After listen() + shutdown(), a TCP socket is moved to the closed section of its reuseport group, while TCP_NEW_SYN_RECV requests can still reference it as rsk_listener. If SO_ATTACH_REUSEPORT_[CE]BPF is then used on this socket, reuseport_attach_prog() calls reuseport_alloc(), which resurrects it into the listening section of a new group, even though the socket is still in TCP_CLOSE. After close(), the socket stays in that group and the pending requests keep it allocated. When the final ACK arrives, reuseport_migrate_sock() can select this dead socket and inet_csk_clone_lock() clones it. With a ULP like espintcp installed while in TCP_CLOSE, the child inherits icsk_ulp_data and sk_destruct after tcp_cleanup_ulp() cleared icsk_ulp_ops, leading to a use-after-free in espintcp_destruct(). As done in commit 8cc3aef0cb19 ("tcp: Do not allow buggy transitions between ehash and lhash2."), deny this transition instead of adding checks to the fast path. Only an unhashed former listener is affected. Applications can still attach a reuseport prog to a socket that never listened, or to a listener (including one that called listen() again after shutdown()). Fixes: 333bb73f620e ("tcp: Keep TCP_CLOSE sockets in the reuseport group.") Reported-by: Kyle Zeng Signed-off-by: Eric Dumazet --- net/core/sock_reuseport.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c index fccbdd0430b05984e82c19b17b6b723b0a3a03a1..41a25be1bfff6aa486f33ed563a093a264c49344 100644 --- a/net/core/sock_reuseport.c +++ b/net/core/sock_reuseport.c @@ -6,6 +6,7 @@ * selecting the socket index from the array of available sockets. */ +#include #include #include #include @@ -692,6 +693,14 @@ int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog) if (!sk->sk_reuseport) return -EINVAL; + /* Do not put a shutdown()ed TCP listener back into the + * listening section of a reuseport group while it is in + * TCP_CLOSE: requests can still migrate to it. + */ + if (sk->sk_protocol == IPPROTO_TCP && + inet_csk(sk)->unhashed_state == TCP_LISTEN) + return -EINVAL; + err = reuseport_alloc(sk, false); if (err) return err; -- 2.53.0