> Handle the previously overlooked TCP_ESTABLISHED -> TCP_CLOSING
> transition (on VIRTIO_VSOCK_OP_RST), which could race with the connect
> loop.
>
> Resetting a socket that is still present in connected_table can lead to
> memory corruption. The reporter noted lost transports for in-flight skbs,
> and I have reproduced crashes caused by re-insertion into connected_table.
>
> list_add double add: new=, prev=, next=.
> kernel BUG at lib/list_debug.c:35!
> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
> Workqueue: vsock-loopback vsock_loopback_work
> RIP: 0010:__list_add_valid_or_report+0x11f/0x130
> Call Trace:
> vsock_insert_connected.cold+0xe/0x13
> [ ... ]
>
> Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
> Reported-by: Hyunwoo Kim <[email protected]>
> Link: https://lore.kernel.org/netdev/anzT1fREOSyHT99k@v4bel/
> Signed-off-by: Michal Luczaj <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=4
