[PATCH] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[PATCH] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Yilin Zhang]

When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:

  BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
  Read of size 4 at addr ffff88800604d928 by task swapper/1/0
  Call Trace:
   tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
   tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
   tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Sync the hint to the copy.

Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue")
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Tested-by: Weiming Shi <shiweiming@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
 net/ipv4/tcp_output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3b320ee77..498c9819a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3694,6 +3694,7 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority,
 int tcp_send_synack(struct sock *sk)
 {
 	struct sk_buff *skb;
+	struct tcp_sock *tp = tcp_sk(sk);
 
 	skb = tcp_rtx_queue_head(sk);
 	if (!skb || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
@@ -3710,6 +3711,8 @@ int tcp_send_synack(struct sock *sk)
 			if (!nskb)
 				return -ENOMEM;
 			INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
+			if (skb == tp->retransmit_skb_hint)
+				tp->retransmit_skb_hint = nskb;
 			tcp_highest_sack_replace(sk, skb, nskb);
 			tcp_rtx_queue_unlink_and_free(skb, sk);
-- 
2.43.0

Re: [PATCH] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Jakub Kicinski]

On Sun, 20 Sep 2026 14:34:19 +0800 Yilin Zhang wrote:
> +			if (skb == tp->retransmit_skb_hint)
> +				tp->retransmit_skb_hint = nskb;
>  			tcp_highest_sack_replace(sk, skb, nskb);
>  			tcp_rtx_queue_unlink_and_free(skb, sk);
> -- 

this patch has been mangled, please repost if it's relevant
-- 
pw-bot: cr

Re: [PATCH] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Eric Dumazet]

On Sun, Sep 20, 2026 at 8:34 AM Yilin Zhang <yilinzhang@moonshot.ai> wrote:
>
> When tcp_send_synack() replaces the cloned SYN skb at the head of the
> retransmit queue with a copy, it frees the original with
> tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
> tp->retransmit_skb_hint keeps pointing at the freed
> skbuff_fclone_cache object.
>
> The dangling hint is read in tcp_verify_retransmit_hint() and used as
> the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
> unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
> an attacker-supplied ICMP fragmentation-needed message, after which a
> simultaneous open frees the armed SYN skb:
>
>   BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>   Read of size 4 at addr ffff88800604d928 by task swapper/1/0
>   Call Trace:
>    tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>    tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
>    tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Make sure to rebase your patches to latest net tree, not an old or
in-house kernel?
The context shows void tcp_send_active_reset(struct sock *sk, gfp_t
priority, at line 3694
rather than current net (line 3887, where tcp_send_active_reset()
takes enum sk_rst_reason reason).

>
> Sync the hint to the copy.
>
> Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue")

Seems not the right Fixes: tag to me?

c31b70c9968f (and 006f582c73f4 for the original omission) is more
historically accurate than 75c119afe14f.

> Reported-by: Kimi Security Team <bug-report@moonshot.ai>
> Tested-by: Weiming Shi <shiweiming@moonshot.ai>
> Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
> ---
>  net/ipv4/tcp_output.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> index 3b320ee77..498c9819a 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
> @@ -3694,6 +3694,7 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority,
>  int tcp_send_synack(struct sock *sk)
>  {
>         struct sk_buff *skb;
> +       struct tcp_sock *tp = tcp_sk(sk);

RCT (Reverse Christmas Tree) violation.

>
>         skb = tcp_rtx_queue_head(sk);
>         if (!skb || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
> @@ -3710,6 +3711,8 @@ int tcp_send_synack(struct sock *sk)
>                         if (!nskb)
>                                 return -ENOMEM;
>                         INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
> +                       if (skb == tp->retransmit_skb_hint)
> +                               tp->retransmit_skb_hint = nskb;
>                         tcp_highest_sack_replace(sk, skb, nskb);
>                         tcp_rtx_queue_unlink_and_free(skb, sk);
> --
> 2.43.0

Patch seems legit, please make sure to CC Kuniyuki Iwashima
<kuniyu@google.com> in V2

Thanks.

Re: [PATCH] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Eric Dumazet]

On Wed, Sep 23, 2026 at 4:49 AM Eric Dumazet <edumazet@google.com> wrote:
>
> Make sure to rebase your patches to latest net tree, not an old or
> in-house kernel?
> The context shows void tcp_send_active_reset(struct sock *sk, gfp_t
> priority, at line 3694
> rather than current net (line 3887, where tcp_send_active_reset()
> takes enum sk_rst_reason reason).

Ignore this part, I was looking at an old tree.

Make sure to not hand-edit patches before sending them.

[PATCH v2] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Yilin Zhang]

When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:

  BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
  Read of size 4 at addr ffff88800604d928 by task swapper/1/0
  Call Trace:
   tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
   tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
   tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Sync the hint to the copy.

Fixes: c31b70c9968f ("tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit")
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Tested-by: Weiming Shi <shiweiming@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
Changes in v2:
- Correct the Fixes: tag (Eric Dumazet).
---
 net/ipv4/tcp_output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index d960e3de7d50..e0c392e29de5 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3886,6 +3886,7 @@ void tcp_send_active_reset(struct sock *sk, enum sk_rst_reason reason)
  */
 int tcp_send_synack(struct sock *sk)
 {
+	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 
 	skb = tcp_rtx_queue_head(sk);
@@ -3903,6 +3904,8 @@ int tcp_send_synack(struct sock *sk)
 			if (!nskb)
 				return -ENOMEM;
 			INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
+			if (skb == tp->retransmit_skb_hint)
+				tp->retransmit_skb_hint = nskb;
 			tcp_highest_sack_replace(sk, skb, nskb);
 			tcp_rtx_queue_unlink_and_free(skb, sk);
 			__skb_header_release(nskb);
-- 
2.34.1

Re: [PATCH v2] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Eric Dumazet]

On Thu, Sep 24, 2026 at 6:49 AM Yilin Zhang <yilinzhang@moonshot.ai> wrote:
>
> When tcp_send_synack() replaces the cloned SYN skb at the head of the
> retransmit queue with a copy, it frees the original with
> tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
> tp->retransmit_skb_hint keeps pointing at the freed
> skbuff_fclone_cache object.
>
> The dangling hint is read in tcp_verify_retransmit_hint() and used as
> the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
> unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
> an attacker-supplied ICMP fragmentation-needed message, after which a
> simultaneous open frees the armed SYN skb:
>
>   BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>   Read of size 4 at addr ffff88800604d928 by task swapper/1/0
>   Call Trace:
>    tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
>    tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
>    tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
>
> Sync the hint to the copy.
>
> Fixes: c31b70c9968f ("tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit")
> Reported-by: Kimi Security Team <bug-report@moonshot.ai>
> Tested-by: Weiming Shi <shiweiming@moonshot.ai>
> Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
> ---
> Changes in v2:
> - Correct the Fixes: tag (Eric Dumazet).
> ---

Thanks for the fix.

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH v2] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 24 Sep 2026 12:49:00 +0800 you wrote:
> When tcp_send_synack() replaces the cloned SYN skb at the head of the
> retransmit queue with a copy, it frees the original with
> tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
> tp->retransmit_skb_hint keeps pointing at the freed
> skbuff_fclone_cache object.
> 
> The dangling hint is read in tcp_verify_retransmit_hint() and used as
> the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
> unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
> an attacker-supplied ICMP fragmentation-needed message, after which a
> simultaneous open frees the armed SYN skb:
> 
> [...]

Here is the summary with links:
  - [v2] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
    https://git.kernel.org/netdev/net/c/fe99bbeee5c5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html