From 4dcac443c08d1937c18f8974ea7cb9180d94d233 Mon Sep 17 00:00:00 2001
From: wyf-777 <wyf-777@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:45:05 +0800
Subject: [PATCH 1/2] [net][sal] Free DFS v2 vnode when socket creation fails

When sal_socket() rejects a request, DFS v2 descriptor cleanup destroys the dfs_file but leaves its separately allocated vnode behind.

Destroy the vnode before releasing the failed descriptor and add a regression test that verifies repeated failures do not consume heap.

Fixes #11710

Assisted-by: OpenAI Codex:GPT-5
---
 components/net/sal/socket/net_sockets.c      |  4 +++
 components/net/utest/SConscript              |  3 ++
 components/net/utest/tc_sal_socket_failure.c | 37 ++++++++++++++++++++
 3 files changed, 44 insertions(+)
 create mode 100644 components/net/utest/tc_sal_socket_failure.c

diff --git a/components/net/sal/socket/net_sockets.c b/components/net/sal/socket/net_sockets.c
index 50c20b908afe..2cdf0d8f0a59 100644
--- a/components/net/sal/socket/net_sockets.c
+++ b/components/net/sal/socket/net_sockets.c
@@ -670,6 +670,10 @@ int socket(int domain, int type, int protocol)
     }
     else
     {
+#ifdef RT_USING_DFS_V2
+        dfs_vnode_destroy(d->vnode);
+        d->vnode = RT_NULL;
+#endif
         /* release fd */
         fd_release(fd);
         rt_set_errno(-ENOMEM);
diff --git a/components/net/utest/SConscript b/components/net/utest/SConscript
index eb9b47e7191c..75c681a7e46a 100644
--- a/components/net/utest/SConscript
+++ b/components/net/utest/SConscript
@@ -17,6 +17,9 @@ if GetDepend('RT_UTEST_TC_USING_SAL'):
     # Add sal test source if enabled
     src += ['tc_sal_socket.c']
 
+    if GetDepend(['RT_USING_DFS_V2', 'SAL_USING_POSIX']):
+        src += ['tc_sal_socket_failure.c']
+
 # Define the test group with proper dependencies
 group = DefineGroup('utestcases', src, depend = [''], CPPPATH = CPPPATH)
 
diff --git a/components/net/utest/tc_sal_socket_failure.c b/components/net/utest/tc_sal_socket_failure.c
new file mode 100644
index 000000000000..a516a1c8269c
--- /dev/null
+++ b/components/net/utest/tc_sal_socket_failure.c
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2006-2026, RT-Thread Development Team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <rtthread.h>
+#include <sys/socket.h>
+
+#include "utest.h"
+
+static void TC_sal_socket_failure_cleanup(void)
+{
+    rt_size_t used_before;
+    rt_size_t used_after;
+    int i;
+
+    /* Warm up the descriptor and SAL tables before measuring the heap. */
+    uassert_int_equal(socket(-1, SOCK_STREAM, 0), -1);
+    rt_memory_info(RT_NULL, &used_before, RT_NULL);
+
+    for (i = 0; i < 32; i++)
+    {
+        uassert_int_equal(socket(-1, SOCK_STREAM, 0), -1);
+    }
+
+    rt_memory_info(RT_NULL, &used_after, RT_NULL);
+    LOG_I("heap used before: %lu, after: %lu",
+          (unsigned long)used_before, (unsigned long)used_after);
+    uassert_int_equal(used_after, used_before);
+}
+
+static void utest_do_tc(void)
+{
+    UTEST_UNIT_RUN(TC_sal_socket_failure_cleanup);
+}
+UTEST_TC_EXPORT(utest_do_tc, "components.net.sal.socket_failure_cleanup", RT_NULL, RT_NULL, 5);

From 1d924c60624fabedb9b33f3dc9ee5290c8313c24 Mon Sep 17 00:00:00 2001
From: wyf-777 <203830680+wyf-777@users.noreply.github.com>
Date: Thu, 27 Aug 2026 09:39:31 +0000
Subject: [PATCH 2/2] style: format code with clang-format [skip ci]

---
 components/net/sal/socket/net_sockets.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/net/sal/socket/net_sockets.c b/components/net/sal/socket/net_sockets.c
index 2cdf0d8f0a59..de8983bf08e6 100644
--- a/components/net/sal/socket/net_sockets.c
+++ b/components/net/sal/socket/net_sockets.c
@@ -63,7 +63,7 @@ int accept(int s, struct sockaddr *addr, socklen_t *addrlen)
         }
 
         d = fd_get(fd);
-        if(d)
+        if (d)
         {
 #ifdef RT_USING_DFS_V2
             d->fops = dfs_net_get_fops();