From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets
 in tcp_abort
Date: Sat, 7 Jul 2018 06:58:28 -0700
Message-ID: <aa156e24-d642-380b-bf83-cff911ceb034@gmail.com>
References: <20180707073140.202004-1-lorenzo@google.com>
 <20180707.221146.161981342461262899.davem@davemloft.net>
 <f3c8139d-ce4d-473a-b786-82ec7a7da7ce@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org, astrachan@google.com,
        subashab@codeaurora.org, dsa@cumulusnetworks.com
To: David Miller <davem@davemloft.net>, lorenzo@google.com
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pl0-f65.google.com ([209.85.160.65]:43201 "EHLO
        mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753173AbeGGN6a (ORCPT
        <rfc822;netdev@vger.kernel.org>); Sat, 7 Jul 2018 09:58:30 -0400
Received: by mail-pl0-f65.google.com with SMTP id c41-v6so4102903plj.10
        for <netdev@vger.kernel.org>; Sat, 07 Jul 2018 06:58:30 -0700 (PDT)
In-Reply-To: <f3c8139d-ce4d-473a-b786-82ec7a7da7ce@gmail.com>
Content-Language: en-US
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>



On 07/07/2018 06:29 AM, Eric Dumazet wrote:
> 
> 
> On 07/07/2018 06:11 AM, David Miller wrote:
>> From: Lorenzo Colitti <lorenzo@google.com>
>> Date: Sat,  7 Jul 2018 16:31:40 +0900
>>
>>> Tested: passes Android sock_diag_test.py, which exercises this codepath
>>
>> If this Android test case exercises this path, why didn't it trigger
>> the double free and thus cause this bug to be found much sooner?
>>
>> Just curious.
>>
> 
> Presumably android has not backported yet the refcount_t stuff in their kernels.
> 
> That is a guess though...
> 


Also maybe the confusion comes from the fact that it is not a double free,
but a use-after-free, which might cause a bug on kernels without
refcount_t saturation.