From nobody Fri Sep 25 07:22:57 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE2A73B47DF; Tue, 15 Sep 2026 13:16:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478195; cv=none; b=ncImXzMqDfhSMYGFjyw38VRCHWITZ4FKDVDAefnMwye1R2hu/wtpUwRvlnZxRcndpz5qbu4zud4zRV+4WxqI2ESojMtx2XpdnIPe11zU05ZNzMlBj3XZVY+1N/VHSjhiDyE2WaP0Oo10K66DpSuQa1hbey0TqdbMij0QJ/M9ZfM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478195; c=relaxed/simple; bh=DxEAvBYs0BJ/VwmHJw7e2YAIz8OzlYW20LcmBo40dPQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=VvjzOm+/5AgiQEzoXri63InCFzx+ftVvCzLppCa0u+sGkqKC+Q+Br3QNYlPWENZVfjLmsrP2rhBNT+A958gTqDnUDH3+HbdGCcWonPI8WXpKsVlbqGSJTvlqJJx/tgDt8aKXwHiQPOZey/RP2yBEJ3yCZsUdKgVT6Bx4mKZoL8c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=ZONxWi8G; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="ZONxWi8G" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x6T0c-00HRCg-Od; Tue, 15 Sep 2026 15:15:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=96jbmB9W+tKz2zIt1w43a9vt7j7LmrljAaRgMAl32vs=; b=ZONxWi8GXwK6TzSwTtChwprtbY UwlxnfPaFRHHrxSxI7AXXXlVFl51Ba4vwdDS86aL5rgkIFDg4D6Ysycw2XswTpp5BZ6Yb5F3zuKAN 3su2DUF4aOvhKNpTqSTsjLzRqdCp3/eh9YHJjw7J+nJAtlsK3j2UyIhvZxpDDx6sHXa20uXf+qSdL xbFJB1BCTvWg42UtwxK5Tq/EaaCzWlsCaX2cnuMYJ32P9Lji2j0WBcRn6KmgxAh/mABUKQ+RfBdEz PwJCPCOjn819Fi/XJ7y5GQgin7bypO4yKxMlsB9N26uLVGJvC3CuEa+r+wsau2aTsbFRN1UTIKO7D A1RJZLiA==; Received: from [10.9.9.72] (helo=submission01.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x6T0X-0003iV-4p; Tue, 15 Sep 2026 15:15:33 +0200 Received: by submission01.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x6T0I-00EUxD-5j; Tue, 15 Sep 2026 15:15:18 +0200 From: Michal Luczaj Date: Tue, 15 Sep 2026 15:15:12 +0200 Subject: [PATCH net v2 1/5] vhost/vsock: Fix socket state constant Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260915-vsock-connect-reset-closing-v2-1-a1d9abb472f7@rbox.co> References: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> In-Reply-To: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> To: Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , "David S. Miller" , Xuan Zhuo , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Asias He Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 Refactor under Fixes missed one: SS_UNCONNECTED (1) -> TCP_CLOSE (7). Until now, sk->sk_state =3D 1 stood for TCP_ESTABLISHED. Fixes: 3b4477d2dcf2 ("VSOCK: use TCP state constants for sk_state") Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella --- drivers/vhost/vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index abed1fbcf66c..6051533456f6 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -774,7 +774,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk) =20 sock_set_flag(sk, SOCK_DONE); vsk->peer_shutdown =3D SHUTDOWN_MASK; - sk->sk_state =3D SS_UNCONNECTED; + sk->sk_state =3D TCP_CLOSE; sk->sk_err =3D ECONNRESET; sk_error_report(sk); } --=20 2.55.0 From nobody Fri Sep 25 07:22:57 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF5793BBFAA; Tue, 15 Sep 2026 13:16:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478178; cv=none; b=QPu1oMXahUPJMJaMeZL+aAUZJm0zMlbPU2/Kc2Z5gMQ7FpttOZpw3hukff2DjOVtfdvO1IL5cMpPwNZSzA/m+Z7Fcq8FeN/UXoanb8Dk3J+uUQO6mLa05c8nnsVBsn1gzi7MpH7TAGv4imlzlzX/m5+3xzj94TRrSXC72R9Wa00= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478178; c=relaxed/simple; bh=OW/j0OV6/KFGgiFnuDflzDHt28f867c5Hch7mrGWrqo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DPBmli5kc3dv1HgcE9Url0g9oyg/8deEN4lHvE6YQEIM4XBtMSGsDiPEOv+ZT3l9xbOMah9pmWh5bCaC9ytiMdhx6H8d23N+E3khdJga6vVuRjUd1uKM8GW52qzRsY+3JTO5C5rcSwaFT16ew0q9MUFmj261jyxPDEoD8m4qgao= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=g9yMXBMG; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="g9yMXBMG" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x6T0c-00HRCh-Oa; Tue, 15 Sep 2026 15:15:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=J6FJXLnbQMTSTvXFFwXmON3Rzv+eNvV2Q3NtjngzJY4=; b=g9yMXBMG8bE9YUnCJlIfgZmdA1 SD1b07fCA8JfcpmPFrbthPLdeUdvsCYYh7zFzT6w50UgM3jkAVXdUnc3mtXhvx343pV1oHXiHKzYN ejGv4vHQiEeU8Asv2GoXRCBuyPMB1AR/+euFdVo0iF9MaZMkRtXipv97iMVO9dbGpilTo3LLiGf2U T5NVsMai/GuKVhwPliOkOKIiU8vXEQUiE+p0c5KqiJKXYpUHwGTy4LRD6z/y5kKvSCLrc89B9OQYl 2VYKrvu6AecSd2xQxSeQqSeu04OCR7PkIJ9ml90GwHdgSJqvCLJc6PDuIz4QvHa0g27f0TCV7RaR6 yROKDoog==; Received: from [10.9.9.72] (helo=submission01.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x6T0W-0003iI-B1; Tue, 15 Sep 2026 15:15:32 +0200 Received: by submission01.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x6T0J-00EUxD-21; Tue, 15 Sep 2026 15:15:19 +0200 From: Michal Luczaj Date: Tue, 15 Sep 2026 15:15:13 +0200 Subject: [PATCH net v2 2/5] vsock/virtio: Streamline socket reset on transport/PM event Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260915-vsock-connect-reset-closing-v2-2-a1d9abb472f7@rbox.co> References: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> In-Reply-To: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> To: Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , "David S. Miller" , Xuan Zhuo , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Asias He Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 Follow vhost's vhost_vsock_reset_orphans() and VMCI's vmci_transport_handle_detach(): set SHUTDOWN_MASK, which will come handy later in the series. Note that commit c38f57da428b ("vhost/vsock: fix reset orphans race with close timeout") fixed a race between pending close timer, i.e. virtio_transport_close_timeout(), and a transport/PM reset. But here we never set SOCK_DONE, hence no race. Fixes: 0ea9e1d3a9e3 ("VSOCK: Introduce virtio_transport.ko") Signed-off-by: Michal Luczaj --- net/vmw_vsock/virtio_transport.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transp= ort.c index 4f9aa9c4c3aa..4d6991321699 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -413,11 +413,14 @@ static void virtio_vsock_event_fill(struct virtio_vso= ck *vsock) =20 static void virtio_vsock_reset_sock(struct sock *sk) { + struct vsock_sock *vsk =3D vsock_sk(sk); + /* vmci_transport.c doesn't take sk_lock here either. At least we're * under vsock_table_lock so the sock cannot disappear while we're * executing. */ =20 + vsk->peer_shutdown =3D SHUTDOWN_MASK; sk->sk_state =3D TCP_CLOSE; sk->sk_err =3D ECONNRESET; sk_error_report(sk); --=20 2.55.0 From nobody Fri Sep 25 07:22:57 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E30513BBFC3; Tue, 15 Sep 2026 13:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478188; cv=none; b=iOukQz4dm8m2SpjUKjITGYAB+192qeEv8x75ksE3Yhdhsf7DMRZXi7QnwDVv0N7MsAschIUPY/9ALZQT3z5A8870426ToZy5UWqH+zlXp9chp1Z7S7jt620lGMdGbneF6Gs9M+BQ9sW3k+//6Y4IiHJX2YreJ3PQv6wSzRUfnHg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478188; c=relaxed/simple; bh=y7KsFyyKmTeubh6XFgZvaa8BZGB1esOoaDfWjXi4gwM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=tXBDa82WJFCwW1ULoiEbyyAX0WBBEBVzyJjcTDCJTi7fguf/YLCN+e24onrQg7RSZY9D+WKA/teYdzUN2p6kjquJHByi8eWpIuYFhxvNTR6hCcECMBI1fqO8P83cJDXLbhJK0le90DCAFgajk288TJr8XIwqnFOXtc/pexJ5f44= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=fE18l4fj; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="fE18l4fj" Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x6T0h-00HRDO-Ly; Tue, 15 Sep 2026 15:15:43 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=DeuOQ/YCzV1GKBzzkSDT/ZbSmyFHC1MB2bRkPBvNDS4=; b=fE18l4fj8+zzEPCsgPaxonUVGD rQttQ0mMtGEJiagUL+QUhvKEAp4VpV1rFPjSsIwkjLhFWMdocUxkad0fnPiXswSGeqOsOElIQLkub 64MWl8650xrpPoK3iF+1psjN7jQVLxxU6IR6cs0CJ/Pkvbl3hC8f3BSIdtMiTO2CGUYxj5V4KgIC9 OUEvq3UpmLAztIZPGnemAIXOn/2AWlqMiO19tObMNFpHtebw9ZVoaBaAGnVlCzyTTYKCUIG/yFE9Y owh8GisBp+AOriJXTWeZjNtkaQrdoTJZNyJmQ7slHwj0A6YDPDjqUodZCeyNZu/gZbOIa6yYWdyI6 +to190gA==; Received: from [10.9.9.72] (helo=submission01.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x6T0W-0002tu-G0; Tue, 15 Sep 2026 15:15:32 +0200 Received: by submission01.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x6T0J-00EUxD-TR; Tue, 15 Sep 2026 15:15:20 +0200 From: Michal Luczaj Date: Tue, 15 Sep 2026 15:15:14 +0200 Subject: [PATCH net v2 3/5] vsock: Enforce no-transport invariant for TCP_LISTEN sockets Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260915-vsock-connect-reset-closing-v2-3-a1d9abb472f7@rbox.co> References: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> In-Reply-To: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> To: Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , "David S. Miller" , Xuan Zhuo , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Asias He Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 A non-blocking connect() running in parallel with a blocking connect(), combined with a racy listen() that hits right after a connect timeout: TCP_SYN_SENT -> TCP_CLOSE -> TCP_LISTEN, while the connect() loop is still in progress. Enforce the invariant. Prevent a socket from becoming a listener after acquiring a transport. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Signed-off-by: Michal Luczaj --- net/vmw_vsock/af_vsock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index f840498b58af..499e902becfa 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1973,13 +1973,13 @@ static int vsock_listen(struct socket *sock, int ba= cklog) goto out; } =20 - if (sock->state !=3D SS_UNCONNECTED) { + vsk =3D vsock_sk(sk); + + if (sock->state !=3D SS_UNCONNECTED || vsk->transport) { err =3D -EINVAL; goto out; } =20 - vsk =3D vsock_sk(sk); - if (!vsock_addr_bound(&vsk->local_addr)) { err =3D -EINVAL; goto out; --=20 2.55.0 From nobody Fri Sep 25 07:22:57 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4F433C09FB; Tue, 15 Sep 2026 13:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478215; cv=none; b=Wcuo6E849xX2+3RCaFld/SDBV1j8/5EPHuiyQcL2ncPel52qkImBBg9gqn3q4QAtEOxWvdykDwoZSoJbfjpDTBGzIJIVUyF07q3SHVYc+LZ8BwDuJF3oTBZCGVtSWy2Uawuy4saKEh1j6mioz5iV6cj5q+8Ka7I/qTyWwJsMieA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478215; c=relaxed/simple; bh=830GKS+GZtQTrD/nVgYFtmMVvy37u5IuYvM2ZtboDHs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Y7Y+Jqh2pqHLtJ0n7nR8C4L6IHASoJFBSUMK0F8BVci4os4gQSP7AWMBJURF905xwHTflOsq3UWYddaPGKBuCpDuvgI2iiGtt3/Z7I6xtvjGKpQd2jD+RPjEVpcseCR7CqcU/vD+rwnNSiNF2WklNNlJMHMHuzBwQrpxbCr3dFo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=AO5TaTGi; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="AO5TaTGi" Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x6T0c-00HRCi-PC; Tue, 15 Sep 2026 15:15:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=b3mQkrs76zO1JPC/v9TSuze2uQXUW1ZUbIhJvl/5BfQ=; b=AO5TaTGidN0NdVy5auvyz5Cq7u kBWUMLOtvHB46UBw9CVhmeRvCyWijmK2sLNRmMFUfqi45R+C+1fMlUXYQT2va8nD0PSTnv6U51+Y+ /q2BcS7iUuUScWgGv/MUtsFuEUvXCz+xi6JNVrt3oDdZ3hF+eztrkNeI1VhaLb1p3xbMR1MyBfKbq STilCmF2ZZikq0wSzIlYPRJAIkcX0vKEh0b30gMLPfqFXNm8VeTKUtrm/U+E0aVvwCAxBcm2rlqSK MKVJ5qwky4BrDXnkYSCw59TJ78Na4sSIOW9FcVt+WSWGXt1PuiqdMTND9WAljRjCjvEErWj5bx7KP dqz3lazg==; Received: from [10.9.9.72] (helo=submission01.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x6T0W-0002ty-OE; Tue, 15 Sep 2026 15:15:32 +0200 Received: by submission01.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x6T0K-00EUxD-QM; Tue, 15 Sep 2026 15:15:20 +0200 From: Michal Luczaj Date: Tue, 15 Sep 2026 15:15:15 +0200 Subject: [PATCH net v2 4/5] vsock: Do not reset a TCP_CLOSING socket Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260915-vsock-connect-reset-closing-v2-4-a1d9abb472f7@rbox.co> References: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> In-Reply-To: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> To: Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , "David S. Miller" , Xuan Zhuo , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Asias He Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Hyunwoo Kim , Michal Luczaj X-Mailer: b4 0.15.2 Handle the previously overlooked TCP_ESTABLISHED -> TCP_CLOSING transition (on VIRTIO_VSOCK_OP_RST), which could race with the connect loop. Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=3D, prev=3D, next=3D. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 Drop the redundant err=3D0 and the inaccurate comment above signal_pending(= ). This fix is supplementary to commit 002541ef650b ("vsock: Ignore signal/timeout on connect() if already established"). Details under Link. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Hyunwoo Kim Link: https://lore.kernel.org/netdev/anzT1fREOSyHT99k@v4bel/ Signed-off-by: Michal Luczaj --- net/vmw_vsock/af_vsock.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 499e902becfa..adf3f018347e 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1712,7 +1712,6 @@ static int vsock_connect(struct socket *sock, struct = sockaddr_unsized *addr, long timeout; DEFINE_WAIT(wait); =20 - err =3D 0; sk =3D sock->sk; vsk =3D vsock_sk(sk); =20 @@ -1834,23 +1833,22 @@ static int vsock_connect(struct socket *sock, struc= t sockaddr_unsized *addr, timeout =3D schedule_timeout(timeout); lock_sock(sk); =20 - /* Connection established. Whatever happens to socket once we - * release it, that's not connect()'s concern. No need to go + /* Connection was established. Whatever happens to socket once + * we release it, that's not connect()'s concern. No need to go * into signal and timeout handling. Call it a day. * * Note that allowing to "reset" an already established socket * here is racy and insecure. */ - if (sk->sk_state =3D=3D TCP_ESTABLISHED) - break; + if (sk->sk_state =3D=3D TCP_ESTABLISHED || + sk->sk_state =3D=3D TCP_CLOSING) { + err =3D 0; + goto out_wait; + } =20 /* If connection was _not_ established and a signal/timeout came * to be, we want the socket's state reset. User space may want * to retry. - * - * sk_state !=3D TCP_ESTABLISHED implies that socket is not on - * vsock_connected_table. We keep the binding and the transport - * assigned. */ if (signal_pending(current) || timeout =3D=3D 0) { err =3D timeout =3D=3D 0 ? -ETIMEDOUT : sock_intr_errno(timeout); @@ -1874,8 +1872,8 @@ static int vsock_connect(struct socket *sock, struct = sockaddr_unsized *addr, prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); } =20 - err =3D sock_error(sk); - if (err) { + if (sk->sk_state !=3D TCP_ESTABLISHED && sk->sk_state !=3D TCP_CLOSING) { + err =3D sock_error(sk); sk->sk_state =3D TCP_CLOSE; sock->state =3D SS_UNCONNECTED; } --=20 2.55.0 From nobody Fri Sep 25 07:22:57 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 469CE3B27E9; Tue, 15 Sep 2026 13:15:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478156; cv=none; b=e23uNdU0UD7YSx0OBWOhP6nNep04gOqqy+qlBQrWm/i8MySzOo0JW6+/eA/oAcBzTL2d7buG1Wv/jF1Xxe9RGgRzebMpnN41j4/+1CHS/ZCkAGAel6NWo1cnz/kCLNM61yD6Os5XGH+U3ZDrcfL1E9xVUgZTLVlU9p+lvsPTAdU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789478156; c=relaxed/simple; bh=xu+mDwt11NCm5xRoNZThMHFCHRLE2/JxywDp9WKY6vw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=PCMdhdxw6O9Y81n2nT8zWD4VBbp0bw3ZZPrKZlTQ9YCF2uahQAQ+MeYZi8SD3exiqBUS/x56QtU2efFyT8otvI8ecyP7DaXD8tFQ/fwh5yczy0xHdBeA9+Uc0vkJSb6KhsSZNvy+xRvFFwI6QWFZvn5teqWCJO+9CpWTOr481Vg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=aJD5Q34H; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="aJD5Q34H" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x6T0h-000wMC-Ce; Tue, 15 Sep 2026 15:15:43 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=8hwGE6w8mUrcO/P9PNHHaz5xdc2BUDZks6W/X0E3xyc=; b=aJD5Q34HCHzAwM1s86lNQ/xEtJ AWKboTjIr54kd45eGpigum/lpJ1hJlADxzti8SmGZ6jlm24ym+60KvUc98yeFdYErfWD6XySTF1rx 0QgW1S3Fzc+xI37c3yzc2Ud6ZfDzvsE4/QMR3K6DgtvmbOBrOMjs4k3fUpiPqb2oiljmhTIYzS6Lx jEcNPHG+aWkCFGWDH2HvL/aFTsx7GicRI7/SYsoBkdHr0WiqUS/FpHOlAevFgefDYJ2AYy8Kczm10 4G48ALCDmO0v+a+1uOTzJeTpr6QMtgBv0W+BPC28fsa4G3+xf4Z98iERM5XsGKumJ/sm7UR7Ru/tm dGp3KOEA==; Received: from [10.9.9.72] (helo=submission01.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x6T0W-0003iR-WC; Tue, 15 Sep 2026 15:15:33 +0200 Received: by submission01.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x6T0L-00EUxD-Mo; Tue, 15 Sep 2026 15:15:21 +0200 From: Michal Luczaj Date: Tue, 15 Sep 2026 15:15:16 +0200 Subject: [PATCH net v2 5/5] vsock: Handle sudden TCP_CLOSE during connect Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260915-vsock-connect-reset-closing-v2-5-a1d9abb472f7@rbox.co> References: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> In-Reply-To: <20260915-vsock-connect-reset-closing-v2-0-a1d9abb472f7@rbox.co> To: Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , "David S. Miller" , Xuan Zhuo , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Asias He Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 Virtio/PM events are serviced by virtio_vsock_reset_sock(), which resets each connected socket. The reset is done under vsock_table_lock but without taking lock_sock(), so from the point of view of vsock_connect() - locklessly. The same pattern exists in VMCI's vmci_transport_handle_detach() and vhost's vhost_vsock_reset_orphans(). The complexity of connect() comes from the fact that: 1. the virtio transport can be reassigned, so the old transport must be safely released; 2. a failed connect can be followed by a retry, so the socket must be reverted to a sensible state. Both cases apply only as long as the socket has not yet established a connection. While connect() waits for TCP_SYN_SENT -> TCP_ESTABLISHED, other transitions can also occur: TCP_SYN_SENT -> TCP_CLOSE on connection failure, timeout or signal TCP_SYN_SENT -> TCP_ESTABLISHED -> TCP_CLOSING on VIRTIO_VSOCK_OP_RST TCP_SYN_SENT -> TCP_ESTABLISHED -> [TCP_CLOSING ->] TCP_CLOSE on event This further complicates connect(). Rather than making every event handler drop the socket from connected_table or adapting connect() to handle more transitions (while missing proper locking), use vsk->peer_shutdown as a poison flag. Whatever state an event leaves the socket in, the flag bricks it and prevents suspicious transport reassignments or TCP_SYN_SENT retransmissions. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Michal Luczaj --- net/vmw_vsock/af_vsock.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index adf3f018347e..972952d04a81 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1743,6 +1743,12 @@ static int vsock_connect(struct socket *sock, struct= sockaddr_unsized *addr, goto out; } =20 + /* Virtio/PM events are serviced locklessly. */ + if (READ_ONCE(vsk->peer_shutdown)) { + err =3D -ECONNRESET; + goto out; + } + /* Set the remote address that we are connecting to. */ memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr)); --=20 2.55.0