From nobody Mon May 25 18:04:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E16E831ED81; Thu, 21 May 2026 03:10:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333017; cv=none; b=M3YvaNb3PxscTtF173YhAZ4k2z/L6K3+AmBNH3z1OfBPKVRBYXrAI/OmTXrcQQIJu1otNjnZnfZohZXboLLIvAbA5rjt3DNn6eCTj/Af3qYUkiEZedybULqS+EsblJ19aum3OXmJubIndyWSWUV4FZVWD8OSM7QC8xqGzc48rlY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333017; c=relaxed/simple; bh=URxeR5p80vIacR8K9TNWnsdP2ESWb8SKRcC54sCAElM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LRDiuyRV9DuthfAWNoNLBrtc5w/GjXKE7297BO8uJls0xyytryxwmec7J/jBlP5E62kESgHC101l1CEeuROUBpCwPkceVucUdc0ZA5hZrPEcADGvd1JfqH7yY6j3BDcixNPHYv5Pms6YVz/UCf/H7igsQsk7uNBiilgu3DNERbU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZBMz5IOA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZBMz5IOA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 238BA1F00A3C; Thu, 21 May 2026 03:10:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779333015; bh=3SwOIApy4Ywfvh2YktSUdrEvcUgi19aX6QruE2QI2F4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZBMz5IOAXpyPQNDizFI5Z5zvXpJK+UM3OHwDwHSTCVy3N9twG8XfAjeX7q+eeYD/B aaWR6adQvjLQbo6Dotv12vqTa2HrWExZFwBZZJ9in6o165agnlmLPKrBAA2zL2VOVR nC8wv17cQ3bg/LIt5p+ra8Td+/wwKAMbj9SgySJI/k+FqCY2hr52Kj/HviMXbPcEGP 7h5ejVVyk9sUZuDEmY5J3p7uBQHsX8H2qjSO15S5DC6bidF3y6WLwiivDx+gqvZ5xi GHIleLwNWDzsVZXVedKGBZ6rTq+U6KAQ07IN28kJXh4B8NeJFdMPIvQBVJ6h69oXk7 LcSYPGquSeI5A== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Gang Yan , sashal@kernel.org, Paolo Abeni , "Matthieu Baerts (NGI0)" Subject: [PATCH 6.12.y 1/4] mptcp: sync the msk->sndbuf at accept() time Date: Thu, 21 May 2026 05:08:47 +0200 Message-ID: <20260521030845.723267-7-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521030845.723267-6-matttbe@kernel.org> References: <20260521030845.723267-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2562; i=matttbe@kernel.org; h=from:subject; bh=Z1WmgW/XUwdgdszC3CBMFu/v914ILVv5o7ffFe9nHvw=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4ygPsfpxfE1K9tSPpbsP1GQf4PsrureWddcGziW9xa 7+L9syTHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABP5a87wVyLP6Xvz8ismC69n Gvacd7p8Mobt7jnunQ1LWlZz2Ff+Os/I8NBhZrLEy5Y5wac4alznf5izp7rg0+GFqX2dsf79q2T 6eAA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan commit fcf04b14334641f4b0b8647824480935e9416d52 upstream. On passive MPTCP connections, the msk sndbuf is not updated correctly. The root cause is an order issue in the accept path: - tcp_check_req() -> subflow_syn_recv_sock() -> mptcp_sk_clone_init() calls __mptcp_propagate_sndbuf() to copy the ssk sndbuf into msk - Later, tcp_child_process() -> tcp_init_transfer() -> tcp_sndbuf_expand() grows the ssk sndbuf. So __mptcp_propagate_sndbuf() runs before the ssk sndbuf has been expanded and the msk ends up with a much smaller sndbuf than the subflow: MPTCP: msk->sndbuf:20480, msk->first->sndbuf:2626560 Fix this by moving the __mptcp_propagate_sndbuf() call from mptcp_sk_clone_init() -- the ssk sndbuf is not yet finalized there -- to __mptcp_propagate_sndbuf() at accept() time, when the ssk sndbuf has been fully expanded by tcp_sndbuf_expand(). Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/602 Signed-off-by: Gang Yan Acked-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-1-e= 3523e3aeb44@kernel.org Signed-off-by: Paolo Abeni [ No conflicts, but move __mptcp_propagate_sndbuf() above the for-loop (mptcp_for_each_subflow()) present in this version, which will modify 'subflow' used by __mptcp_propagate_sndbuf() in this new patch. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7dbb666c72c3..c1b1fb0fe8bc 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3493,7 +3493,6 @@ struct sock *mptcp_sk_clone_init(const struct sock *s= k, * uses the correct data */ mptcp_copy_inaddrs(nsk, ssk); - __mptcp_propagate_sndbuf(nsk, ssk); =20 mptcp_rcv_space_init(msk, ssk); msk->rcvq_space.time =3D mptcp_stamp(); @@ -4101,6 +4100,8 @@ static int mptcp_stream_accept(struct socket *sock, s= truct socket *newsock, msk =3D mptcp_sk(newsk); msk->in_accept_queue =3D 0; =20 + __mptcp_propagate_sndbuf(newsk, mptcp_subflow_tcp_sock(subflow)); + /* set ssk->sk_socket of accept()ed flows to mptcp socket. * This is needed so NOSPACE flag can be set from tcp stack. */ --=20 2.53.0 From nobody Mon May 25 18:04:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 908D131ED81; Thu, 21 May 2026 03:10:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333018; cv=none; b=Umk/Uqfp+kgIuvW/qUhaNJpc6p3MF1xOeryHSp7r1wsNu9UxRqizmW0NtxqsVIHNTFsaNt1OqwDdj2U76zYxBxF1PYLyD+Tq+jOuW4wD3NEoSOPda/KktvT0ia1d/+8x+miVICEwO0kxJX1DRuld/7AEyx0AZ0kYAr8FQXe4SE8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333018; c=relaxed/simple; bh=OPiUOJp9VtmPav65wfzceFlbz/K62XDBrUfEsK39OmY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nQMAJUDxLe7rcwv+d5cemgSE95oli/3ebudMa05wPXSEP/xI2Yps8ktjuJTaEzGlJNbVHO0vhNxGXQhEQ5CpLE2mP+RpSWwGlP2wy/8x+q1Or1O3kQl2TbyoNJkhBHKHPcbJ9u8Tr3moH7tv49TSaFrV3rAqq6U+v3RiZ9ILCH4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XrDqauQn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XrDqauQn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D55AB1F000E9; Thu, 21 May 2026 03:10:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779333017; bh=rxCJP2EMvJUeKzUukp43M7FHhKUyvcMIjcfLX0PmJ3I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XrDqauQnD/p9JHpGYM/zz30uMwId5yCpuTlk/rT2kHvqqJF5p+dpuMPM59TaAvn0K zHF6CIy20MXh74uF/qvwdSrJ0UnOgg8XB/Tl9YTBeOKCLk3MfRSsSSapXHMh0gunWh UL2miRCNSAXsvDQ+5tacjK9zEYsImd+QArBYidI2FD0raDmrwlHEYyv80aRDDxAZwk AdiPg/z6ntIWQKC/y/4mx2xPK4zsQWsZRvS0DSxyg81aHLnKxoIF7lXcy63u2UdfIn u47LGW8KNg+rVw94KWwWJM2al9drRIRoqff4tfy6jIG5HZyd4BLuRDZiGUyzs8EiiU fGbaSViCJEQfA== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.12.y 2/4] mptcp: pm: ADD_ADDR rtx: allow ID 0 Date: Thu, 21 May 2026 05:08:48 +0200 Message-ID: <20260521030845.723267-8-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521030845.723267-6-matttbe@kernel.org> References: <20260521030845.723267-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1332; i=matttbe@kernel.org; h=from:subject; bh=OPiUOJp9VtmPav65wfzceFlbz/K62XDBrUfEsK39OmY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4yqPnBdxr/tsnv9DT7/yPm096fazKH7+btH/jo5+3b fz3M5cEd5SyMIhxMciKKbJIt0Xmz3xexVvi5WcBM4eVCWQIAxenAExEuIaRobGFr/bFD2n1Od4P OBvnvRQN3ea8VT0w8LdQVI6LVvUkb4b/bnf2Vy0ViLZRNeHsyFle//+6ERuPNM/MnL8fb/ex7Y7 lBQA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 03f324f3f1f7619a47b9c91282cb12775ab0a2f1 upstream. ADD_ADDR can be sent for the ID 0, which corresponds to the local address and port linked to the initial subflow. Indeed, this address could be removed, and re-added later on, e.g. what is done in the "delete re-add signal" MPTCP Join selftests. So no reason to ignore it. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-2-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 5d892583ab4e..857e8db670a7 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -304,9 +304,6 @@ static void mptcp_pm_add_timer(struct timer_list *timer) if (inet_sk_state_load(sk) =3D=3D TCP_CLOSE) return; =20 - if (!entry->addr.id) - return; - bh_lock_sock(sk); if (sock_owned_by_user(sk)) { /* Try again later. */ --=20 2.53.0 From nobody Mon May 25 18:04:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4EAA631ED81; Thu, 21 May 2026 03:10:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333020; cv=none; b=V7QIeOiuefQV24LwFnxV7IuySfDk65Mczpu56WsU2mhviF7mjlk0KDpo/tgB1IG7bbINgAr3AEgfTJBDmC+agUx+3iDjhzVE01UGzi3PIx6GTRv2VJVmwSt5478I74jpLo9okWv/TZPF/ZNSL4GC8Ckn4Hi5tQcRI7UY+0a1fTI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333020; c=relaxed/simple; bh=XQAPDYO5/AsUuyg2SukJ7VthQYl88z3+JlOxCIDeG0c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H3ayW6Bl5GEbLfTLQTRBR2JACoZl9PwWtGJ3DLZ5NhBmMdxpK78ltrZIa1TGTt2MO65BP33GLqwZn3r5K2FU3n8BLedt2h8GDKRVE+zAW+0FAitf7jNj2DLHaSPCavQfLQMxqK+4OgWbd4tjJBGO+WSw2wMJcJ/HGIvT8NZPI1o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZqQJ3m4A; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZqQJ3m4A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 946B21F00A3B; Thu, 21 May 2026 03:10:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779333018; bh=vNmm7ElPbevXVkPylSvaaWly5F7+iaJ+V2VAjLyoAAU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZqQJ3m4Al+cr8Jb9Hy6VBwkNTzio+8SXSmycLEO7MNSYn3fCstKwWZ3asQXrHTso8 Z6CbBpkUwNo99L0PV1Xjp3knAteL/5vtKKcxoaplwR+Oavutq3bptlh/4Uj8LDEKTi g5RNnreDqQjPNE0PIq9ojy8czVvdTugl8S8fa4ESLI7jBE1vi/JbnErG50ROQG6S6I 4RM5T+x5U/duAtY/OROqKH9o9XmlrIrMIfsfObY+W6auM4Kzly4Li8Q0FzKhUWnPP1 hoSeDLSIc+EPaSEaO+dRcNP4LG9rUSHFt7n2ntN1Aa0Iya1ENITESPXrlxlUiDhMdH bBsQOLOnrf7EA== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.12.y 3/4] mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Date: Thu, 21 May 2026 05:08:49 +0200 Message-ID: <20260521030845.723267-9-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521030845.723267-6-matttbe@kernel.org> References: <20260521030845.723267-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1786; i=matttbe@kernel.org; h=from:subject; bh=XQAPDYO5/AsUuyg2SukJ7VthQYl88z3+JlOxCIDeG0c=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4ytNYJdO9JZ7oTzvktEuoxmhBsgzDblM2pshNLJZHO Ff61d7tKGVhEONikBVTZJFui8yf+byKt8TLzwJmDisTyBAGLk4BmMgnAYZ/xuuUH1XEf+Zgk2FK 3/KZ4wa3nMFqv50C9V05xwyLMpgKGP47ZVXXz/VIrH7V13Nbb0et5QmHlu1ZlyYfPzbZxU1f4xM LAA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 9634cb35af17019baec21ca648516ce376fa10e6 upstream. When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 857e8db670a7..be531df02c37 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -298,11 +298,8 @@ static void mptcp_pm_add_timer(struct timer_list *time= r) =20 pr_debug("msk=3D%p\n", msk); =20 - if (!msk) - return; - - if (inet_sk_state_load(sk) =3D=3D TCP_CLOSE) - return; + if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + goto exit; =20 bh_lock_sock(sk); if (sock_owned_by_user(sk)) { @@ -340,6 +337,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) =20 out: bh_unlock_sock(sk); +exit: __sock_put(sk); } =20 --=20 2.53.0 From nobody Mon May 25 18:04:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1E7A31ED81; Thu, 21 May 2026 03:10:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333022; cv=none; b=jBZmxpzwU2aEQ95DKrwBNGDIsx2SOTi9AMyCGLaqiBRMgzmEPgBFgY99vnEg0JYmt/mPJvoY1oP0r/ee4/llMrVka9wBG0k4I1WkcQ3ODyOz+Z28Skt7P2CkWztBiKnLjlYOkXJHfe+5N5H3SvpTs4pWZIxx6XUTzCh0u2EO7T0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779333022; c=relaxed/simple; bh=K0ILoGJSDN/w1UabpH2sQKTwwGJIAI/IqgzRfDwRYaI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WzPFddKxoo2YOTtsuVlC3RAwmblCBowNIcmbzp3/uqw7yMl7GBecQ91wd5aybh3o62bF5Npg5Kg715KloMfVkaXXuGIbI7+lWFWRT2ZUnAwciAP25kF8roQcvPbTG9/rqDCQVfu/WpUYm+3HqboMwTHfOreY5UsxOfd6fOzyETw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bZIr3aNn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bZIr3aNn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 534741F00A3E; Thu, 21 May 2026 03:10:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779333020; bh=sHfglxnALvhhMQ7dRnIFBN97Faq61nbYYW4V3KO1NRE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bZIr3aNnmXuJEqczqXAwBZ4FC+s+MWNZck0+IYymaF6g0ug6vSRJx5oWl/pnpZXam Vp5zdSM79BrZZrKBC9Y9ksaUEvnO5IRymnUhurvUqYO7rswtfeVmzVkdS1me1ZhKA3 fCy6FZ5u8VPiuNG2aZiJ+5hS1k3dAVXqmJ+JzcEtHJWjiWCbei3/8NOnqXKsOyRtVl jaVu/1kl/ReYYZVQQC7Pz1e6NrE0ij6lQMWJXEjVL5Lyrsg+Fq6jwk0zLQTR8AqkWk rIlPowOf/xPjCaLQ2mhJOqjweMEQ9ZEMSUU4ZPZ8mkcf0MOPl70CwbfxjX2o4BmgZv WqnFZS9TBXiIQ== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.12.y 4/4] mptcp: pm: ADD_ADDR rtx: free sk if last Date: Thu, 21 May 2026 05:08:50 +0200 Message-ID: <20260521030845.723267-10-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521030845.723267-6-matttbe@kernel.org> References: <20260521030845.723267-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4118; i=matttbe@kernel.org; h=from:subject; bh=K0ILoGJSDN/w1UabpH2sQKTwwGJIAI/IqgzRfDwRYaI=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4youmLIoL3/fpz+27nHGZv3e8C8j9862no//LE80f/ UrZ/x+e7yhlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZjIzzZGhn8XxWJsa3ib3Uxn 2EzaqCuceG+95ZHtzJWxE3LE1tikLGb4zVJhI3LfkdlxZ4jixkZuCY7vx7ffnr7Q+sq27x9tNpS 6MQMA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit b7b9a461569734d33d3259d58d2507adfac107ed upstream. When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on "itself". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ Applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c. Also, there were conflicts, because commit 30549eebc4d8 ("mptcp: make ADD_ADDR retransmission timeout adaptive") is not in this version and changed the context. Also, other conflicts were due to newer patches being backported with resolved conflicts before this one. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index be531df02c37..4ff6721ad5c7 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -22,6 +22,7 @@ struct mptcp_pm_add_entry { struct list_head list; struct mptcp_addr_info addr; u8 retrans_times; + bool timer_done; struct timer_list add_timer; struct mptcp_sock *sock; struct rcu_head rcu; @@ -294,22 +295,22 @@ static void mptcp_pm_add_timer(struct timer_list *tim= er) struct mptcp_pm_add_entry *entry =3D from_timer(entry, timer, add_timer); struct mptcp_sock *msk =3D entry->sock; struct sock *sk =3D (struct sock *)msk; - unsigned int timeout; + unsigned int timeout =3D 0; =20 pr_debug("msk=3D%p\n", msk); =20 - if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) - goto exit; - bh_lock_sock(sk); + if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + goto out; + if (sock_owned_by_user(sk)) { /* Try again later. */ - sk_reset_timer(sk, timer, jiffies + HZ / 20); + timeout =3D HZ / 20; goto out; } =20 if (mptcp_pm_should_add_signal_addr(msk)) { - sk_reset_timer(sk, timer, jiffies + HZ); + timeout =3D HZ; goto out; } =20 @@ -326,9 +327,8 @@ static void mptcp_pm_add_timer(struct timer_list *timer) entry->retrans_times++; } =20 - if (entry->retrans_times < ADD_ADDR_RETRANS_MAX) - sk_reset_timer(sk, timer, - jiffies + timeout); + if (entry->retrans_times >=3D ADD_ADDR_RETRANS_MAX) + timeout =3D 0; =20 spin_unlock_bh(&msk->pm.lock); =20 @@ -336,9 +336,13 @@ static void mptcp_pm_add_timer(struct timer_list *time= r) mptcp_pm_subflow_established(msk); =20 out: + if (timeout) + sk_reset_timer(sk, timer, jiffies + timeout); + else + /* if sock_put calls sk_free: avoid waiting for this timer */ + entry->timer_done =3D true; bh_unlock_sock(sk); -exit: - __sock_put(sk); + sock_put(sk); } =20 struct mptcp_pm_add_entry * @@ -402,6 +406,7 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, =20 timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); reset_timer: + add_entry->timer_done =3D false; timeout =3D mptcp_get_add_addr_timeout(net); if (timeout) sk_reset_timer(sk, &add_entry->add_timer, jiffies + timeout); @@ -422,7 +427,8 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk) spin_unlock_bh(&msk->pm.lock); =20 list_for_each_entry_safe(entry, tmp, &free_list, list) { - sk_stop_timer_sync(sk, &entry->add_timer); + if (!entry->timer_done) + sk_stop_timer_sync(sk, &entry->add_timer); kfree_rcu(entry, rcu); } } --=20 2.53.0