[net][sal] Free DFS v2 vnode when socket creation fails

When sal_socket() rejects a request, DFS v2 descriptor cleanup destroys the dfs_file but leaves its separately allocated vnode behind.

Destroy the vnode before releasing the failed descriptor and add a regression test that verifies repeated failures do not consume heap.

Fixes #11710

Assisted-by: OpenAI Codex:GPT-5

3 files changed, 44 insertions, 0 deletions

diff --git a/components/net/sal/socket/net_sockets.c b/components/net/sal/socket/net_sockets.c
index 50c20b908a..2cdf0d8f0a 100644
--- a/components/net/sal/socket/net_sockets.c
+++ b/components/net/sal/socket/net_sockets.c
@@ -670,6 +670,10 @@ int socket(int domain, int type, int protocol)
     }
     else
     {
+#ifdef RT_USING_DFS_V2
+        dfs_vnode_destroy(d->vnode);
+        d->vnode = RT_NULL;
+#endif
         /* release fd */
         fd_release(fd);
         rt_set_errno(-ENOMEM);
diff --git a/components/net/utest/SConscript b/components/net/utest/SConscript
index eb9b47e719..75c681a7e4 100644
--- a/components/net/utest/SConscript
+++ b/components/net/utest/SConscript
@@ -17,6 +17,9 @@ if GetDepend('RT_UTEST_TC_USING_SAL'):
     # Add sal test source if enabled
     src += ['tc_sal_socket.c']
 
+    if GetDepend(['RT_USING_DFS_V2', 'SAL_USING_POSIX']):
+        src += ['tc_sal_socket_failure.c']
+
 # Define the test group with proper dependencies
 group = DefineGroup('utestcases', src, depend = [''], CPPPATH = CPPPATH)
 
diff --git a/components/net/utest/tc_sal_socket_failure.c b/components/net/utest/tc_sal_socket_failure.c
new file mode 100644
index 0000000000..a516a1c826
--- /dev/null
+++ b/components/net/utest/tc_sal_socket_failure.c
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2006-2026, RT-Thread Development Team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <rtthread.h>
+#include <sys/socket.h>
+
+#include "utest.h"
+
+static void TC_sal_socket_failure_cleanup(void)
+{
+    rt_size_t used_before;
+    rt_size_t used_after;
+    int i;
+
+    /* Warm up the descriptor and SAL tables before measuring the heap. */
+    uassert_int_equal(socket(-1, SOCK_STREAM, 0), -1);
+    rt_memory_info(RT_NULL, &used_before, RT_NULL);
+
+    for (i = 0; i < 32; i++)
+    {
+        uassert_int_equal(socket(-1, SOCK_STREAM, 0), -1);
+    }
+
+    rt_memory_info(RT_NULL, &used_after, RT_NULL);
+    LOG_I("heap used before: %lu, after: %lu",
+          (unsigned long)used_before, (unsigned long)used_after);
+    uassert_int_equal(used_after, used_before);
+}
+
+static void utest_do_tc(void)
+{
+    UTEST_UNIT_RUN(TC_sal_socket_failure_cleanup);
+}
+UTEST_TC_EXPORT(utest_do_tc, "components.net.sal.socket_failure_cleanup", RT_NULL, RT_NULL, 5);