From nobody Sat Jul 25 07:29:06 2026 Received: from sender4-of-o54.zoho.com (sender4-of-o54.zoho.com [136.143.188.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B91376025 for ; Sat, 11 Jul 2026 08:39:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.54 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759184; cv=pass; b=Ujawv1W60bSfc1kqeqgRDUcPaGK6kZXP7VCzHhaRHYXtwhCseQQZbXEx2FRAlw0zIKrL9bXaE5oDSXVl1OIdKAux8jzMGE+DJx6IBphaVaKJT8iM59XbdD+nddrWLvioZxWFdIVK3FsIyUVmErHMQ3059uF7Ssu4z6Wxn4quDF4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759184; c=relaxed/simple; bh=vOVV4Nq8xLoVDzWwHZbf3pIZ5RdvC+VyrXsdFD7nIRQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=fTFX6Zv+fHjUnwzhcRffyH7RbC71GKUNA3TCCjW2mrsgfuVTJKjEauHUsTl8RI+JYz4znFAG5mKXwx/y1ZUw5xv6BwbK7t73sk3aqrBXJbQ1NE3cs7L87BmVwuSTaMr+DXAsl9km75YUlsmjohraOrnHx29Rn5h5Ccs6BpqVPiE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; dkim=fail (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b=rWKhQFsA reason="key not found in DNS"; arc=pass smtp.client-ip=136.143.188.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b="rWKhQFsA" ARC-Seal: i=1; a=rsa-sha256; t=1783759166; cv=none; d=zohomail.com; s=zohoarc; b=jwmCZYPkanZLP6iFHMsGCGsOzt9kvqylQh9X3Mqdo+UwHLALWAeCTIJE1PRyzMF3gyijkKDRiwbr4Izeu6bq2fEzVCk8GVB66zY8icVS+IzIS2hQHxG6XL1pqoBth5/tHCjBwL5wbfAxE0X319dPTZarc2XOdJFMlVggcQvmfJc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783759166; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=JgKNGzKwEPTCNFdiK2pJ4noGSKYLVL5tPQd4kCy1LUQ=; b=S2u6QUlg/Np4+BIKeLHkZSTrmVg+/dWxll08X8WuSygLxe7XBeGgTxH8mJT0OMeohzYKZFFcbUBhB7crGbirI1XCFrU4SnkAWv1k/opEUnlOr2O7jnfsa+dq7OwthYQR7TyJzyu861A0xHQteeIfc3Kks6dKod7C+sAv7bDjBac= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=shardul.b@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1783759166; s=mpiric; d=mpiricsoftware.com; i=shardul.b@mpiricsoftware.com; h=From:From:Date:Date:Subject:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id:Message-Id:References:In-Reply-To:To:To:Cc:Cc:Reply-To; bh=JgKNGzKwEPTCNFdiK2pJ4noGSKYLVL5tPQd4kCy1LUQ=; b=rWKhQFsA0XTtERBlF1mlQPLBcDce6C5h3MrqItuLYFnWCfMtvZwWg0+IFi7LKoRf OHosFJHD7CGWImPPOZMx9hYiuubjj8hl6Mbm6F5vaAhTDUjSK5F6hjGYZyQZR5qnd7b RgQwu7Fv5RYKg8fXKpqFNh8dq2TQUtnv+fo+G7vw= Received: by mx.zohomail.com with SMTPS id 1783759164990138.62137875120504; Sat, 11 Jul 2026 01:39:24 -0700 (PDT) From: Shardul Bankar Date: Sat, 11 Jul 2026 14:09:15 +0530 Subject: [PATCH mptcp-next 1/3] Squash to "mptcp: pm: init and release mptcp_pm_ops" Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260711-mptcp_pm_ops_null_deref_join-v1-1-843ebd7ac0cf@mpiricsoftware.com> References: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> In-Reply-To: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> To: mptcp@lists.linux.dev, Geliang Tang Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Paolo Abeni , Kalpan Jani , Janak Patel , shardulsb08@gmail.com, Shardul Bankar X-Mailer: b4 0.15.2 X-ZohoMailClient: External msk->pm.ops is cleared here on the teardown path, but it is read locklessly from the softirq MP_JOIN path: mptcp_pm_get_local_id() and mptcp_pm_is_backup() are reached from subflow_token_join_request() on an inbound MP_JOIN, holding only a reference to the target msk (from mptcp_token_get_sock()) and without the socket lock. Annotate the store with WRITE_ONCE() to pair with the READ_ONCE() on those readers. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Shardul Bankar --- net/mptcp/pm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 033f783d49902..4d8f8c999b1de 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1158,7 +1158,10 @@ static void mptcp_pm_ops_release(struct mptcp_sock *= msk) { struct mptcp_pm_ops *pm_ops =3D msk->pm.ops; =20 - msk->pm.ops =3D NULL; + /* Paired with READ_ONCE() in the lockless softirq MP_JOIN readers + * mptcp_pm_is_backup() / mptcp_pm_get_local_id(). + */ + WRITE_ONCE(msk->pm.ops, NULL); if (pm_ops->release) pm_ops->release(msk); =20 --=20 2.34.1 From nobody Sat Jul 25 07:29:06 2026 Received: from sender4-of-o54.zoho.com (sender4-of-o54.zoho.com [136.143.188.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6764876025 for ; Sat, 11 Jul 2026 08:39:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.54 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759195; cv=pass; b=D9rUkXOnF0IzIWgycAv5Rdge6VMqrMYtURm+2P+NQ3mXaR9ucuZDdDy/NqshlF/XGYdvExqLtGNZXUIA0EWGXqohPIp3HH+WCJ7Fk9ccMXR3AiL/5jsLwJKpsMQAuYO81uYSHAc+s+FfGzFDL+ew3dDeeTmA4pMS1B33qhAcCEk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759195; c=relaxed/simple; bh=+7d61WKk/hsGU05gdYD7Vvctnh7ia+gBc//kClt5XnY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Vy+YU9wbHF/FdJo9RucmqFVhTxvcHny47gnEFINuf8ucVHi+GmD2gm2lN47d8LkQhyES/znmR8q+C+3msu/DhF2Bb89XR8fitpKCbF3bv59VN2XWXbZelz8rGJ4pNRbyQCq2t2VDztg0fSHM9QzbJpPA/nsapH6XHJHihTvaLqI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; dkim=fail (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b=ObXpjdgu reason="key not found in DNS"; arc=pass smtp.client-ip=136.143.188.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b="ObXpjdgu" ARC-Seal: i=1; a=rsa-sha256; t=1783759170; cv=none; d=zohomail.com; s=zohoarc; b=cVjyzHdYLAAT/RFKzGBDFBFrO37CK7POwi2Q1hWhnKXWvfXebjEQiCGI2bA/k8RI42/nCU6gAX7R4NpRRfkclOPyg59cc31ZKkukHeK2QS5ef/9fykg9hxQtQr2Ru6JuCHA97JP3bjpTVYLiD+Bf3UoTowiTlyayUH0otJqvebQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783759170; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=X6cnuxp5eMD9k4nHWN906RkVLSWAlJ49/k3hgCqEKU4=; b=DhTZ9JYlGFo+dcyCSdAeO/ssQPc4zchW1OT9i3GgahWXM6j3jW8QzKBxAIn7a+kFSI1R5S7oMrNMDLuM+Pw4lUqDvezCN5072Q1JJgBWjvfNdnpvNZ0K8HpS054PzKMPPAI0XRqnj5DguGexzjBJ1dbhok4u388ryg9nmfB6+ww= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=shardul.b@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1783759170; s=mpiric; d=mpiricsoftware.com; i=shardul.b@mpiricsoftware.com; h=From:From:Date:Date:Subject:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id:Message-Id:References:In-Reply-To:To:To:Cc:Cc:Reply-To; bh=X6cnuxp5eMD9k4nHWN906RkVLSWAlJ49/k3hgCqEKU4=; b=ObXpjdguiiDK0iY+V6q/ZaDbbnNcZDyxFucKbfv8lkgjwI3/1VJAH/etauPLH80G 2CumUumecVoucU4CPPd3EiQl3WCR3wjHN+3bkwu1DF/0VqdW2ZOZ29WXxdl/+VcnO5F FNr8cp/7ZfWp4TRZQ710fwn4giXV/bfQXTTotA/g= Received: by mx.zohomail.com with SMTPS id 1783759168991218.31095441719276; Sat, 11 Jul 2026 01:39:28 -0700 (PDT) From: Shardul Bankar Date: Sat, 11 Jul 2026 14:09:16 +0530 Subject: [PATCH mptcp-next 2/3] Squash to "mptcp: pm: add get_local_id() interface" Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260711-mptcp_pm_ops_null_deref_join-v1-2-843ebd7ac0cf@mpiricsoftware.com> References: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> In-Reply-To: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> To: mptcp@lists.linux.dev, Geliang Tang Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Paolo Abeni , Kalpan Jani , Janak Patel , shardulsb08@gmail.com, Shardul Bankar X-Mailer: b4 0.15.2 X-ZohoMailClient: External mptcp_pm_get_local_id() now dereferences msk->pm.ops, but it is reached from subflow_token_join_request() on an inbound MP_JOIN, in softirq and holding only a reference to the target msk (from mptcp_token_get_sock()), without the socket lock. A concurrent close()/disconnect() can clear pm.ops via mptcp_pm_ops_release() in between. Read pm.ops once with READ_ONCE() and return an error if it is NULL; the join is then rejected, which is the expected outcome on a closing connection. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Shardul Bankar --- net/mptcp/pm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 4d8f8c999b1de..4fcd9d30b3df2 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1029,6 +1029,7 @@ int mptcp_pm_get_local_id(struct mptcp_sock *msk, str= uct sock_common *skc) { struct mptcp_pm_addr_entry skc_local =3D { 0 }; struct mptcp_addr_info msk_local; + struct mptcp_pm_ops *pm_ops; =20 if (WARN_ON_ONCE(!msk)) return -1; @@ -1044,7 +1045,14 @@ int mptcp_pm_get_local_id(struct mptcp_sock *msk, st= ruct sock_common *skc) skc_local.addr.id =3D 0; skc_local.flags =3D MPTCP_PM_ADDR_FLAG_IMPLICIT; =20 - return msk->pm.ops->get_local_id(msk, &skc_local); + /* See mptcp_pm_is_backup(): reached locklessly from the softirq + * MP_JOIN path, racing a concurrent mptcp_pm_ops_release(). + */ + pm_ops =3D READ_ONCE(msk->pm.ops); + if (!pm_ops) + return -1; + + return pm_ops->get_local_id(msk, &skc_local); } =20 bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc) --=20 2.34.1 From nobody Sat Jul 25 07:29:06 2026 Received: from sender4-of-o54.zoho.com (sender4-of-o54.zoho.com [136.143.188.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34A4F76025 for ; Sat, 11 Jul 2026 08:40:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.54 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759205; cv=pass; b=OFKtxX54PPiE+o9R+xyhqTwNTV4B95GhreKdsxS5/wXITZaYHGcPGvJ+yyqai5shoSYhoNBgZA1PSaO4gpYpe0Ot/Wf7mNOdaL/lpcemlfkC0T5EuwCFkL2CzPMuGwA94qWhu/gEd6Y7vub70Nbl1oL3v+a2ZwDuOuiS7DRDopg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783759205; c=relaxed/simple; bh=HNKSA7c1i5wbb8TQbTZqG7h7kVtQ0XTLf98DNlOUu6c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KmrNgGIj81FWUIF5dKJgR0s2tAKIaL30krVaTYXmTVeRqtJT0v9LTXQmRPGBm3yLgncJigI1vYDYjOHXhN6CUycWunlfZ80Gcq5kEQvFAg/FxOhnVJDPxjtqu/fHfrKxnqoOpkR6Cjl0hYhkUl1n3zdRImuo3iO8956QMFiTJPk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; dkim=fail (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b=E8Fkb9GV reason="key not found in DNS"; arc=pass smtp.client-ip=136.143.188.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mpiricsoftware.com header.i=shardul.b@mpiricsoftware.com header.b="E8Fkb9GV" ARC-Seal: i=1; a=rsa-sha256; t=1783759174; cv=none; d=zohomail.com; s=zohoarc; b=gRaPB1Xx23LXJJssTy6puNERMJPU6DxpHBhE5Wm4QDUyBqSkdR5CJ0s5RN/0qXNucrK/8uRBJiuNGFXrGtl1QtjVIb8qK4sSaBwytof5fnC9aijAtCwmgSYZXNXuUnMIFmbfY8gYoTd6UvC8h6kfHXEyCCyGbyooUzPaO7kl7Qs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783759174; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=wKPo4d3mhxkkvOVzujMQBOsPO10/UeKpMRPM/iuL05I=; b=n+TDtYCadqnbRb61TPpUdomXmCMBDeGD+lf8SsREDjDhK+ncOStjVADmYwRPu1F6X6NpHxrKItmojoBc66oY5Yi/5dcpfYfbMiWTPe4vDNrn8m2lXTfSJbldXqBKxndFUSho2MKrIiNc/bFPg2R/h42aPlvCNN4Y4IhVhc+rhwY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=shardul.b@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1783759174; s=mpiric; d=mpiricsoftware.com; i=shardul.b@mpiricsoftware.com; h=From:From:Date:Date:Subject:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id:Message-Id:References:In-Reply-To:To:To:Cc:Cc:Reply-To; bh=wKPo4d3mhxkkvOVzujMQBOsPO10/UeKpMRPM/iuL05I=; b=E8Fkb9GVBadXR4OXNDOC7MITn050rh3vEMBA89OaIDNtLL0BiDS9tBfvG81u5XOt h+lue4m8rbqjWLZptMJzQGdLSNkqKGnNz57U/sk8gvJEnuxZHLvfz7nhfviN/fE6ezi nikBOrJKLwbquWuHuJByCvQ77qlZbjDGqTsiqqwQ= Received: by mx.zohomail.com with SMTPS id 1783759172771190.37490046917708; Sat, 11 Jul 2026 01:39:32 -0700 (PDT) From: Shardul Bankar Date: Sat, 11 Jul 2026 14:09:17 +0530 Subject: [PATCH mptcp-next 3/3] Squash to "mptcp: pm: add get_priority() interface" Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260711-mptcp_pm_ops_null_deref_join-v1-3-843ebd7ac0cf@mpiricsoftware.com> References: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> In-Reply-To: <20260711-mptcp_pm_ops_null_deref_join-v1-0-843ebd7ac0cf@mpiricsoftware.com> To: mptcp@lists.linux.dev, Geliang Tang Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Paolo Abeni , Kalpan Jani , Janak Patel , shardulsb08@gmail.com, Shardul Bankar X-Mailer: b4 0.15.2 X-ZohoMailClient: External mptcp_pm_is_backup() now dereferences msk->pm.ops, but like mptcp_pm_get_local_id() it is reached from subflow_token_join_request() on an inbound MP_JOIN, in softirq and holding only a reference to the target msk, without the socket lock. A concurrent close()/disconnect() clearing pm.ops via mptcp_pm_ops_release() between the token lookup and the dereference triggers a NULL pointer dereference of ->get_priority. Read pm.ops once with READ_ONCE() and return false if it is NULL, the safe default for the backup hint (the join is already rejected by mptcp_pm_get_local_id() if it observed the same NULL). Found by an MPTCP protocol-flow harness extending BRF (arXiv:2305.08782), which drives inbound MP_JOINs against a connection under teardown. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Shardul Bankar --- net/mptcp/pm.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 4fcd9d30b3df2..12cb2f7b5af92 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1058,10 +1058,20 @@ int mptcp_pm_get_local_id(struct mptcp_sock *msk, s= truct sock_common *skc) bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc) { struct mptcp_addr_info skc_local; + struct mptcp_pm_ops *pm_ops; + + /* Paired with WRITE_ONCE() in mptcp_pm_ops_release(). An inbound + * MP_JOIN reaches this via subflow_token_join_request() on a msk + * obtained from mptcp_token_get_sock(), i.e. holding only a refcount + * and no socket lock, so a concurrent teardown may NULL pm.ops. + */ + pm_ops =3D READ_ONCE(msk->pm.ops); + if (!pm_ops) + return false; =20 mptcp_local_address((struct sock_common *)skc, &skc_local); =20 - return msk->pm.ops->get_priority(msk, &skc_local); + return pm_ops->get_priority(msk, &skc_local); } =20 static void mptcp_pm_subflows_chk_stale(const struct mptcp_sock *msk, stru= ct sock *ssk) --=20 2.34.1