A socket whose connect() failed keeps sk_err set. If that socket is later reused as a listener, vsock_accept() rejects an unrelated incoming connection, and on virtio/hyperv the resulting child socket is leaked.
Patch 1 removes the listener's sk_err check from vsock_accept(), since no vsock transport ever sets sk_err on a TCP_LISTEN socket. This will fix what the syzbot reported. Patch 2 removes vsock_sock.rejected, now unreachable after patch 1. Patch 3 is a related but separate fix: vsock_connect() now consumes sk_err via sock_error() once it has been returned to userspace, so a failed blocking connect() doesn't keep reporting the same error a second time. --- Changes in v5: - Split into a series - Remove the now-unused rejected flag from vsock_sock v4: https://lore.kernel.org/netdev/[email protected]/ - Remove sk_err checks from vsock_accept() v3: https://lore.kernel.org/netdev/[email protected]/ - Fix truncated title and add annotations to reproducer steps. v2: https://lore.kernel.org/netdev/[email protected]/ - Add reproducer steps to commit message. v1: https://lore.kernel.org/netdev/[email protected]/ Nguyen Dinh Phi (3): vsock: don't check the listener's sk_err in vsock_accept() vsock: remove the now-unused rejected flag vsock: use sock_error() to consume sk_err after a failed connect include/net/af_vsock.h | 5 +--- net/vmw_vsock/af_vsock.c | 62 +++++++++++++--------------------------- 2 files changed, 21 insertions(+), 46 deletions(-) -- 2.53.0
