Re: [PATCH net-next 2/6] vsock: add IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unreachable connections are forcefully closed without notifying the transport, causing zombie connections on the remote host.
--

commit f3fdca73a2fc67941333bcc7521ccf2e755bdfaf
Author: Bobby Eshleman <bobbyeshleman@meta.com>

vsock: add IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS

This commit introduces an ioctl to assign a guest's vsock device to a
specific network namespace. When the device moves to a disallowed namespace,
existing sockets are reset to prevent unauthorized reachability.

Link: https://lore.kernel.org/all/20200427142518.uwssa6dtasrp3bfc@steredhat/

> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 29cde17e08f31..ad11f0f56eb8a 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
[ ... ]
> @@ -710,6 +751,140 @@ bool vsock_find_cid(unsigned int cid)
[ ... ]
> +static void vsock_reset_unreachable_sock(struct sock *sk)
> +{
> +	if (vsock_g2h_net_reachable(sock_net(sk)))
> +		return;
> +
> +	sk->sk_state = TCP_CLOSE;
> +	sk->sk_err = ECONNRESET;
> +	sk_error_report(sk);
> +}

[Severity: High]
Does forcefully setting the socket state to TCP_CLOSE here prevent the
transport from notifying the remote host?

When the state is set directly to TCP_CLOSE, a transport's release function
(like virtio_transport_release()) may see the socket as already fully
terminated and skip sending a reset message (like VIRTIO_VSOCK_OP_RST) to
the host.

Since this ioctl can be triggered by a guest user with CAP_NET_ADMIN in the
init user namespace, could this lead to zombie connections accumulating on
the host hypervisor, potentially allowing a guest to exhaust host resources
because the host is never informed of the dropped connections?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-vsock-guest-ns-v1-0-9995383e9a8b@meta.com?part=2