Re: [PATCH v2] vsock/hv_sock: don't finish a connection on a socket being released

[Stefano Garzarella <sgarzare@redhat.com>]

On Sat, Sep 19, 2026 at 02:31:27PM +0200, Bartłomiej Dmitruk wrote:
>hvs_open_connection() only checks sk->sk_state (TCP_LISTEN for a
>host-initiated connection, TCP_SYN_SENT for a guest-initiated one) before
>proceeding. __vsock_release() sets sk->sk_shutdown = SHUTDOWN_MASK and, for
>a listener, flushes the accept queue, while leaving sk_state unchanged. A
>VMBUS channel offer that races close() therefore still passes the state
>check and either enqueues a child onto the already-flushed accept queue
>(conn_from_host) or completes a connection on a socket being torn down
>(!conn_from_host); the socket and its VMBUS channel then leak.
>
>The virtio transport guards the listener case in
>virtio_transport_recv_listen(); hv_sock has no equivalent. Add a
>sk_shutdown == SHUTDOWN_MASK check to the common path right after
>lock_sock(), so both the host- and guest-initiated paths bail out.
>hv_sock holds lock_sock(sk) across hvs_open_connection(), so the check is
>race-free.
>
>This was found by code inspection; I do not have Hyper-V hardware to test on.
>
>Fixes: ae0078fcf0a5 ("hv_sock: implements Hyper-V transport for Virtual Sockets (AF_VSOCK)")
>Signed-off-by: Bartłomiej Dmitruk <bartlomiej.dmitruk@isec.pl>
>---
>v2: move the SHUTDOWN_MASK check to the common checks after lock_sock() so it
>    also covers the guest-initiated (!conn_from_host) path; add Fixes tag
>    (Stefano Garzarella).
>v1: https://lore.kernel.org/netdev/20260917220156.56015-1-bartlomiej.dmitruk@isec.pl/
>

About v1, I see sashiko reporting some pre-existing issues
https://lore.kernel.org/netdev/179003264046.2160803.3176959842906352107@kernel.org/

The critical one seems real, can you check?
Maybe it should be fixed before this change.

Stefano

>diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
>--- a/net/vmw_vsock/hyperv_transport.c
>+++ b/net/vmw_vsock/hyperv_transport.c
>@@ -322,6 +322,15 @@
> 	    (!conn_from_host && sk->sk_state != TCP_SYN_SENT))
> 		goto out;
>
>+	/* __vsock_release() may have already set sk_shutdown = SHUTDOWN_MASK
>+	 * (and, for a listener, flushed the accept queue) while leaving the
>+	 * socket in TCP_LISTEN/TCP_SYN_SENT.  Proceeding would enqueue a child
>+	 * onto a released listener, or complete a connection on a released
>+	 * socket, leaking it and its VMBUS channel.
>+	 */
>+	if (sk->sk_shutdown == SHUTDOWN_MASK)
>+		goto out;
>+
> 	if (conn_from_host) {
> 		if (sk_acceptq_is_full(sk))
> 			goto out;
>