A valid SYN that matches a TIME_WAIT socket is redirected to the listener with a non-zero tcp_tw_isn. tcp_conn_request() deliberately exempts those requests from normal SYN queue throttling. A peer can therefore create victim-side TIME_WAIT entries with short connections, replay valid reopen SYNs, and withhold the final ACK to allocate request_sock objects outside the listener's normal SYN-flood controls. Do not send syncookies for this path: tcp_timewait_state_process() derives tcp_tw_isn from tw_snd_nxt so that a direct reopen uses an ISN after the prior connection's sequence space. A syncookie ISN is a hash-derived value and has no such ordering guarantee. Check the selected listener's SYN queue before descheduling the TIME_WAIT socket. If it is full, account a request-queue drop, retain the TIME_WAIT socket, and discard the SYN. Once the queue has room, the existing direct-reopen path and its TIME_WAIT ISN are unchanged. Normal SYNs continue to use syncookies when the listener is full. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: Claude-Code:GLM-5.2-special Signed-off-by: Yizhou Zhao --- net/ipv4/tcp_ipv4.c | 8 ++++++++ net/ipv6/tcp_ipv6.c | 9 +++++++++ 2 files changed, 17 insertions(+) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 209ef7522508fcc3974ae71d35dd66cba96b73d0..ddb5daede802d355b51b802b29b2e1ead3597bd2 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -2310,6 +2310,14 @@ int tcp_v4_rcv(struct sk_buff *skb) inet_iif(skb), sdif); if (sk2) { + if (inet_csk_reqsk_queue_is_full(sk2)) { + drop_reason = SKB_DROP_REASON_TCP_LISTEN_OVERFLOW; + __NET_INC_STATS(net, LINUX_MIB_TCPREQQFULLDROP); + tcp_listendrop(sk2); + inet_twsk_put(inet_twsk(sk)); + goto discard_it; + } + inet_twsk_deschedule_put(inet_twsk(sk)); sk = sk2; tcp_v4_restore_cb(skb); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index ebe161d72fbd07a13d92812b45b5a3ce2464a015..8d3ff7184d03f5dd81f9a9c20e3ebbf174efc43a 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1969,6 +1969,15 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) sdif); if (sk2) { struct inet_timewait_sock *tw = inet_twsk(sk); + + if (inet_csk_reqsk_queue_is_full(sk2)) { + drop_reason = SKB_DROP_REASON_TCP_LISTEN_OVERFLOW; + __NET_INC_STATS(net, LINUX_MIB_TCPREQQFULLDROP); + tcp_listendrop(sk2); + inet_twsk_put(tw); + goto discard_it; + } + inet_twsk_deschedule_put(tw); sk = sk2; tcp_v6_restore_cb(skb); -- 2.47.3