From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets
 in tcp_abort
Date: Sat, 7 Jul 2018 06:29:39 -0700
Message-ID: <f3c8139d-ce4d-473a-b786-82ec7a7da7ce@gmail.com>
References: <20180707073140.202004-1-lorenzo@google.com>
 <20180707.221146.161981342461262899.davem@davemloft.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org, astrachan@google.com,
        subashab@codeaurora.org, eric.dumazet@gmail.com,
        dsa@cumulusnetworks.com
To: David Miller <davem@davemloft.net>, lorenzo@google.com
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pf0-f194.google.com ([209.85.192.194]:33581 "EHLO
        mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S932338AbeGGN3l (ORCPT
        <rfc822;netdev@vger.kernel.org>); Sat, 7 Jul 2018 09:29:41 -0400
Received: by mail-pf0-f194.google.com with SMTP id b17-v6so10565033pfi.0
        for <netdev@vger.kernel.org>; Sat, 07 Jul 2018 06:29:41 -0700 (PDT)
In-Reply-To: <20180707.221146.161981342461262899.davem@davemloft.net>
Content-Language: en-US
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>



On 07/07/2018 06:11 AM, David Miller wrote:
> From: Lorenzo Colitti <lorenzo@google.com>
> Date: Sat,  7 Jul 2018 16:31:40 +0900
> 
>> Tested: passes Android sock_diag_test.py, which exercises this codepath
> 
> If this Android test case exercises this path, why didn't it trigger
> the double free and thus cause this bug to be found much sooner?
> 
> Just curious.
> 

Presumably android has not backported yet the refcount_t stuff in their kernels.

That is a guess though...