io_uring_prep_connect on unreachable address -> io_uring_prep_shutdown after a while results in 2 connects on 5.15 kernel

[Comrade88]

the shutdown doesn't lead to ECONNRESET on the socket, instead it is ETIMEDOUT.
kernel traces show that shutdown switches the socket TCP_SYN_SENT -> TCP_CLOSE, sets ECONNRESET on the socket, triggers a POLLERR poll event, __io_poll_execute accepts and discards the event then starts another io_connect, the later sees the TCP_CLOSE'd socket and issues TCP_CLOSE -> TCP_SYN_SENT transition as if the socket was pristine.
i believe this is incorrect behavior. could you please advise if I have chosen the right place to discuss this issue or where else should I turn for qualified assistance?

[axboe]

This is the right place - do you have a test case for this?

[axboe]

Thanks, I'll take a look at this tomorrow.

[axboe]

Something like this should do it:

diff --git a/io_uring/net.c b/io_uring/net.c
index d89c39f853e3..17852a6616ff 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1710,6 +1710,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
 	int ret;
 	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
 
+	if (unlikely(req->flags & REQ_F_FAIL)) {
+		ret = -ECONNRESET;
+		goto out;
+	}
+
 	file_flags = force_nonblock ? O_NONBLOCK : 0;
 
 	ret = __sys_connect_file(req->file, &io->addr, connect->addr_len,
diff --git a/io_uring/poll.c b/io_uring/poll.c
index 31b118133bb0..7b7ea4c4b490 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -273,6 +273,8 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts)
 				return IOU_POLL_REISSUE;
 			}
 		}
+		if (req->cqe.res & EPOLLERR)
+			req_set_fail(req);
 		if (req->apoll_events & EPOLLONESHOT)
 			return IOU_POLL_DONE;

[axboe]

I'm going to send out the patch and get it included (and marked for stable). If you want attribution in the commit in form of a Reported-by tag, please reply in here with your name/identity and email and I can add that. If you don't want that or don't care, that's fine too.

[Comrade88]

i'm sure this was a bug. thanks.
pls, use for attribution: Sergey Galas' <[email protected]>

[axboe]

Done, here's the queued up patch:

https://git.kernel.dk/cgit/linux/commit/?h=io_uring-6.14&id=8c8492ca64e79c6e0f433e8c9d2bcbd039ef83d0