Re: [PATCH net-next 2/6] vsock: add IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS

[Bobby Eshleman <bobbyeshleman@gmail.com>]

On Thu, Sep 03, 2026 at 11:01:46PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Unreachable connections are forcefully closed without notifying the transport, causing zombie connections on the remote host.
> --
> 
> commit f3fdca73a2fc67941333bcc7521ccf2e755bdfaf
> Author: Bobby Eshleman <bobbyeshleman@meta.com>
> 
> vsock: add IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS
> 
> This commit introduces an ioctl to assign a guest's vsock device to a
> specific network namespace. When the device moves to a disallowed namespace,
> existing sockets are reset to prevent unauthorized reachability.
> 
> Link: https://lore.kernel.org/all/20200427142518.uwssa6dtasrp3bfc@steredhat/
> 
> > diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> > index 29cde17e08f31..ad11f0f56eb8a 100644
> > --- a/net/vmw_vsock/af_vsock.c
> > +++ b/net/vmw_vsock/af_vsock.c
> [ ... ]
> > @@ -710,6 +751,140 @@ bool vsock_find_cid(unsigned int cid)
> [ ... ]
> > +static void vsock_reset_unreachable_sock(struct sock *sk)
> > +{
> > +	if (vsock_g2h_net_reachable(sock_net(sk)))
> > +		return;
> > +
> > +	sk->sk_state = TCP_CLOSE;
> > +	sk->sk_err = ECONNRESET;
> > +	sk_error_report(sk);
> > +}
> 
> [Severity: High]
> Does forcefully setting the socket state to TCP_CLOSE here prevent the
> transport from notifying the remote host?
> 
> When the state is set directly to TCP_CLOSE, a transport's release function
> (like virtio_transport_release()) may see the socket as already fully
> terminated and skip sending a reset message (like VIRTIO_VSOCK_OP_RST) to
> the host.
> 
> Since this ioctl can be triggered by a guest user with CAP_NET_ADMIN in the
> init user namespace, could this lead to zombie connections accumulating on
> the host hypervisor, potentially allowing a guest to exhaust host resources
> because the host is never informed of the dropped connections?

This only happens if the host-side socket is completely idle. The next
pkt will trigger virtio_transport_recv_pkt() to respond with RST. This
is the same thing that happens after VIRTIO_VSOCK_EVENT_TRANSPORT_RESET
or virtio_vsock_vqs_del().

Best,
Bobby