Re: [PATCH v2] vsock/hv_sock: don't finish a connection on a socket being released

[sashiko-bot@kernel.org]

> hvs_open_connection() only checks sk->sk_state (TCP_LISTEN for a
> host-initiated connection, TCP_SYN_SENT for a guest-initiated one) before
> proceeding. __vsock_release() sets sk->sk_shutdown = SHUTDOWN_MASK and, for
> a listener, flushes the accept queue, while leaving sk_state unchanged. A
> VMBUS channel offer that races close() therefore still passes the state
> check and either enqueues a child onto the already-flushed accept queue
> (conn_from_host) or completes a connection on a socket being torn down
> (!conn_from_host); the socket and its VMBUS channel then leak.
> 
> The virtio transport guards the listener case in
> virtio_transport_recv_listen(); hv_sock has no equivalent. Add a
> sk_shutdown == SHUTDOWN_MASK check to the common path right after
> lock_sock(), so both the host- and guest-initiated paths bail out.
> hv_sock holds lock_sock(sk) across hvs_open_connection(), so the check is
> race-free.
> 
> This was found by code inspection; I do not have Hyper-V hardware to test on.
> 
> Fixes: ae0078fcf0a5 ("hv_sock: implements Hyper-V transport for Virtual Sockets (AF_VSOCK)")
> Signed-off-by: Bartłomiej Dmitruk <bartlomiej.dmitruk@isec.pl>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919123128.28868-1-bartlomiej.dmitruk@isec.pl?part=1