The pluggable path-manager series converts mptcp_pm_get_local_id() and
mptcp_pm_is_backup() to dereference msk->pm.ops. Both are reached from
subflow_token_join_request() on an inbound MP_JOIN, in softirq and holding
only a reference to the target msk (from mptcp_token_get_sock()), without the
socket lock. A concurrent close()/disconnect() can clear pm.ops via
mptcp_pm_ops_release() in between, so the join path dereferences a NULL
pm.ops (a KASAN null-ptr-deref of ->get_priority in softirq).
Found by an MPTCP protocol-flow harness extending BRF (arXiv:2305.08782),
which drives inbound MP_JOINs against a connection under teardown.
Guard both readers with READ_ONCE() and bail out when pm.ops is NULL, paired
with WRITE_ONCE() in mptcp_pm_ops_release(). The affected commits are still in
the export tree, so this is three squash-to fixups, one per introducing commit.
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
Shardul Bankar (3):
Squash to "mptcp: pm: init and release mptcp_pm_ops"
Squash to "mptcp: pm: add get_local_id() interface"
Squash to "mptcp: pm: add get_priority() interface"
net/mptcp/pm.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
---
base-commit: e6ce9ffe5d02034a38e8bca7b78a7f58aff8caae
change-id: 20260711-mptcp_pm_ops_null_deref_join-a2f8e56832b4
Best regards,
--
Shardul Bankar <shardul.b@mpiricsoftware.com>