Commit dbd62ad55a4c for kernel

commit dbd62ad55a4c898f5a4c9edb20c0c062afb799df
Author: Kyle Zeng <kylebot@openai.com>
Date:   Wed Oct 28 17:08:47 2026 +0100

    tcp: avoid double destroy in tcp_abort() of an unaccepted child

    tcp_abort() checks for TCP_CLOSE while only owning the socket lock,
    then grabs the BH lock before calling tcp_done_with_error().

    For a child still sitting in a listener accept queue (which can be
    reached via SOCK_DESTROY or bpf_sock_destroy()), inet_csk_listen_stop()
    can run in this window: it only holds the child BH lock, and calls
    inet_child_forget(), which disconnects, orphans and destroys the child.

    tcp_abort() then calls tcp_done_with_error() -> tcp_done(), which sees
    SOCK_DEAD and calls inet_csk_destroy_sock() a second time, leading to
    a double sock_put() and a use-after-free.

    Recheck TCP_CLOSE after acquiring the BH lock, unless we just closed
    a listener ourselves, in which case tcp_done_with_error() must still
    run to report the error.

    Note that the WARN_ON(sock_owned_by_user(child)) in
    inet_csk_listen_stop() can still trigger in this window.

    Fixes: bac76cf89816 ("tcp: fix forever orphan socket caused by tcp_abort")
    Signed-off-by: Kyle Zeng <kylebot@openai.com>
    [edumazet: recheck TCP_CLOSE under the BH lock instead of moving the test, smaller diff]
    Signed-off-by: Eric Dumazet <edumazet@kernel.org>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
    Link: https://patch.msgid.link/20261028160847.2170959-1-edumazet@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 76df69aa0115..0871886a34a2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -5127,6 +5127,8 @@ void tcp_done(struct sock *sk)
 int tcp_abort(struct sock *sk, int err)
 {
 	int state = inet_sk_state_load(sk);
+	bool listener = false;
+	int ret = 0;

 	if (state == TCP_NEW_SYN_RECV) {
 		struct request_sock *req = inet_reqsk(sk);
@@ -5161,21 +5163,31 @@ int tcp_abort(struct sock *sk, int err)
 	if (sk->sk_state == TCP_LISTEN) {
 		tcp_set_state(sk, TCP_CLOSE);
 		inet_csk_listen_stop(sk);
+		listener = true;
 	}

 	/* Don't race with BH socket closes such as inet_csk_listen_stop. */
 	local_bh_disable();
 	bh_lock_sock(sk);

+	/* An unaccepted child might have been closed by
+	 * inet_csk_listen_stop() while we were not holding its BH lock.
+	 */
+	if (!listener && sk->sk_state == TCP_CLOSE) {
+		ret = -ENOENT;
+		goto out;
+	}
+
 	if (tcp_need_reset(sk->sk_state))
 		tcp_send_active_reset(sk, SK_RST_REASON_TCP_STATE);
 	tcp_done_with_error(sk, err);

+out:
 	bh_unlock_sock(sk);
 	local_bh_enable();
 	if (!has_current_bpf_ctx())
 		release_sock(sk);
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(tcp_abort);