From nobody Mon May 25 18:11:29 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B205F38D40B for ; Thu, 14 May 2026 09:50:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778752232; cv=none; b=M0606STTzAYoxFqCpqMgwy8jp5q4YgePs1TQw2ftThwBSh/zNzH/eDGWXsP4DNdMSYOUL5Z+9uuSuAf2KtL4B7El+QNGG6m9A8Wc0n2PTkKQz+DFfWbHXPtaCvldaBuVkLi6XSLFwEDgEmCoXGchWQw71jGIeIMZs+GwNoWNPcU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778752232; c=relaxed/simple; bh=48EDdeEz79jTJsYDo7PkIk1eG83NmDnlnUdmIz0wDTU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Jv71FOHL1gpokLohHliROKXjEyiCuS1+F81mE49aOLxaoU/rwo32rUbBZ7ezStttCsdcaMuDGXFDnX0R4xDqdwtXKd+8BI4eEGzGMoeFzKE62zJMgXmpHYX0fTIndhU6toZkqTkElMVPmbS2bPmGezdJSDIbAqf4+w9UuYsV/7Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 53ea23b44f7a11f1aa26b74ffac11d73-20260514 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_TXT, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_TRUSTED SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS DMARC_NOPASS, CIE_BAD, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:a21106be-cb77-4391-a01c-be422b0abcd0,IP:10, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:5 X-CID-INFO: VERSION:1.3.12,REQID:a21106be-cb77-4391-a01c-be422b0abcd0,IP:10,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:5 X-CID-META: VersionHash:e7bac3a,CLOUDID:4e72c64c4716b0dd8c70ef1b4c50b02d,BulkI D:260514175024319CNESW,BulkQuantity:0,Recheck:0,SF:17|19|38|66|78|81|82|10 2|127|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk:n il,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BR E:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_FAS,TF_CID_SPAM_FSD,TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 53ea23b44f7a11f1aa26b74ffac11d73-20260514 X-User: cuitao@kylinos.cn Received: from ctao-book.. [(223.70.159.239)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1559794892; Thu, 14 May 2026 17:50:23 +0800 From: Tao Cui To: matttbe@kernel.org, martineau@kernel.org, geliang@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, mptcp@lists.linux.dev, Tao Cui Subject: [PATCH v2 1/2] mptcp: pm: fix extra_subflows underflow on userspace PM connect failure Date: Thu, 14 May 2026 17:50:06 +0800 Message-ID: <20260514095007.405475-2-cuitao@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260514095007.405475-1-cuitao@kylinos.cn> References: <20260514095007.405475-1-cuitao@kylinos.cn> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to roll back the pre-increment done by kernel PM's fill_*() helpers. The userspace PM does not pre-increment =E2=80=94 it only increments after __mptcp_subflow_connect() succeeds =E2=80=94 so this decrement is spurious. Fix it by gating mptcp_pm_close_subflow() on the PM type. Signed-off-by: Tao Cui --- net/mptcp/subflow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index d562e149606f..c45ad67cb650 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1716,7 +1716,8 @@ int __mptcp_subflow_connect(struct sock *sk, const st= ruct mptcp_pm_local *local, /* we account subflows before the creation, and this failures will not * be caught by sk_state_change() */ - mptcp_pm_close_subflow(msk); + if (!mptcp_pm_is_userspace(msk)) + mptcp_pm_close_subflow(msk); return err; } =20 --=20 2.43.0 From nobody Mon May 25 18:11:29 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66276368D42 for ; Thu, 14 May 2026 09:50:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778752235; cv=none; b=blne1RMXoFI8RUBioxrUq9ZoQdwn2bpLB5lDJmr8mfs52CxldkvEeCEPYLXX1RwmvvJzqtLvdaVLNmhvTscELM4svXsy+/H/IE2dp3SMCzIlql1EiaJ0a6MWn5XybHpSIFFRvSZhIVpvdQR0o3CBRLijUaOjp0k01RAMQNADkjo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778752235; c=relaxed/simple; bh=1u5wxaqEBpkWjzCsQMQ4NUP+3MG9SvfjrMgH7lkPkC8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UY1JSIpjBmpcvviD/SxmpT20wYI1A/eRiXf18ErFGUm/CLWZsQrPC0EKIrQB/XL1fbrzNQJhIC+pM8l3jdTgXkfFQapkwxbTnA7sNeD35ZmidzQsSiFCTgyg8MXy+gUC8QX0eUCzFnF/1XgJrr1kwPhIyUmTyas0R6zpzsttnTY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 5585a1f84f7a11f1aa26b74ffac11d73-20260514 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_TRUSTED SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS DMARC_NOPASS, CIE_BAD, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:bd46983c-6958-4cef-8c5a-888aaa465e6f,IP:10, URL:0,TC:0,Content:0,EDM:-20,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACT ION:release,TS:-15 X-CID-INFO: VERSION:1.3.12,REQID:bd46983c-6958-4cef-8c5a-888aaa465e6f,IP:10,UR L:0,TC:0,Content:0,EDM:-20,RT:0,SF:-5,FILE:0,BULK:0,RULE:EDM_GE969F26,ACTI ON:release,TS:-15 X-CID-META: VersionHash:e7bac3a,CLOUDID:da8b1783eb1a9c93841d5a1c464e3873,BulkI D:260514175027KN0PT24H,BulkQuantity:0,Recheck:0,SF:17|19|38|66|78|81|82|10 2|127|898,TC:nil,Content:0|15|50,EDM:1,IP:-2,URL:0,File:nil,RT:nil,Bulk:ni l,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE :0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_AEC,TF_CID_SPAM_FAS,TF_CID_SPAM_FSD X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 5585a1f84f7a11f1aa26b74ffac11d73-20260514 X-User: cuitao@kylinos.cn Received: from ctao-book.. [(223.70.159.239)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1391504883; Thu, 14 May 2026 17:50:26 +0800 From: Tao Cui To: matttbe@kernel.org, martineau@kernel.org, geliang@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, mptcp@lists.linux.dev, Tao Cui Subject: [PATCH v2 2/2] mptcp: pm: add extra_subflows underflow guard for userspace PM Date: Thu, 14 May 2026 17:50:07 +0800 Message-ID: <20260514095007.405475-3-cuitao@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260514095007.405475-1-cuitao@kylinos.cn> References: <20260514095007.405475-1-cuitao@kylinos.cn> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mptcp_pm_subflow_check_next() decrements extra_subflows unconditionally for the userspace PM without checking that the counter is non-zero. Since extra_subflows is a u8, an underflow from 0 to 255 permanently corrupts the counter and blocks future subflow creation. Add an underflow guard to prevent this. Signed-off-by: Tao Cui --- net/mptcp/pm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 3c152bf66cd5..a83a56b467f9 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -655,7 +655,8 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, if (mptcp_pm_is_userspace(msk)) { if (update_subflows) { spin_lock_bh(&pm->lock); - pm->extra_subflows--; + if (pm->extra_subflows) + pm->extra_subflows--; spin_unlock_bh(&pm->lock); } return; --=20 2.43.0