Re: Fw: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master]
From: Cong Wang <hidden>
Date: 2016-08-16 20:33:19
On Tue, Aug 16, 2016 at 1:27 PM, Eric Dumazet [off-list ref] wrote:
And tcp_add_write_queue_tail() looks like :
static inline void tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb)
{
__tcp_add_write_queue_tail(sk, skb);
/* Queue it, remembering where we must start sending. */
if (sk->sk_send_head == NULL) {
sk->sk_send_head = skb;
if (tcp_sk(sk)->highest_sack == NULL)
tcp_sk(sk)->highest_sack = skb;
}
}Ah, I never looked into tcp_add_write_queue_tail()... So this bug seems exist after commit 6859d49475d4f32abe640372117e4b...