From nobody Mon May 25 18:04:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBC85360EDA; Thu, 21 May 2026 03:28:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334129; cv=none; b=XVtsGKOMIqO6TxRYNXFn8YDpMDFGygNk8clIrBTvRB+qboBoNAT4l8RPTgSFA9l4tb5Yy+iEJe2NoHOLRL4o4bZkCuhJJ3RSxNFNUKUItaoxgfGBhQH8ytFyRFHas3LCkod9nEEXmlxZtW2f86j/htTXetQXGZVoeHBjG0R7Cdo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334129; c=relaxed/simple; bh=ormrvSzueMuYKSsgTMU9bd3BI7psozozyihQjVHLiik=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IcrpaaTAaV149+Sw/L5jI9Q2ok2ZnD1adEeTSoMOrp63XVGryyr9l4+QQSowtIV4pYBoNEY5mL7aFGBQyttiMfV/hO4ocTlxU2yZNMssokDhN3TKjjhGt7m0UbRIDxhYIkHpicGWLC92fkaVavciZFMnJG5vLdN+0iEUBSetQWI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=njpVL7g0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="njpVL7g0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BEDE1F00A3E; Thu, 21 May 2026 03:28:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779334127; bh=JDwWEszVW0ozbfE62J6M/b2AIbeh5w1dxkRwQ9+6H3U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=njpVL7g0BsTXfQ/yXtOUFYMkJKtHoPOZyp/4OezpNBYt6vpSIOeK7+xHEtgIHcB21 6zKD+tfa0TNbILeTuzhXKo2Y9DADiRHYJFgInpiYUBujWeB1AoZjpSiSrF6tAwGK5p 5//AWnC73I1hzROXZ5/YJjQvC+00xtiBXa/qn50S2AfZU0DimOVjPos02JOidCGTnF opZZUouJrYgM2Fly9Dsipz0M9J7BfynxiutQFNcYDNgxTJO84A98pX7+u7q9YAF3ok sRDyOFsK8HOg/yt79ZnuqAMcGUprPp6Nl2wIpE0hL1Z9NJf2rJeqYACRYnB66sDbiV VmviofOjyMxeg== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Gang Yan , sashal@kernel.org, Paolo Abeni , "Matthieu Baerts (NGI0)" Subject: [PATCH 6.6.y 1/4] mptcp: sync the msk->sndbuf at accept() time Date: Thu, 21 May 2026 05:19:08 +0200 Message-ID: <20260521031906.740857-7-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521031906.740857-6-matttbe@kernel.org> References: <20260521031906.740857-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2562; i=matttbe@kernel.org; h=from:subject; bh=qDRSdub3sv4BWfBJw9DcEvzI4fbL9JeAWuiAfUv8qiM=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4Kvd0HDk5SWCznlikb4iJ1vsfM9+WXX5nyCJikXnip p2EYVFHRykLgxgXg6yYIot0W2T+zOdVvCVefhYwc1iZQIYwcHEKwER40hgZVnIdtYmblzg/tHjy Og3208FL9vUtf2SyyK1LUc/7zOWprIwMTffSljiyGe0/lmzqWD15sY767W2LlvMuCOR6fHmfv/h ZDgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan commit fcf04b14334641f4b0b8647824480935e9416d52 upstream. On passive MPTCP connections, the msk sndbuf is not updated correctly. The root cause is an order issue in the accept path: - tcp_check_req() -> subflow_syn_recv_sock() -> mptcp_sk_clone_init() calls __mptcp_propagate_sndbuf() to copy the ssk sndbuf into msk - Later, tcp_child_process() -> tcp_init_transfer() -> tcp_sndbuf_expand() grows the ssk sndbuf. So __mptcp_propagate_sndbuf() runs before the ssk sndbuf has been expanded and the msk ends up with a much smaller sndbuf than the subflow: MPTCP: msk->sndbuf:20480, msk->first->sndbuf:2626560 Fix this by moving the __mptcp_propagate_sndbuf() call from mptcp_sk_clone_init() -- the ssk sndbuf is not yet finalized there -- to __mptcp_propagate_sndbuf() at accept() time, when the ssk sndbuf has been fully expanded by tcp_sndbuf_expand(). Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/602 Signed-off-by: Gang Yan Acked-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-1-e= 3523e3aeb44@kernel.org Signed-off-by: Paolo Abeni [ No conflicts, but move __mptcp_propagate_sndbuf() above the for-loop (mptcp_for_each_subflow()) present in this version, which will modify 'subflow' used by __mptcp_propagate_sndbuf() in this new patch. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index aed6c04c7de6..ff1632d03a96 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3451,7 +3451,6 @@ struct sock *mptcp_sk_clone_init(const struct sock *s= k, * uses the correct data */ mptcp_copy_inaddrs(nsk, ssk); - __mptcp_propagate_sndbuf(nsk, ssk); =20 mptcp_rcv_space_init(msk, ssk); msk->rcvq_space.time =3D mptcp_stamp(); @@ -4064,6 +4063,8 @@ static int mptcp_stream_accept(struct socket *sock, s= truct socket *newsock, msk =3D mptcp_sk(newsk); msk->in_accept_queue =3D 0; =20 + __mptcp_propagate_sndbuf(newsk, mptcp_subflow_tcp_sock(subflow)); + /* set ssk->sk_socket of accept()ed flows to mptcp socket. * This is needed so NOSPACE flag can be set from tcp stack. */ --=20 2.53.0 From nobody Mon May 25 18:04:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77145358381; Thu, 21 May 2026 03:28:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334130; cv=none; b=ZVT+RLpdvxwN0kmcVgyvOb1OYwEmsmYzR+zgw2tX06fXBfSa4fLMTExhuBNZ/arfrdtk0ulfpxt6d7eRyN2hPpgvSB8k/91scQjTywvYI7X8vwXAaNrsxBSGlFMXfraA2EJVFRz9doQebpFsNRMNXYFBO4/qjavTfdqmdFT+jmo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334130; c=relaxed/simple; bh=dedVbwFEs6+83NrjuCtR/O9WvWYy5d0Fs9aM3EiTf1A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FrRYkuuRpwp3sz5z6Vw4AsvBI+7A0J/n71tl/3xVo3nDAWGJTwBF+lUd8ZnOC0TdTHv2eJOAWgi7aHy7ovihfdvgUnlUx6zBxbcI3MYzX3ecui3VS/95fAIvj875Y187+nOpdXcKBYGbNlwcfIBg2sh088Kx/LziCDsYB/TbYaU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gQiC+2xR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gQiC+2xR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A7251F00A3B; Thu, 21 May 2026 03:28:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779334129; bh=6tpKhbl7/XP4g0sNUV4dMb7sk1SW+jcxNTcYkt/07i8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gQiC+2xRgk40ytP2JM/ufg2/GN1+jRLHhiNJ0KyLhzI0hKTC0lYeqCyc8ubfcy7CS FDEOElKmZeNVxO/vI+Mwk+t8Wfs9Ao122+bfCmKRp/yL6C5zPN4KDu0xDasqjIZoPB eDhXFG1jF5XjitYDkA3xmdubIFaT8RluoOwnztZGj6CRvaunOlaSGQMv0sYVikcoQN /JajP5KHNXpEI7mIyYrK2d+u9iThQjbcvQlXheWVxcqGmChP4CDaTF1GF6pArW07s+ gIJlI1w7Mbo9HlrnOO+z46IAqO9rtJWndxs9tLCNx15yPp5Tok9vcrPPVLrx7rFDCJ FLVfdZgzDbmsQ== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.6.y 2/4] mptcp: pm: ADD_ADDR rtx: allow ID 0 Date: Thu, 21 May 2026 05:19:09 +0200 Message-ID: <20260521031906.740857-8-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521031906.740857-6-matttbe@kernel.org> References: <20260521031906.740857-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1332; i=matttbe@kernel.org; h=from:subject; bh=dedVbwFEs6+83NrjuCtR/O9WvWYy5d0Fs9aM3EiTf1A=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4Kk9c8Re54bn2muGVlNA/Xpwl7s3P/FvVf/ktir129 F/WXf2sjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgIm8+8TI0KPN//T1I4lJq4Vn /r9sWRzy+lbiwqJ/q+s+pofl+i/TZ2L4p9uqv+bMomfVscXihTG6uUfWsTOfecObtqgzvDXf+3w eDwA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 03f324f3f1f7619a47b9c91282cb12775ab0a2f1 upstream. ADD_ADDR can be sent for the ID 0, which corresponds to the local address and port linked to the initial subflow. Indeed, this address could be removed, and re-added later on, e.g. what is done in the "delete re-add signal" MPTCP Join selftests. So no reason to ignore it. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-2-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 4a5802126c8e..23aef214f30d 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -305,9 +305,6 @@ static void mptcp_pm_add_timer(struct timer_list *timer) if (inet_sk_state_load(sk) =3D=3D TCP_CLOSE) return; =20 - if (!entry->addr.id) - return; - bh_lock_sock(sk); if (sock_owned_by_user(sk)) { /* Try again later. */ --=20 2.53.0 From nobody Mon May 25 18:04:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34D93383334; Thu, 21 May 2026 03:28:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334132; cv=none; b=R9G9oxlfL9igjx5+PK2YKcyyR2Yp79po54p2IwpeD+2RVSJryw+O50fK6jysOBFqe6hN7bHFyoLzCYqH6e2KbGNw1o72a8xPHIyK7VUwttZ5QS9akeqNHfaZrLCIMgNogOw+8B6hD2IwRBQ6ZF0HQft4XDgmqLboKcpi/vFWioY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334132; c=relaxed/simple; bh=VbqCQ0mg1rJEhOqTkvrjuXs4O1VsCNj1JMKA1aYw8F8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TUMLu7qTcFH0G/+9CPI9zkf6Gb+zCu47bIwMt8SZVum+DwyfIdfPcJuLCil0M1SwomIckc5l24QRKEcig3R5DvkYACr++xiFss1HVEdRfpKPXcPsuvV4Rtipg9n4oJqD5IcP6DsqRZmoYPGt94F0SQOw8ffImizhtcG1JOKc0cU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d+00G8o5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d+00G8o5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDCC51F000E9; Thu, 21 May 2026 03:28:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779334131; bh=s12C8NbqqG7Wl4+Y9JAgy5v7YeKLMUddX4LUWVb6h/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=d+00G8o5UPpHv7NLIDxX0wzSQrduRAv/JMBRViSj4c2pgyECfYjlSh6hiIxOwWnpi EKbpbssBIQN8xxfF+at/cNJzw9EOeL62UKQMGuJe1uFZTFcc3wl+loHax519D58DA1 MLP6VjpiEyZRVVgJClH1+tgQu5SgQi6YYbReZcjTVqbtVfzif8dtDmeZAMRwTemwAO /IQXHjp1aoiwcxdqdIJXOqwxnxAsSSVqPoVOn+lHP1ujLfasnkzxAkXJKQ2RJigvoj ha71P2u5V8mjLINukw/tKIIbqzmBBK8+wPXelQIhDyeVeuVZCAoOj63NK1evYtfr/S ukD0HH7BZb/sQ== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.6.y 3/4] mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Date: Thu, 21 May 2026 05:19:10 +0200 Message-ID: <20260521031906.740857-9-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521031906.740857-6-matttbe@kernel.org> References: <20260521031906.740857-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1786; i=matttbe@kernel.org; h=from:subject; bh=VbqCQ0mg1rJEhOqTkvrjuXs4O1VsCNj1JMKA1aYw8F8=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4Ki/fL+Bg4TopuGq+Qsr/pZPdnu1RD3vxr6WA0W4SK /eX3cdNO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACayOpHhv9/8zeciRWYpnql9 9V3iYdmjlml/v9SzNlz0Vf/VfennsecM/0t8Xh1w+iTDs5thVd2OMzd5foi4pWZtnjFzN0/e6cf 7LVgB X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 9634cb35af17019baec21ca648516ce376fa10e6 upstream. When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 23aef214f30d..d087d5fc3067 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -299,11 +299,8 @@ static void mptcp_pm_add_timer(struct timer_list *time= r) =20 pr_debug("msk=3D%p\n", msk); =20 - if (!msk) - return; - - if (inet_sk_state_load(sk) =3D=3D TCP_CLOSE) - return; + if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + goto exit; =20 bh_lock_sock(sk); if (sock_owned_by_user(sk)) { @@ -341,6 +338,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) =20 out: bh_unlock_sock(sk); +exit: __sock_put(sk); } =20 --=20 2.53.0 From nobody Mon May 25 18:04:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A332360EDA; Thu, 21 May 2026 03:28:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334134; cv=none; b=snAMqaG2sKPDb4JEdxCY97L/Jvzm5BhUG1I7eGoh1Q/+1twjn3tcmRhdE4KuhnkEMF8Ww0ACQ3fYqxErDnt4lTz8AN7VUlAt4sn53hMTiMhDXfw7BVffQGRuYfWT93ghNj6DL2irWL2gkmOagsYb8WbGByru0/q8fXB+ahrDcNw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779334134; c=relaxed/simple; bh=+EKz2YWEsevHjjsdEbItlblGbtlBTzz6Gu87pVBShog=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U0/9tXnSYYxICylnKXAmzC7fqBNBNtr4b5UU3DKSJX12TQhN2ndbvtwTqpSrkaGPraJ0e9UBit/aM380ukxYtMeGoVgBZ12obpbZ92pyzHDeBEaszW2fCK2XaoEMwEAOIaFBIZe5xW8bVp3sI4M7iSeBIrbX5O/+5SRky5lu7WU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VJIVLTo9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VJIVLTo9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CA871F00A3B; Thu, 21 May 2026 03:28:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779334132; bh=IvmQM7KtjQLPFb+cpmG0733WucSAht7Ym65hoC3BQyo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VJIVLTo93w+r8K4gVougYLmuvOjlK+6FsFskXWQ84vVkTojxUacgoWhaBCcJMhd5C HsVmD1/oId6Ki1PDdbvi1OBWhF3WK2XTEW7gJb0pVOBzKG1U5MhI1v0vI9nd6uLvPb wt/QhTvIBftZz0V3D7srChkfP+JxEucETIqBBon3Cu7qkWKZQp/TMCDbogJa+q1hr2 dX7OPoFWpcrwvlBT9r9J4Bq0SrcfRlIsk9bkI4+Yk7DXIIlaE99Cl1Yy+pcree5s/3 DRb0lypakzhRgez1Wi/VzrPgwkAUzxR1LZBNg6/ZkyTD31ycUqTvNaqDZYoEGKhyyi UWePBw7cyCOvg== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.6.y 4/4] mptcp: pm: ADD_ADDR rtx: free sk if last Date: Thu, 21 May 2026 05:19:11 +0200 Message-ID: <20260521031906.740857-10-matttbe@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260521031906.740857-6-matttbe@kernel.org> References: <20260521031906.740857-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4118; i=matttbe@kernel.org; h=from:subject; bh=+EKz2YWEsevHjjsdEbItlblGbtlBTzz6Gu87pVBShog=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLL4Ku+VLndd0XSA9empVrPZp/R/POWv6IifuvijjcOah VveuCa/7ihlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZjIzlyGf7pGqt19Rk4TWSWv LLyx5VnJP5U6wZjrjIaOEQVPzbibYxgZ1ptH2j+7YbwvcsuWusaFh76IHTm11mvW3rX/r/uZJrd uYQMA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit b7b9a461569734d33d3259d58d2507adfac107ed upstream. When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on "itself". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ Applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c. Also, there were conflicts, because commit 30549eebc4d8 ("mptcp: make ADD_ADDR retransmission timeout adaptive") is not in this version and changed the context. Also, other conflicts were due to newer patches being backported with resolved conflicts before this one. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_netlink.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index d087d5fc3067..6e5570f97236 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -27,6 +27,7 @@ struct mptcp_pm_add_entry { struct list_head list; struct mptcp_addr_info addr; u8 retrans_times; + bool timer_done; struct timer_list add_timer; struct mptcp_sock *sock; struct rcu_head rcu; @@ -295,22 +296,22 @@ static void mptcp_pm_add_timer(struct timer_list *tim= er) struct mptcp_pm_add_entry *entry =3D from_timer(entry, timer, add_timer); struct mptcp_sock *msk =3D entry->sock; struct sock *sk =3D (struct sock *)msk; - unsigned int timeout; + unsigned int timeout =3D 0; =20 pr_debug("msk=3D%p\n", msk); =20 - if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) - goto exit; - bh_lock_sock(sk); + if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + goto out; + if (sock_owned_by_user(sk)) { /* Try again later. */ - sk_reset_timer(sk, timer, jiffies + HZ / 20); + timeout =3D HZ / 20; goto out; } =20 if (mptcp_pm_should_add_signal_addr(msk)) { - sk_reset_timer(sk, timer, jiffies + HZ); + timeout =3D HZ; goto out; } =20 @@ -327,9 +328,8 @@ static void mptcp_pm_add_timer(struct timer_list *timer) entry->retrans_times++; } =20 - if (entry->retrans_times < ADD_ADDR_RETRANS_MAX) - sk_reset_timer(sk, timer, - jiffies + timeout); + if (entry->retrans_times >=3D ADD_ADDR_RETRANS_MAX) + timeout =3D 0; =20 spin_unlock_bh(&msk->pm.lock); =20 @@ -337,9 +337,13 @@ static void mptcp_pm_add_timer(struct timer_list *time= r) mptcp_pm_subflow_established(msk); =20 out: + if (timeout) + sk_reset_timer(sk, timer, jiffies + timeout); + else + /* if sock_put calls sk_free: avoid waiting for this timer */ + entry->timer_done =3D true; bh_unlock_sock(sk); -exit: - __sock_put(sk); + sock_put(sk); } =20 struct mptcp_pm_add_entry * @@ -403,6 +407,7 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, =20 timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); reset_timer: + add_entry->timer_done =3D false; timeout =3D mptcp_get_add_addr_timeout(net); if (timeout) sk_reset_timer(sk, &add_entry->add_timer, jiffies + timeout); @@ -423,7 +428,8 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk) spin_unlock_bh(&msk->pm.lock); =20 list_for_each_entry_safe(entry, tmp, &free_list, list) { - sk_stop_timer_sync(sk, &entry->add_timer); + if (!entry->timer_done) + sk_stop_timer_sync(sk, &entry->add_timer); kfree_rcu(entry, rcu); } } --=20 2.53.0