On 09/27/2018 05:16 PM, stranche@codeaurora.org wrote:

Hi Yuchung,

Based on the dumps we were able to get, it appears that TFO was not used in this case.
We also tried some local experiments where we dropped incoming SYN packets after already
successful TFO connections on the receive side to see if TFO would trigger this scenario, but
have not been able to reproduce it.

One other interesting thing we found is that the socket never sent or received any data. It only
sent/received the packets for the initial handshake and the outgoing FIN.

Just to make sure : Was this some sort of syzkaller (or other fuzzer) run ?