5.15-stable patches

added patches:
	vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index bae98a8b799ff865841935bfba0f02243c734409..f090b5460c66f997ba3f1f63e88c93d2bc792180 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -384,3 +384,4 @@ batman-adv-bla-only-purge-non-released-claims.patch
 batman-adv-bla-put-backbone-reference-on-failed-claim-hash-insert.patch
 bluetooth-l2cap-fix-null-ptr-deref-in-l2cap_sock_get_sndtimeo_cb.patch
 vsock-fix-buffer-size-clamping-order.patch
+vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch

diff --git a/queue-5.15/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch b/queue-5.15/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch
new file mode 100644 (file)
index 0000000..713b81f
--- /dev/null
+++ b/queue-5.15/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch
@@ -0,0 +1,54 @@
+From 52bcb57a4e8a0865a76c587c2451906342ae1b2d Mon Sep 17 00:00:00 2001
+From: Dudu Lu <phx0fer@gmail.com>
+Date: Mon, 13 Apr 2026 21:14:09 +0800
+Subject: vsock/virtio: fix accept queue count leak on transport mismatch
+
+From: Dudu Lu <phx0fer@gmail.com>
+
+commit 52bcb57a4e8a0865a76c587c2451906342ae1b2d upstream.
+
+virtio_transport_recv_listen() calls sk_acceptq_added() before
+vsock_assign_transport(). If vsock_assign_transport() fails or
+selects a different transport, the error path returns without
+calling sk_acceptq_removed(), permanently incrementing
+sk_ack_backlog.
+
+After approximately backlog+1 such failures, sk_acceptq_is_full()
+returns true, causing the listener to reject all new connections.
+
+Fix by moving sk_acceptq_added() to after the transport validation,
+matching the pattern used by vmci_transport and hyperv_transport.
+
+Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
+Signed-off-by: Dudu Lu <phx0fer@gmail.com>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://patch.msgid.link/20260413131409.19022-1-phx0fer@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/vmw_vsock/virtio_transport_common.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1223,8 +1223,6 @@ virtio_transport_recv_listen(struct sock
+               return -ENOMEM;
+       }
+ 
+-      sk_acceptq_added(sk);
+-
+       lock_sock_nested(child, SINGLE_DEPTH_NESTING);
+ 
+       child->sk_state = TCP_ESTABLISHED;
+@@ -1246,6 +1244,7 @@ virtio_transport_recv_listen(struct sock
+               return ret;
+       }
+ 
++      sk_acceptq_added(sk);
+       if (virtio_transport_space_update(child, pkt))
+               child->sk_write_space(child);
+