[PATCH RFC net v2 1/3] vsock/virtio: refuse connect() from a CID the transport does not own

[Yiran Qiu <eritque-arcus@ikuyo.dev>]

Since commit c0cfa2d8a788 ("vsock: add multi-transports support"),
bind() accepts any local CID, but connect() picks the transport from the
remote CID only.  The virtio transports send from the transport's CID,
so a socket bound to another local CID sends as if it were bound to
the same port on the transport's CID, and its connect() never
completes.

Over vsock_loopback, one process can use this against another that is
bound to (VMADDR_CID_LOCAL, P):
 1. it binds to (guest CID, P) and connects to a local listener; the
    request arrives from (VMADDR_CID_LOCAL, P) and leaves behind a
    child socket for that address, which stays until the listener
    accepts and closes it;
 2. the other process's connect() to the same listener matches that
    child and fails with ECONNRESET.

Refuse such a connect() with EADDRNOTAVAIL, as bind() does for a CID
that is not local.  And whenever the virtio connect() fails, set the
socket to TCP_CLOSE, as vmci_transport_connect() does, instead of
leaving it in TCP_SYN_SENT.

Found by an LLM-driven code audit.  I reproduced it on unmodified
kernels with the two processes running as different users, without
error injection, and tested the fix with the reproducer and vsock_test
in guests and on a host.  Drafted with Claude.

Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
Signed-off-by: Yiran Qiu <eritque-arcus@ikuyo.dev>
---
 net/vmw_vsock/virtio_transport_common.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 1e762a480df4..8f524d073ae1 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -1219,8 +1219,20 @@ int virtio_transport_connect(struct vsock_sock *vsk)
 		.vsk = vsk,
 		.net = sock_net(sk_vsock(vsk)),
 	};
+	u32 local_cid;
+	int ret;
 
-	return virtio_transport_send_pkt_info(vsk, &info);
+	local_cid = vsk->transport->get_local_cid();
+	if (local_cid != VMADDR_CID_ANY &&
+	    vsk->local_addr.svm_cid != VMADDR_CID_ANY &&
+	    vsk->local_addr.svm_cid != local_cid)
+		ret = -EADDRNOTAVAIL;
+	else
+		ret = virtio_transport_send_pkt_info(vsk, &info);
+
+	if (ret < 0)
+		sk_vsock(vsk)->sk_state = TCP_CLOSE;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(virtio_transport_connect);
 
-- 
2.56.0