Re: Fw: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master]

Hello, I'm fuzzing with your patch applied, and I don't see the issue
triggering anymore, (or other related)

I will keep you updated if something pops up, so we can fix before pushing

Marco

On Wed, Aug 17, 2016 at 4:32 AM, Cong Wang [off-list ref] wrote:

On Tue, Aug 16, 2016 at 1:27 PM, Eric Dumazet [off-list ref] wrote:

quoted

And tcp_add_write_queue_tail() looks like :


static inline void tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb)
{
        __tcp_add_write_queue_tail(sk, skb);

        /* Queue it, remembering where we must start sending. */
        if (sk->sk_send_head == NULL) {
                sk->sk_send_head = skb;

                if (tcp_sk(sk)->highest_sack == NULL)
                        tcp_sk(sk)->highest_sack = skb;
        }
}

Ah, I never looked into tcp_add_write_queue_tail()...

So this bug seems exist after commit 6859d49475d4f32abe640372117e4b...