On Mon, Mar 17, 2025 at 10:52:25AM +0100, Michal Luczaj wrote:
Signal delivery during connect() may lead to a disconnect of an already established socket. That involves removing socket from any sockmap and resetting state to SS_UNCONNECTED. While it correctly restores socket's proto, a call to vsock_bpf_recvmsg() might have been already under way in another thread. If the connect()ing thread reassigns the vsock transport to NULL, the recvmsg()ing thread may trigger a WARN_ON_ONCE.
connect / state = SS_CONNECTED / sock_map_update_elem vsock_bpf_recvmsg psock = sk_psock_get() lock sk if signal_pending unhash sock_map_remove_links
So vsock's ->recvmsg() should be restored after this, right? Then how is vsock_bpf_recvmsg() called afterward?
state = SS_UNCONNECTEDrelease sk
connect transport = NULL lock sk WARN_ON_ONCE(!vsk->transport)
And I am wondering why we need to WARN here since we can handle this error case correctly?
Thanks.