Subject: Re: Crash when receiving FIN-ACK in TCP_FIN_WAIT1 state

From: Subash Abhinov Kasiviswanathan <[email-masked]>
Date: Sun, 20 Oct 2019 17:15:49 -0600

> Hmm. Random related thought while searching for a possible cause: I
> wonder if tcp_write_queue_purge() should clear tp->highest_sack (and
> possibly tp->sacked_out)? The tcp_write_queue_purge() code is careful
> to call  tcp_clear_all_retrans_hints(tcp_sk(sk)) and I would imagine
> that similar considerations would imply that we should clear at least
> tp->highest_sack?
> 
> neal

Hi Neal

If the socket is in FIN-WAIT1, does that mean that all the segments
corresponding to SACK blocks are sent and ACKed already?

tp->sacked_out is non zero in all these crashes (is the SACK information
possibly invalid or stale here?).

-- 
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project