On 7/8/18 10:53 PM, Lorenzo Colitti wrote: > On Sat, Jul 7, 2018 at 10:29 PM Eric Dumazet <eric.duma...@gmail.com> wrote: >>>> Tested: passes Android sock_diag_test.py, which exercises this codepath >>> >>> If this Android test case exercises this path, why didn't it trigger >>> the double free and thus cause this bug to be found much sooner? >>> >>> Just curious. >> >> Presumably android has not backported yet the refcount_t stuff in their >> kernels. > > That's correct. We only started seeing this on 4.14, which is not yet > in the field.
Prior to 4.12 syn-recv sockets did not show up in the list, so it could not be closed through the diag API. I did not chase it to a specific commit between 4.11 (no syn-recv in 'ss -ta') and 4.12 (syn-recv shows up in 'ss -ta').
