On 07/09/2018 07:59 AM, David Ahern wrote:
> On 7/8/18 10:53 PM, Lorenzo Colitti wrote:
>> On Sat, Jul 7, 2018 at 10:29 PM Eric Dumazet <eric.duma...@gmail.com> wrote:
>>>>> Tested: passes Android sock_diag_test.py, which exercises this codepath
>>>>
>>>> If this Android test case exercises this path, why didn't it trigger
>>>> the double free and thus cause this bug to be found much sooner?
>>>>
>>>> Just curious.
>>>
>>> Presumably android has not backported yet the refcount_t stuff in their
>>> kernels.
>>
>> That's correct. We only started seeing this on 4.14, which is not yet
>> in the field.
>
> Prior to 4.12 syn-recv sockets did not show up in the list, so it could
> not be closed through the diag API. I did not chase it to a specific
> commit between 4.11 (no syn-recv in 'ss -ta') and 4.12 (syn-recv shows
> up in 'ss -ta').
>
I suggest you look more closely to tcp_abort(), the function you changed
in commit d7226c7a4dd1 (linux-4.8)
Then you will see it had support for syn-recv since linux-4.5
So I do not understand your 4.11/4.12 mentions at all.
"ss -ta" always had dumped syn-recv request sockets.
