[PATCH mptcp-next 0/3] mptcp: pm: guard the lockless MP_JOIN path against a NULL pm.ops

Shardul Bankar posted 3 patches 1 week, 6 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/multipath-tcp/mptcp_net-next tags/patchew/20260711-mptcp._5Fpm._5Fops._5Fnull._5Fderef._5Fjoin-v1-0-843ebd7ac0cf@mpiricsoftware.com
net/mptcp/pm.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
[PATCH mptcp-next 0/3] mptcp: pm: guard the lockless MP_JOIN path against a NULL pm.ops
Posted by Shardul Bankar 1 week, 6 days ago
The pluggable path-manager series converts mptcp_pm_get_local_id() and
mptcp_pm_is_backup() to dereference msk->pm.ops. Both are reached from
subflow_token_join_request() on an inbound MP_JOIN, in softirq and holding
only a reference to the target msk (from mptcp_token_get_sock()), without the
socket lock. A concurrent close()/disconnect() can clear pm.ops via
mptcp_pm_ops_release() in between, so the join path dereferences a NULL
pm.ops (a KASAN null-ptr-deref of ->get_priority in softirq).

Found by an MPTCP protocol-flow harness extending BRF (arXiv:2305.08782),
which drives inbound MP_JOINs against a connection under teardown.

Guard both readers with READ_ONCE() and bail out when pm.ops is NULL, paired
with WRITE_ONCE() in mptcp_pm_ops_release(). The affected commits are still in
the export tree, so this is three squash-to fixups, one per introducing commit.

Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
Shardul Bankar (3):
      Squash to "mptcp: pm: init and release mptcp_pm_ops"
      Squash to "mptcp: pm: add get_local_id() interface"
      Squash to "mptcp: pm: add get_priority() interface"

 net/mptcp/pm.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)
---
base-commit: e6ce9ffe5d02034a38e8bca7b78a7f58aff8caae
change-id: 20260711-mptcp_pm_ops_null_deref_join-a2f8e56832b4

Best regards,
--  
Shardul Bankar <shardul.b@mpiricsoftware.com>
Re: [PATCH mptcp-next 0/3] mptcp: pm: guard the lockless MP_JOIN path against a NULL pm.ops
Posted by MPTCP CI 1 week, 6 days ago
Hi Shardul,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/29147647219

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/1143323d7dd7
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1125769


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)