Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort

[Eric Dumazet]

On 07/07/2018 06:29 AM, Eric Dumazet wrote:
> 
> 
> On 07/07/2018 06:11 AM, David Miller wrote:
>> From: Lorenzo Colitti <lore...@google.com>
>> Date: Sat,  7 Jul 2018 16:31:40 +0900
>>
>>> Tested: passes Android sock_diag_test.py, which exercises this codepath
>>
>> If this Android test case exercises this path, why didn't it trigger
>> the double free and thus cause this bug to be found much sooner?
>>
>> Just curious.
>>
> 
> Presumably android has not backported yet the refcount_t stuff in their 
> kernels.
> 
> That is a guess though...
> 


Also maybe the confusion comes from the fact that it is not a double free,
but a use-after-free, which might cause a bug on kernels without
refcount_t saturation.