SelectorEventLoop `sock_connect` can return before cleaning up if `sock.connect` encounters `BlockingIOError` or `InterruptedError` on cancellation

[bdraco]

Bug report

Bug description:

Originally reported in aio-libs/aiohttp#10617 (comment)

To make this happen:

Call loop.sock_connect and cancel it before the socket is connected.

Because _sock_write_done is called via add_done_callback it gets called in the next iteration of the event loop on cancellation.

cpython/Lib/asyncio/selector_events.py

Line 658 in 9c7ef0c

fut.add_done_callback(

sock_connect will return before _sock_write_done is called which means the writer has not been removed yet and can get reused.

Additionally, this makes the close in

cpython/Lib/asyncio/base_events.py

Line 1047 in 9c7ef0c

sock.close()

unsafe because on cancellation the socket gets closed before the writer is removed so the fd can get reused

CPython versions tested on:

3.10 but the same code exists for 3.13+

Operating systems tested on:

Linux

[bdraco]

I can't make a reproducer for this.

I tried

async def socket_runner(port: int) -> None:
    loop = asyncio.get_running_loop()
    while True:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.setblocking(False)
        task = asyncio.current_task()
        loop.call_later(0.1, task.cancel)
        try:
            await loop.sock_connect(sock, ("1.1.1.1", port))
        except asyncio.CancelledError:
            sock.close()

But the callback always fires in time.

[bdraco]

I thinkthe problem is actually happening in _create_connection_transport

cpython/Lib/asyncio/base_events.py

Line 1220 in 151d1bf

transport = self._make_socket_transport(sock, protocol, waiter)

only loop.sock_connect that ends up losing the race

[bdraco]

So if create_connection get cancelled, _create_connection_transport has already created the transport and protocol. The waiter gets cancelled at

cpython/Lib/asyncio/base_events.py

Line 1224 in 151d1bf

except:

which calls transport.close but the call_soon in

cpython/Lib/asyncio/selector_events.py

Line 950 in 151d1bf

self._loop.call_soon(self._add_reader,

hasn't run yet. So in the race case, create_connection is done and the socket gets closed in the downstream code, than the call_soon to add the reader runs after

[bdraco]

I'll keep working on a reproducer so this issue is actually actionable.