rsi_91x.h
rstreason.h
rtnetlink.h
rtnh.h
sch_generic.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
sch_priv.h
scm.h
secure_seq.h	tcp: secure_seq: add back ports to TS offset	2026-03-04 17:44:35 -08:00
seg6_hmac.h
seg6_local.h
seg6.h
selftests.h
slhc_vj.h
smc.h
snmp.h
sock_reuseport.h
sock.h	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
Space.h	drivers: net: 8390: wd80x3: Remove this driver	2026-04-23 15:57:10 -07:00
stp.h
strparser.h
switchdev.h	bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign	2026-03-19 13:14:00 +01:00
tc_wrapper.h	net/sched: refine indirect call mitigation in tc_wrapper.h	2026-03-09 19:31:41 -07:00
tcp_ao.h
tcp_ecn.h	tcp: annotate data-races around tp->delivered and tp->delivered_ce	2026-04-18 11:10:12 -07:00
tcp_states.h
tcp.h	tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction	2026-05-20 19:14:06 -07:00
tcx.h
timewait_sock.h
tipc.h
tls_prot.h
tls_toe.h
tls.h
transp_v6.h	ipv6: Retire UDP-Lite.	2026-03-13 18:57:44 -07:00
tso.h	net: tso: Introduce tso_dma_map and helpers	2026-04-12 10:54:31 -07:00
tun_proto.h
udp_tunnel.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
udp.h	udp: Don't pass udptable to IPv4 socket lookup functions.	2026-03-13 18:57:46 -07:00
vsock_addr.h
vxlan.h
wext.h
x25.h
x25device.h
xdp_priv.h
xdp_sock_drv.h	xsk: respect tailroom for ZC setups	2026-04-06 18:43:51 -07:00
xdp_sock.h	xsk: fix XDP_UMEM_SG_FLAG issues	2026-04-06 18:43:51 -07:00
xdp.h
xfrm.h	xfrm: reduce struct sec_path size	2026-02-10 20:21:48 -08:00
xsk_buff_pool.h	xsk: remove repeated defines	2026-03-16 19:28:21 -07:00