From nobody Sun Jul 5 05:54:13 2026 Received: from sender4-of-o54.zoho.com (sender4-of-o54.zoho.com [136.143.188.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2185B2DECCB for ; Tue, 30 Jun 2026 15:07:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.54 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782832028; cv=pass; b=bJ5klpX6golecgi8bTDFy+gMI2QWBK1RnENiFv4+1NUNvgOlyIHVgq+xVCbvmZ/kvYmShhd8TLRGuC8KPUg4AKiPyanhwgMavmCjIaxxJvICu5DTdNwBVkYHIhN4OHXHqPe9KnZX0L/M/1O4mL4kvsmBlZVHluILE0HntnYjiSg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782832028; c=relaxed/simple; bh=Up3ZDwApkdxTgtbSeMmDIdRtnMrA+b19I3/+YDcmI4c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qgXlgxcfQRA3Bhc29RDk+mnDPYM20xZyrNIY1jjrtGS/YvuquVJYBhFOSzSpOKN9I066qxYVMlaJHul3t0o1Hdvr8koIxvILn7n6Lrnd7JXxBBhxpN4n+yTrnMYg2xh2Qs4Oe9dj/6gBeGzR6UT/wuctBcDcyNc5hsumKoC2hUc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; dkim=fail (0-bit key) header.d=mpiricsoftware.com header.i=kalpan.jani@mpiricsoftware.com header.b=oFfb5jPo reason="key not found in DNS"; arc=pass smtp.client-ip=136.143.188.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mpiricsoftware.com header.i=kalpan.jani@mpiricsoftware.com header.b="oFfb5jPo" ARC-Seal: i=1; a=rsa-sha256; t=1782832011; cv=none; d=zohomail.com; s=zohoarc; b=EjdkKRagfKBKAOh2gKzzvlGcpHll9gyFb0YE5xSJP67AJ4JEpsMmguzOLlaO1ufq1i6k2/yVNbu874xF03OrYBHpElVsEgG6JhZS78Yt+ejH+fAI5YErGl40GvOJbeuDa96iegORA5zSe2NgeY48Ar0YfjoV5QE2HlHwYooUnak= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782832011; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=s7yKRg9/9Oi9C3gzjcSZR+m8myxKY6EU5ULgRbIQpxI=; b=HXVGHj4TRppZmBsHvD+U17m8pta5OObEleHoA+OkfTA6zR4y7mN+ZQVSSSxzExZeaZV0gHn0Z35xsLsk1RopYR37tu/5uu1xTHEIV7v9fw/srBcfbny3rEVkKAhsfLBG2787V07TypVtweMd8TVkWc9bCPlC61A1yJPwn79iwt0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=kalpan.jani@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1782832011; s=mpiric; d=mpiricsoftware.com; i=kalpan.jani@mpiricsoftware.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=s7yKRg9/9Oi9C3gzjcSZR+m8myxKY6EU5ULgRbIQpxI=; b=oFfb5jPoB1Cu0MYIPb3Uuwvdd6D7U4ZRXkokKCWNkkonN+UsHvdV8mqltqztgF/4 HabRM6sYZpxt1Q9acCh+vHOU8NS/8cbQFYBbO5A10P4DO+JYN1RmU28bClaYFzJWac5 HTS6w9A44oUBixi/XMRdncoJi7rIyLdlOXqW/Bkc= Received: by mx.zohomail.com with SMTPS id 1782832008784984.89779295814; Tue, 30 Jun 2026 08:06:48 -0700 (PDT) From: Kalpan Jani To: mptcp@lists.linux.dev Cc: matttbe@kernel.org, martineau@kernel.org, pabeni@redhat.com, shardul.b@mpiricsoftware.com, janak@mpiric.us, kalpanjani009@gmail.com, akshit@mpiricsoftware.com, Kalpan Jani , syzbot+55c2a5c871441261ed14@syzkaller.appspotmail.com, Tao Cui Subject: [PATCH net v5 1/2] mptcp: pm: drop pending ADD_ADDR when removing id 0 endpoint Date: Tue, 30 Jun 2026 20:36:31 +0530 Message-ID: <20260630150632.899750-2-kalpan.jani@mpiricsoftware.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260630150632.899750-1-kalpan.jani@mpiricsoftware.com> References: <20260630150632.899750-1-kalpan.jani@mpiricsoftware.com> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not tear down pending announcements, unlike the non-zero id path. When the PM later reselects id 0 after adding another signal endpoint, it finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel()) in mptcp_pm_alloc_anno_list(). Root cause: asymmetry between removal paths. - Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls mptcp_pm_remove_anno_addr() to clean up. - Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely. Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove() and decrement add_addr_signaled before queuing the RM_ADDR. Subtle detail: signal endpoints are stored in anno_list with port 0, but msk_local carries the connection's local port. mptcp_pm_announced_remove() uses use_port=3Dtrue for comparison, so clear the port before the lookup. Fixes: 740d798e8767 ("mptcp: remove id 0 address") Reported-by: syzbot+55c2a5c871441261ed14@syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/620 Suggested-by: Tao Cui Signed-off-by: Kalpan Jani --- net/mptcp/pm_kernel.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index 331f6fa99014..d3014bf57bf3 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c @@ -1138,6 +1138,8 @@ static int mptcp_nl_remove_id_zero_address(struct net= *net, while ((msk =3D mptcp_token_iter_next(net, &s_slot, &s_num)) !=3D NULL) { struct sock *sk =3D (struct sock *)msk; struct mptcp_addr_info msk_local; + struct mptcp_addr_info anno_addr; + bool announced; =20 if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk)) goto next; @@ -1147,7 +1149,13 @@ static int mptcp_nl_remove_id_zero_address(struct ne= t *net, goto next; =20 lock_sock(sk); + /* Drop a possibly pending ADD_ADDR for this address. */ + anno_addr =3D msk_local; + anno_addr.port =3D 0; + announced =3D mptcp_pm_announced_remove(msk, &anno_addr); spin_lock_bh(&msk->pm.lock); + if (announced) + msk->pm.add_addr_signaled--; mptcp_pm_remove_addr(msk, &list); mptcp_pm_rm_subflow(msk, &list); __mark_subflow_endp_available(msk, 0); --=20 2.43.0 From nobody Sun Jul 5 05:54:13 2026 Received: from sender4-of-o54.zoho.com (sender4-of-o54.zoho.com [136.143.188.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DBCD319852 for ; Tue, 30 Jun 2026 15:07:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.54 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782832049; cv=pass; b=LppMBMd+O+/FI2jrARn/sdWVnxhlywQ6oj2EjsQFOgURtmUJdys0RA1kd74t9T+Vq06TIC0Uj+gPcShJPKBjtdolAt/QEuZN8f3EqZ//u1TQ0px1Q3OYI5YMD2Vn5WDpHq37VgYaQ6MwqMR3l2Rir++rlssaQbK2/Twbig5yKWM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782832049; c=relaxed/simple; bh=3jRzh6OB28z5vZ4rEqdipq//8uA8gjUTGN7R31oDzvA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gI/KNXRuNuHGDPHw1CCZv+9FBORmCkFgooP8YHEV4CQugEQOduhtyxCo0rQK63b2r1IMPS+tAcQ+3dMhEoyJnPxTe1SB+DTugUd3E5MZJxcP0ov83HuLv/bnvHh9LNtTqCqZ5IwJa/LoMWgY0WVUQyx7vKxvEls7CwzmwgwPDbM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; dkim=fail (0-bit key) header.d=mpiricsoftware.com header.i=kalpan.jani@mpiricsoftware.com header.b=sJj/Nn3c reason="key not found in DNS"; arc=pass smtp.client-ip=136.143.188.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mpiricsoftware.com header.i=kalpan.jani@mpiricsoftware.com header.b="sJj/Nn3c" ARC-Seal: i=1; a=rsa-sha256; t=1782832017; cv=none; d=zohomail.com; s=zohoarc; b=TEVHQlCXgmJ50t5C86O0zH5Ir5oXK6O37DtvHN9TJuPfbc1uKw1Im44sMNExn7Av+dalMsfCfivW12cmNRf0lGgm9LG6rJmJcoKRZKki4KfHG7Vlip171sz8ARxQhNK4+k4lKL2HAKpkG8az4S9bivpZr1ArimjptONund89awg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782832017; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=h416sGqVgtFIf8IrsvPeVuYKWINAHvt7aZmWVji5QxQ=; b=ZMxlboQKmPwYBjTiNtVZXzbhke3DtE3U6QYscLQiwYsRpgC+QroDJCQfk0b3Y2Qa3+M4mVI/SR4N1O8++rpiSXwzriHgjXOtDfj/m7jrR4A+P3Fmd8Tgn60eMuRuDday/QPlsaxIJCsbixcjAM++2e+S8ePWNWi+84lAmXbVo7w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=kalpan.jani@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1782832017; s=mpiric; d=mpiricsoftware.com; i=kalpan.jani@mpiricsoftware.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=h416sGqVgtFIf8IrsvPeVuYKWINAHvt7aZmWVji5QxQ=; b=sJj/Nn3c+eet9Zomqd0K6kZQl67amXtNy6XTKcUFBFmTboCqCAe2RPdCUC9yk8eS Z0VNmirgN/w0sUJ1/O5VIxbRL7K06C6Rr595mJQXuc4knMHno4ETS1zdydZNYjqadGE iIGQRDqLkytPhp0IqxopEgWDg50vu0znYihMFfjA= Received: by mx.zohomail.com with SMTPS id 1782832014579955.5500305277944; Tue, 30 Jun 2026 08:06:54 -0700 (PDT) From: Kalpan Jani To: mptcp@lists.linux.dev Cc: matttbe@kernel.org, martineau@kernel.org, pabeni@redhat.com, shardul.b@mpiricsoftware.com, janak@mpiric.us, kalpanjani009@gmail.com, akshit@mpiricsoftware.com, Kalpan Jani , Tao Cui Subject: [PATCH net v5 2/2] selftests: mptcp: add id 0 stale ADD_ADDR regression test Date: Tue, 30 Jun 2026 20:36:32 +0530 Message-ID: <20260630150632.899750-3-kalpan.jani@mpiricsoftware.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260630150632.899750-1-kalpan.jani@mpiricsoftware.com> References: <20260630150632.899750-1-kalpan.jani@mpiricsoftware.com> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" Add regression test for issue #620 to the mptcp_join.sh suite: removing the id 0 endpoint while a pending ADD_ADDR echo is outstanding used to leave a stale anno_list entry. A subsequent PM reselection would re-announce that address and trigger WARN_ON_ONCE() in mptcp_pm_alloc_anno_list(). The test verifies no WARNING appears when removing id 0 from a fully- established MPTCP connection with a signal endpoint. Co-developed-by: Tao Cui Signed-off-by: Tao Cui Tested-by: Tao Cui Signed-off-by: Kalpan Jani --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 550a6b6117a9..d45c3b670fdd 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -2775,6 +2775,16 @@ remove_tests() chk_rm_nr 1 1 invert chk_rst_nr 0 0 invert fi + # id 0 stale anno list entry (issue #620) + if reset "id 0 stale anno"; then + pm_nl_set_limits $ns1 0 1 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + pm_nl_set_limits $ns2 1 1 + addr_nr_ns1=3D-1 speed=3Dslow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_add_nr 1 1 + chk_rm_nr 1 1 invert + fi } =20 add_tests() --=20 2.43.0