vsock/virtio: fix accept queue count leak on transport mismatch

commit 52bcb57a4e8a0865a76c587c2451906342ae1b2d upstream.

virtio_transport_recv_listen() calls sk_acceptq_added() before
vsock_assign_transport(). If vsock_assign_transport() fails or
selects a different transport, the error path returns without
calling sk_acceptq_removed(), permanently incrementing
sk_ack_backlog.

After approximately backlog+1 such failures, sk_acceptq_is_full()
returns true, causing the listener to reject all new connections.

Fix by moving sk_acceptq_added() to after the transport validation,
matching the pattern used by vmci_transport and hyperv_transport.

Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260413131409.19022-1-phx0fer@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 1227b280f1c9912938e05f5ef49b56eabbc99d4c..6547e199ea5b168128f7bc9930722657dc800e24 100644 (file)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -1544,8 +1544,6 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb,
                return -ENOMEM;
        }
 
-       sk_acceptq_added(sk);
-
        lock_sock_nested(child, SINGLE_DEPTH_NESTING);
 
        child->sk_state = TCP_ESTABLISHED;
@@ -1567,6 +1565,7 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb,
                return ret;
        }
 
+       sk_acceptq_added(sk);
        if (virtio_transport_space_update(child, skb))
                child->sk_write_space(child);