From nobody Sat Sep 26 16:39:32 2026 Received: from mta0.migadu.com (out-35.mta0.migadu.com [91.218.175.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77EAF396590 for ; Mon, 24 Aug 2026 07:36:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.35 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556995; cv=none; b=NjBqbIgH00yaZZvZ8iLigUcNEosKAtxLIWsKzY11sbAL5Ta1/9kloKWyjEbEt/G95aTQp76eWPFw8kgqeiQL4Z3IvrHX2EBmoaqcxbGmg3ddpDrmV4q/krAwJXTc+pFJBo5CubNuAabkP0iTApCmhpSBxc7CQSKKLFj/1OhBhiQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556995; c=relaxed/simple; bh=XPeup+fSlPhSkibuRnyl9GWzphD6LKQJc9aNTcWsTZg=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ie39zgG7G4EpfAEENTyCt3t7ehrh6mR5sxtl0E4VK8588/6FbbdoJx2z12xYbz1phV4HkEYX5muYBT0Msk1vzNTu141G7dAIfuuRbHgWuR2zb3jDUDkDieyzFOd9FIu4SZ+1wUiGorJ++3P5pqGRQ7O6/JZ6CYjeDf++/pjaM3I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=tD0nTnqJ; arc=none smtp.client-ip=91.218.175.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="tD0nTnqJ" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=XPeup+fSlPhSkibuRnyl9GWzphD6LKQJc9aNTcWsTZg=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556990; v=1; x=1788161790; b=tD0nTnqJ3aHj0jxb4yEg8IS9oZew1uLXzsNBh2kPK7ospfnXQ2S6cFz/tCL0PkgQwx396zQE QRqVZr2SEiOFNn6+YpAzBrpGHT1zN6wPL7rT0YFBP9lyhuRdLGpt4fOZV2NUhKL33VeLXVjsNvu ck92DmRZuR6xw/ap6LnKHORA= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id 111897fa57af6ad5; Mon, 24 Aug 2026 07:36:30 +0000 X-Mizu-Trace-ID: 111897fa57af6ad5 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 1/6] mptcp: sched: change scheduler sysctl atomically Date: Mon, 24 Aug 2026 15:36:20 +0800 Message-ID: <20260824073625.57471-2-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan The per-netns scheduler name is stored as an inline char[] buffer and updated via strscpy() from the sysctl handler. A concurrent reader (e.g. mptcp_init_sock() resolving the default scheduler) can observe a half-written name, which is also flagged by KCSAN. READ_ONCE() does not help here as it cannot read a multi-byte string atomically. Following the tcp_congestion_control() model, store a pointer to the immutable struct mptcp_sched_ops instead of the name string. A pointer store is a single atomic word, so readers always observe a consistent value, and mptcp_get_scheduler() can now return the ops directly instead of going through mptcp_sched_find() again. Assisted-by: Claude:GLM5.2 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/626 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 63 +++++++++++++++++++++++++++++++++++--------- net/mptcp/protocol.c | 3 +-- net/mptcp/protocol.h | 3 ++- net/mptcp/sched.c | 2 +- 4 files changed, 54 insertions(+), 17 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 63c5747f0f63..7d0f3421bd04 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -39,7 +39,7 @@ struct mptcp_pernet { u8 allow_join_initial_addr_port; u8 pm_type; u8 add_addr_v6_port_drop_ts; - char scheduler[MPTCP_SCHED_NAME_MAX]; + struct mptcp_sched_ops __rcu *scheduler; char path_manager[MPTCP_PM_NAME_MAX]; }; =20 @@ -90,9 +90,17 @@ const char *mptcp_get_path_manager(const struct net *net) return mptcp_get_pernet(net)->path_manager; } =20 -const char *mptcp_get_scheduler(const struct net *net) +static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) { - return mptcp_get_pernet(net)->scheduler; + struct mptcp_sched_ops *sched; + + sched =3D rcu_dereference(pernet->scheduler); + return sched ? sched : &mptcp_sched_default; +} + +struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net) +{ + return mptcp_pernet_sched(mptcp_get_pernet(net)); } =20 unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net) @@ -112,23 +120,33 @@ static void mptcp_pernet_set_defaults(struct mptcp_pe= rnet *pernet) pernet->allow_join_initial_addr_port =3D 1; pernet->stale_loss_cnt =3D 4; pernet->pm_type =3D MPTCP_PM_TYPE_KERNEL; - strscpy(pernet->scheduler, "default", sizeof(pernet->scheduler)); + + if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) + RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); + strscpy(pernet->path_manager, "kernel", sizeof(pernet->path_manager)); pernet->add_addr_v6_port_drop_ts =3D 1; } =20 #ifdef CONFIG_SYSCTL -static int mptcp_set_scheduler(char *scheduler, const char *name) +static int mptcp_set_scheduler(struct mptcp_pernet *pernet, const char *na= me) { - struct mptcp_sched_ops *sched; + struct mptcp_sched_ops *sched, *prev; int ret =3D 0; =20 rcu_read_lock(); sched =3D mptcp_sched_find(name); - if (sched) - strscpy(scheduler, name, MPTCP_SCHED_NAME_MAX); - else + if (sched) { + if (bpf_try_module_get(sched, sched->owner)) { + prev =3D xchg(&pernet->scheduler, sched); + if (prev) + bpf_module_put(prev, prev->owner); + } else { + ret =3D -EBUSY; + } + } else { ret =3D -ENOENT; + } rcu_read_unlock(); =20 return ret; @@ -137,7 +155,9 @@ static int mptcp_set_scheduler(char *scheduler, const c= har *name) static int proc_scheduler(const struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *ppos) { - char (*scheduler)[MPTCP_SCHED_NAME_MAX] =3D ctl->data; + struct mptcp_pernet *pernet =3D container_of(ctl->data, + struct mptcp_pernet, + scheduler); char val[MPTCP_SCHED_NAME_MAX]; struct ctl_table tbl =3D { .data =3D val, @@ -145,11 +165,13 @@ static int proc_scheduler(const struct ctl_table *ctl= , int write, }; int ret; =20 - strscpy(val, *scheduler, MPTCP_SCHED_NAME_MAX); + rcu_read_lock(); + strscpy(val, mptcp_pernet_sched(pernet)->name, MPTCP_SCHED_NAME_MAX); + rcu_read_unlock(); =20 ret =3D proc_dostring(&tbl, write, buffer, lenp, ppos); if (write && ret =3D=3D 0) - ret =3D mptcp_set_scheduler(*scheduler, val); + ret =3D mptcp_set_scheduler(pernet, val); =20 return ret; } @@ -563,18 +585,33 @@ void mptcp_active_detect_blackhole(struct sock *ssk, = bool expired) static int __net_init mptcp_net_init(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + int ret; =20 mptcp_pernet_set_defaults(pernet); =20 - return mptcp_pernet_new_table(net, pernet); + ret =3D mptcp_pernet_new_table(net, pernet); + if (ret) { + struct mptcp_sched_ops *sched; + + sched =3D rcu_dereference_protected(pernet->scheduler, true); + if (sched) + bpf_module_put(sched, sched->owner); + } + + return ret; } =20 /* Note: the callback will only be called per extra netns */ static void __net_exit mptcp_net_exit(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + struct mptcp_sched_ops *sched; =20 mptcp_pernet_del_table(pernet); + + sched =3D rcu_dereference_protected(pernet->scheduler, true); + if (sched) + bpf_module_put(sched, sched->owner); } =20 static struct pernet_operations mptcp_pernet_ops =3D { diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index c2762d74f29d..4d7cb50ec61a 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3271,8 +3271,7 @@ static int mptcp_init_sock(struct sock *sk) return -ENOMEM; =20 rcu_read_lock(); - ret =3D mptcp_init_sched(mptcp_sk(sk), - mptcp_sched_find(mptcp_get_scheduler(net))); + ret =3D mptcp_init_sched(mptcp_sk(sk), mptcp_get_scheduler(net)); rcu_read_unlock(); if (ret) return ret; diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 7e168e450fb0..6447945be93c 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -803,7 +803,7 @@ unsigned int mptcp_stale_loss_cnt(const struct net *net= ); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); const char *mptcp_get_path_manager(const struct net *net); -const char *mptcp_get_scheduler(const struct net *net); +struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 void mptcp_active_disable(struct sock *sk); @@ -1155,6 +1155,7 @@ int mptcp_pm_remove_addr(struct mptcp_sock *msk, cons= t struct mptcp_rm_list *rm_ =20 /* the default path manager, used in mptcp_pm_unregister */ extern struct mptcp_pm_ops mptcp_pm_kernel; +extern struct mptcp_sched_ops mptcp_sched_default; =20 struct mptcp_pm_ops *mptcp_pm_find(const char *name); int mptcp_pm_register(struct mptcp_pm_ops *pm_ops); diff --git a/net/mptcp/sched.c b/net/mptcp/sched.c index 1e59072d478c..0d13ee46ffdf 100644 --- a/net/mptcp/sched.c +++ b/net/mptcp/sched.c @@ -40,7 +40,7 @@ static int mptcp_sched_default_get_retrans(struct mptcp_s= ock *msk) return 0; } =20 -static struct mptcp_sched_ops mptcp_sched_default =3D { +struct mptcp_sched_ops mptcp_sched_default =3D { .get_send =3D mptcp_sched_default_get_send, .get_retrans =3D mptcp_sched_default_get_retrans, .name =3D "default", --=20 2.43.0 From nobody Sat Sep 26 16:39:32 2026 Received: from mta0.migadu.com (out-36.mta0.migadu.com [91.218.175.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BE88248F72 for ; Mon, 24 Aug 2026 07:36:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.36 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556995; cv=none; b=n5UpWa/1fcnPWpYUmjHTfccsROTyjMFq7YKDmrRdLGXteb0umYtMKWV2RlJ50tOi6mEboWxDv2yQfp4bKotdNE39jKxqx8qmp1jXdd8Bxtx9Eif986RFf+F7NBEfNLINfOZ3FlTROiGCson3XxyqZ1avpoolO604nLRSu0pacS8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556995; c=relaxed/simple; bh=IMDn9PKn0X3yRRWxYnjSO8ew4F2KumDV0Kt9fDXbys8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hQ0GMTUNJIVnhaMku/Svf6KT80C5QEv7gt3uWyzkvw3i/Bk3hCa0WMVwO7h6kD+O13l8Vr39xHJ610bASE9Bs7yEX2va0z1IblVC3RqfXaEMD1YcUaupDjE/TzUcsvf+qcVHSb6zQm0uBcd9esCFHFpDR4x9voQJIyciMUd4c0g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=oKoHXxaP; arc=none smtp.client-ip=91.218.175.36 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="oKoHXxaP" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=IMDn9PKn0X3yRRWxYnjSO8ew4F2KumDV0Kt9fDXbys8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556991; v=1; x=1788161791; b=oKoHXxaPR1yRaAZsd7VIQDrnKLmEcRXqCmqzunuP5wVat3Ky4ZvQHDRt0KdBe72N1Q9ru2eq +hJXFbCqKCuDIfqySa4y9OE4+ZoTeoU5l5QzrEW8DlJ7Ge+jrx6nV/BZJc9cngBlz1WIi3kfGoK At7sVNGJgdWayV4l5pEYeYnA= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id 92473df891488077; Mon, 24 Aug 2026 07:36:31 +0000 X-Mizu-Trace-ID: 92473df891488077 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 2/6] mptcp: pm: change path_manager sysctl atomically Date: Mon, 24 Aug 2026 15:36:21 +0800 Message-ID: <20260824073625.57471-3-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan The per-netns path manager name is stored as an inline char[] buffer and updated via strscpy() from the sysctl handler. A concurrent reader can observe a half-written name (KCSAN), which READ_ONCE() cannot fix for a multi-byte string. Following the tcp_congestion_control() model (and the scheduler change in the previous patch), store a pointer to the immutable struct mptcp_pm_ops instead of the name string. No module reference is taken on the path manager ops for now, as they can only be registered from built-in code on one side, and on the other side the reference counting will be introduced by the last patch of this series, together with the BPF path manager support. Assisted-by: Claude:GLM5.2 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/626 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 33 +++++++++++++++++++++++---------- net/mptcp/pm.c | 3 ++- net/mptcp/protocol.h | 3 +-- 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 7d0f3421bd04..76ff2a41ba38 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -40,7 +40,7 @@ struct mptcp_pernet { u8 pm_type; u8 add_addr_v6_port_drop_ts; struct mptcp_sched_ops __rcu *scheduler; - char path_manager[MPTCP_PM_NAME_MAX]; + struct mptcp_pm_ops __rcu *path_manager; }; =20 static struct mptcp_pernet *mptcp_get_pernet(const struct net *net) @@ -85,9 +85,20 @@ int mptcp_get_pm_type(const struct net *net) return mptcp_get_pernet(net)->pm_type; } =20 -const char *mptcp_get_path_manager(const struct net *net) +static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp_pernet *pernet) { - return mptcp_get_pernet(net)->path_manager; + struct mptcp_pm_ops *pm_ops; + + pm_ops =3D rcu_dereference(pernet->path_manager); + return pm_ops ? pm_ops : &mptcp_pm_kernel; +} + +void mptcp_get_path_manager(const struct net *net, char *name) +{ + rcu_read_lock(); + strscpy(name, mptcp_pernet_pm(mptcp_get_pernet(net))->name, + MPTCP_PM_NAME_MAX); + rcu_read_unlock(); } =20 static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) @@ -124,7 +135,8 @@ static void mptcp_pernet_set_defaults(struct mptcp_pern= et *pernet) if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); =20 - strscpy(pernet->path_manager, "kernel", sizeof(pernet->path_manager)); + RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); + pernet->add_addr_v6_port_drop_ts =3D 1; } =20 @@ -210,7 +222,7 @@ static int proc_blackhole_detect_timeout(const struct c= tl_table *table, return ret; } =20 -static int mptcp_set_path_manager(char *path_manager, const char *name) +static int mptcp_set_path_manager(struct mptcp_pernet *pernet, const char = *name) { struct mptcp_pm_ops *pm_ops; int ret =3D 0; @@ -218,7 +230,7 @@ static int mptcp_set_path_manager(char *path_manager, c= onst char *name) rcu_read_lock(); pm_ops =3D mptcp_pm_find(name); if (pm_ops) - strscpy(path_manager, name, MPTCP_PM_NAME_MAX); + xchg(&pernet->path_manager, pm_ops); else ret =3D -ENOENT; rcu_read_unlock(); @@ -232,7 +244,6 @@ static int proc_path_manager(const struct ctl_table *ct= l, int write, struct mptcp_pernet *pernet =3D container_of(ctl->data, struct mptcp_pernet, path_manager); - char (*path_manager)[MPTCP_PM_NAME_MAX] =3D ctl->data; char pm_name[MPTCP_PM_NAME_MAX]; const struct ctl_table tbl =3D { .data =3D pm_name, @@ -240,11 +251,13 @@ static int proc_path_manager(const struct ctl_table *= ctl, int write, }; int ret; =20 - strscpy(pm_name, *path_manager, MPTCP_PM_NAME_MAX); + rcu_read_lock(); + strscpy(pm_name, mptcp_pernet_pm(pernet)->name, MPTCP_PM_NAME_MAX); + rcu_read_unlock(); =20 ret =3D proc_dostring(&tbl, write, buffer, lenp, ppos); if (write && ret =3D=3D 0) { - ret =3D mptcp_set_path_manager(*path_manager, pm_name); + ret =3D mptcp_set_path_manager(pernet, pm_name); if (ret =3D=3D 0) { u8 pm_type =3D __MPTCP_PM_TYPE_NR; =20 @@ -276,7 +289,7 @@ static int proc_pm_type(const struct ctl_table *ctl, in= t write, pm_name =3D "kernel"; else if (pm_type =3D=3D MPTCP_PM_TYPE_USERSPACE) pm_name =3D "userspace"; - mptcp_set_path_manager(pernet->path_manager, pm_name); + mptcp_set_path_manager(pernet, pm_name); } =20 return ret; diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index d7c5b50b34cc..69a38cb48977 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1204,7 +1204,7 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) void mptcp_pm_data_reset(struct mptcp_sock *msk) { const struct net *net =3D sock_net((struct sock *)msk); - const char *pm_name =3D mptcp_get_path_manager(net); + char pm_name[MPTCP_PM_NAME_MAX]; u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; =20 @@ -1213,6 +1213,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) pm->rm_list_rx.nr =3D 0; WRITE_ONCE(pm->pm_type, pm_type); =20 + mptcp_get_path_manager(net, pm_name); rcu_read_lock(); mptcp_pm_ops_init(msk, pm_name); rcu_read_unlock(); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 6447945be93c..bbcf0ecd72d1 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -802,7 +802,7 @@ int mptcp_allow_join_id0(const struct net *net); unsigned int mptcp_stale_loss_cnt(const struct net *net); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); -const char *mptcp_get_path_manager(const struct net *net); +void mptcp_get_path_manager(const struct net *net, char *name); struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 @@ -1153,7 +1153,6 @@ int mptcp_pm_announce_addr(struct mptcp_sock *msk, bool echo); int mptcp_pm_remove_addr(struct mptcp_sock *msk, const struct mptcp_rm_lis= t *rm_list); =20 -/* the default path manager, used in mptcp_pm_unregister */ extern struct mptcp_pm_ops mptcp_pm_kernel; extern struct mptcp_sched_ops mptcp_sched_default; =20 --=20 2.43.0 From nobody Sat Sep 26 16:39:32 2026 Received: from mta1.migadu.com (out-135.mta1.migadu.com [95.215.58.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD2F9374A1F for ; Mon, 24 Aug 2026 07:36:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.135 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556996; cv=none; b=W9VHsi8hzq+UMRiJU9pLfFG+5kcWGJEdRWhslwrt4AFIuqBvHr4aSPC+CYGVhrqmDGB30P1aihD8K5TfpjkPcyLOVq7ItiNreHd5MIwN8ic4ubhMczSZJ3SYLAO0+64TSGxDUVQj2FLEMxOlR/ZH+evqXRR7yUOLohgtYlKBHnE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556996; c=relaxed/simple; bh=f8tgCjT83aIcTUbhHk9sOl+jqy/sFiMJokips0njS/M=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uFl3vAbnSITZm2tu0IzjwwfdcEKjln/lW+gp2pKgdN9NVEojVkoM4wKlzxAaypU2BvL1lHIc+uad8XEfTBb3KLhd8eMt9JwEREU2sRpJFlkwovUXVc6NoCEIIpmmRlVBio7cMhyKwGMUoGN4HNv/xKxQilQbOIJ6e0IcKPS9GXY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=tptF59do; arc=none smtp.client-ip=95.215.58.135 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="tptF59do" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=f8tgCjT83aIcTUbhHk9sOl+jqy/sFiMJokips0njS/M=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556992; v=1; x=1788161792; b=tptF59do4VBDPcxbXsXHNAit1b6kxxzrcFJoPojguusB+nH5D9Ec4QYMHihgSB2F+dJANhOR ojJTsdAhAE0guanP0HO/WBk1mJEfTwHwv+fP+qs/d7jYvUeKnKkwSkM/FHhOMrrE4+UQQbi/koI xwUbJqZNiEkt4ADIRBXVOYFo= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id 48e89d095ac9123c; Mon, 24 Aug 2026 07:36:32 +0000 X-Mizu-Trace-ID: 48e89d095ac9123c X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 3/6] mptcp: use READ_ONCE() over sysctls Date: Mon, 24 Aug 2026 15:36:22 +0800 Message-ID: <20260824073625.57471-4-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Matthieu Baerts (NGI0)" To avoid KCSAN issues. This patch is in theory for -net, and will need to be split in multiple patches, with different Fixes tags. But I prefer to wait for Eric's patches, as I noticed he already started to modify mptcp_is_enabled: https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETb= mQ@mail.gmail.com Still, keeping this patch in this series, not to forget about it. Reported-by: Eric Dumazet Closes: https://lore.kernel.org/CANn89iL=3Dos-60kDKqMDdyiXuPF5CG=3DeejS0vmt= hwpDGXz_Bp8A@mail.gmail.com Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/ctrl.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 76ff2a41ba38..5a75f9b76d15 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -50,39 +50,39 @@ static struct mptcp_pernet *mptcp_get_pernet(const stru= ct net *net) =20 int mptcp_is_enabled(const struct net *net) { - return mptcp_get_pernet(net)->mptcp_enabled; + return READ_ONCE(mptcp_get_pernet(net)->mptcp_enabled); } =20 unsigned int mptcp_get_add_addr_timeout(const struct net *net) { - return mptcp_get_pernet(net)->add_addr_timeout; + return READ_ONCE(mptcp_get_pernet(net)->add_addr_timeout); } =20 int mptcp_is_checksum_enabled(const struct net *net) { - return mptcp_get_pernet(net)->checksum_enabled; + return READ_ONCE(mptcp_get_pernet(net)->checksum_enabled); } =20 int mptcp_allow_join_id0(const struct net *net) { - return mptcp_get_pernet(net)->allow_join_initial_addr_port; + return READ_ONCE(mptcp_get_pernet(net)->allow_join_initial_addr_port); } =20 unsigned int mptcp_stale_loss_cnt(const struct net *net) { - return mptcp_get_pernet(net)->stale_loss_cnt; + return READ_ONCE(mptcp_get_pernet(net)->stale_loss_cnt); } =20 unsigned int mptcp_close_timeout(const struct sock *sk) { if (sock_flag(sk, SOCK_DEAD)) return TCP_TIMEWAIT_LEN; - return mptcp_get_pernet(sock_net(sk))->close_timeout; + return READ_ONCE(mptcp_get_pernet(sock_net(sk))->close_timeout); } =20 int mptcp_get_pm_type(const struct net *net) { - return mptcp_get_pernet(net)->pm_type; + return READ_ONCE(mptcp_get_pernet(net)->pm_type); } =20 static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp_pernet *pernet) @@ -586,7 +586,7 @@ void mptcp_active_detect_blackhole(struct sock *ssk, bo= ol expired) =20 net =3D sock_net(ssk); timeouts =3D inet_csk(ssk)->icsk_retransmits; - to_max =3D mptcp_get_pernet(net)->syn_retrans_before_tcp_fallback; + to_max =3D READ_ONCE(mptcp_get_pernet(net)->syn_retrans_before_tcp_fallba= ck); =20 if (timeouts =3D=3D to_max || (timeouts < to_max && expired)) { subflow->mpc_drop =3D 1; --=20 2.43.0 From nobody Sat Sep 26 16:39:32 2026 Received: from mta0.migadu.com (out-37.mta0.migadu.com [91.218.175.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DB2C396590 for ; Mon, 24 Aug 2026 07:36:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556996; cv=none; b=SgXzsZ+XbVWri5eSMRehFATQKRDHjLqyyvfjhev8mYWvSTdGwavD5bsLiT7rWUGcW6f1tKNi20autkKcERHf4L0ngHE+dc3Vq3GIo18lycTDFLHREdrr+6rX7Zv4EIraR3ny9rXSdFyxRFWAH7XeAWAWa/9RIqNzF30lyNe5iQ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556996; c=relaxed/simple; bh=rtw1YyrIvzIHYWYdRXpdAafdWLiYM50DLewJZDMU6SY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lnyiQOAh8pW136INJnQNHyrdkjwkuon5HfsNIUeQp535XpbUTet4Jm4nQeYeKt9HGBuxqLK9amUkoZgl99AzL7ybmEX0bCtIIshJH6M/F+ECuc2VGFbIA7dBpCbtNy6l12QBQZyqn6KgaH+EEpBaRl+zkTONktO5t5D+JpsVSXk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=R07L/hCJ; arc=none smtp.client-ip=91.218.175.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="R07L/hCJ" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=rtw1YyrIvzIHYWYdRXpdAafdWLiYM50DLewJZDMU6SY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556993; v=1; x=1788161793; b=R07L/hCJ8BpepxLFmE0A6/w5/o6c4ejIrcV/mbUpTabz1ZTgZ9msG6ts8eMAxBECkSFGE/x0 YOnRRyd6BDC16FMRZPStZQsU9eNCQL5ZzfA//Pl/+0GjJL1HBwZAtA39odhbGcn/OQIrLBIHrgy 3BH6mSNvdgoS1dnTWjRd0YCE= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id cdca49b78d83c1b3; Mon, 24 Aug 2026 07:36:33 +0000 X-Mizu-Trace-ID: cdca49b78d83c1b3 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 4/6] mptcp: pm: use WRITE_ONCE() for the pm_type sysctl Date: Mon, 24 Aug 2026 15:36:23 +0800 Message-ID: <20260824073625.57471-5-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan Write pernet->pm_type with WRITE_ONCE() in proc_path_manager(), pairing it with the READ_ONCE() readers introduced earlier in this series. Note that updating net.mptcp.path_manager swaps the ops pointer first, then writes the derived pm_type: a socket created in between may see the new ops with the old pm_type. As the net.mptcp.pm_type knob is deprecated since v6.15 and will be removed, the race is not fixed on purpose; document it above the assignment so it does not get reported again. Suggested-by: Matthieu Baerts Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 5a75f9b76d15..87491b961bf2 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -265,7 +265,13 @@ static int proc_path_manager(const struct ctl_table *c= tl, int write, pm_type =3D MPTCP_PM_TYPE_KERNEL; else if (strncmp(pm_name, "userspace", MPTCP_PM_NAME_MAX) =3D=3D 0) pm_type =3D MPTCP_PM_TYPE_USERSPACE; - pernet->pm_type =3D pm_type; + + /* Pre-existing race: two sequential writes, a socket + * created in between may see the new ops with the old + * pm_type. The knob is deprecated since v6.15 and will + * be removed: not fixed on purpose. + */ + WRITE_ONCE(pernet->pm_type, pm_type); } } =20 --=20 2.43.0 From nobody Sat Sep 26 16:39:32 2026 Received: from mta1.migadu.com (out-136.mta1.migadu.com [95.215.58.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5479C397343 for ; Mon, 24 Aug 2026 07:36:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.136 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556998; cv=none; b=mz90oLJCW9eeSvSXLeilmmUyVsh2frgtz8Uih3gbd9dK6AcploUQAtI2SVdH203edb1PzAihUOdhGC1MHqsLXaRkTZ66Z23oX0dSZczonWLiyGMj24mCWk6YLu1q9WKswPBmPSVgiBgLEcTLIjq+h71+F61RT1KQEGafx+kTStQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787556998; c=relaxed/simple; bh=x6BFRwOgOUh0LHC2Ua60TVXK0ksGiYQfLTAAs5bxYe0=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TEgvdU60NWEMN/9nexCz5vkBsb7VDC2qSEijrsXw9c2OCGhPavu7p4faozRgiUA2xiCmbmudDItxtUq8HQLSpSO6SpkXKf2xaZCpCWYWhE2kwBBY1SmEUXFYVHyC1fZ4YSYZTaNbXKfE5rP7TfTlbTvjJcOzXuEtlKd9mv1xihc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=RrHTirik; arc=none smtp.client-ip=95.215.58.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="RrHTirik" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=x6BFRwOgOUh0LHC2Ua60TVXK0ksGiYQfLTAAs5bxYe0=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556994; v=1; x=1788161794; b=RrHTirikhUetS3H3Uk6mLfJ/bm9Tcn9mgcFUfXe00ippBkkS7XT3LOT7tMPbhfZ4rG1rch85 9PX+CVMuJI2dc7fQ54jxr7UiiiAmtBv1uoh3IP9Ojul2L7Z/zkeiWMAlhjeCFdmtjjSvUw0JU7k hTKngcD2th2dBsdXOuoseGAA= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id 28ba1ee5996423a7; Mon, 24 Aug 2026 07:36:34 +0000 X-Mizu-Trace-ID: 28ba1ee5996423a7 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 5/6] Squash-to "mptcp: pm: init and release mptcp_pm_ops" Date: Mon, 24 Aug 2026 15:36:24 +0800 Message-ID: <20260824073625.57471-6-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan This commit introduces the mptcp_pm_ops lifetime handling on sockets (mptcp_pm_ops_init/release taking a module reference), and would then be the first one whose per-net path managers can be unloaded while a pernet still stores them. mptcp_pm_ops_init() also takes the ops pointer directly instead of the name, and mptcp_get_path_manager() returns the ops: the redundant mptcp_pm_find() list walk from the name is avoided, as done for the scheduler side earlier in this series. Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 35 +++++++++++++++++++++++++---------- net/mptcp/pm.c | 12 ++++-------- net/mptcp/protocol.h | 2 +- 3 files changed, 30 insertions(+), 19 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 87491b961bf2..6379a9f481ac 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -93,12 +93,9 @@ static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp= _pernet *pernet) return pm_ops ? pm_ops : &mptcp_pm_kernel; } =20 -void mptcp_get_path_manager(const struct net *net, char *name) +struct mptcp_pm_ops *mptcp_get_path_manager(const struct net *net) { - rcu_read_lock(); - strscpy(name, mptcp_pernet_pm(mptcp_get_pernet(net))->name, - MPTCP_PM_NAME_MAX); - rcu_read_unlock(); + return mptcp_pernet_pm(mptcp_get_pernet(net)); } =20 static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) @@ -135,7 +132,8 @@ static void mptcp_pernet_set_defaults(struct mptcp_pern= et *pernet) if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); =20 - RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); + if (bpf_try_module_get(&mptcp_pm_kernel, mptcp_pm_kernel.owner)) + RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); =20 pernet->add_addr_v6_port_drop_ts =3D 1; } @@ -224,15 +222,22 @@ static int proc_blackhole_detect_timeout(const struct= ctl_table *table, =20 static int mptcp_set_path_manager(struct mptcp_pernet *pernet, const char = *name) { - struct mptcp_pm_ops *pm_ops; + struct mptcp_pm_ops *pm_ops, *prev; int ret =3D 0; =20 rcu_read_lock(); pm_ops =3D mptcp_pm_find(name); - if (pm_ops) - xchg(&pernet->path_manager, pm_ops); - else + if (pm_ops) { + if (bpf_try_module_get(pm_ops, pm_ops->owner)) { + prev =3D xchg(&pernet->path_manager, pm_ops); + if (prev) + bpf_module_put(prev, prev->owner); + } else { + ret =3D -EBUSY; + } + } else { ret =3D -ENOENT; + } rcu_read_unlock(); =20 return ret; @@ -611,10 +616,15 @@ static int __net_init mptcp_net_init(struct net *net) ret =3D mptcp_pernet_new_table(net, pernet); if (ret) { struct mptcp_sched_ops *sched; + struct mptcp_pm_ops *pm; =20 sched =3D rcu_dereference_protected(pernet->scheduler, true); if (sched) bpf_module_put(sched, sched->owner); + + pm =3D rcu_dereference_protected(pernet->path_manager, true); + if (pm) + bpf_module_put(pm, pm->owner); } =20 return ret; @@ -625,12 +635,17 @@ static void __net_exit mptcp_net_exit(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); struct mptcp_sched_ops *sched; + struct mptcp_pm_ops *pm; =20 mptcp_pernet_del_table(pernet); =20 sched =3D rcu_dereference_protected(pernet->scheduler, true); if (sched) bpf_module_put(sched, sched->owner); + + pm =3D rcu_dereference_protected(pernet->path_manager, true); + if (pm) + bpf_module_put(pm, pm->owner); } =20 static struct pernet_operations mptcp_pernet_ops =3D { diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 69a38cb48977..64244a1a01bc 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1155,13 +1155,11 @@ void mptcp_pm_worker(struct mptcp_sock *msk) spin_unlock_bh(&msk->pm.lock); } =20 -static void mptcp_pm_ops_init(struct mptcp_sock *msk, const char *pm_name) +static void mptcp_pm_ops_init(struct mptcp_sock *msk, + struct mptcp_pm_ops *pm_ops) { - struct mptcp_pm_ops *pm_ops; - - pm_ops =3D mptcp_pm_find(pm_name); if (!pm_ops || !bpf_try_module_get(pm_ops, pm_ops->owner)) { - pr_warn_once("pm %s fails, fallback to default pm", pm_name); + pr_warn_once("pm %s fails, fallback to default pm", pm_ops->name); pm_ops =3D &mptcp_pm_kernel; } =20 @@ -1204,7 +1202,6 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) void mptcp_pm_data_reset(struct mptcp_sock *msk) { const struct net *net =3D sock_net((struct sock *)msk); - char pm_name[MPTCP_PM_NAME_MAX]; u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; =20 @@ -1213,9 +1210,8 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) pm->rm_list_rx.nr =3D 0; WRITE_ONCE(pm->pm_type, pm_type); =20 - mptcp_get_path_manager(net, pm_name); rcu_read_lock(); - mptcp_pm_ops_init(msk, pm_name); + mptcp_pm_ops_init(msk, mptcp_get_path_manager(net)); rcu_read_unlock(); } =20 diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index bbcf0ecd72d1..1deefb8d3fcc 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -802,7 +802,7 @@ int mptcp_allow_join_id0(const struct net *net); unsigned int mptcp_stale_loss_cnt(const struct net *net); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); -void mptcp_get_path_manager(const struct net *net, char *name); +struct mptcp_pm_ops *mptcp_get_path_manager(const struct net *net); struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 --=20 2.43.0 From nobody Sat Sep 26 16:39:32 2026 Received: from mta1.migadu.com (out-137.mta1.migadu.com [95.215.58.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 467A1248F72 for ; Mon, 24 Aug 2026 07:36:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.137 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787557003; cv=none; b=LErPQGwMegqbrCRdHm8xVxwTt1R5mSrv1uQyCJPChSpZdqCKH/IjYh7OG5egImV/Ckh5sZMemUR8Xljp66fviOZdz4K0QJOPdw8KvrV4mfZor4wa+CZxlYaf6hNXm3wbu7nWdGtJtqWSM4pl5CQ0yROM01AvhBqNKcfF173zUrM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787557003; c=relaxed/simple; bh=rjOSMdC8vdi0Xvzbj+fUxFpWEut2EVHYsJsOg+RaQrQ=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bVTurlVcBF+8UgvRWLQGQj0Fzn9nI5KXACSWy8pfkqqmsJKw6HWLQ5U7u3jrk67i5sgZA35Azptt/RSmzim0SPqafs+YnRexGSPAQYbRuqLV61U7smVk86HjLZP+QUNxtg0JdfeJlWZ2Q9wM4Z0i+FQ+Eu7UcSWW2iWIjA2RJqw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=aPaJfHXF; arc=none smtp.client-ip=95.215.58.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="aPaJfHXF" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=rjOSMdC8vdi0Xvzbj+fUxFpWEut2EVHYsJsOg+RaQrQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787556999; v=1; x=1788161799; b=aPaJfHXF2u6WERnDgMls/fJ3BPOpZiNmfom+x1cfiPaWQWAjj0hq/Ja8w6nA6WsX6inZF61q nEqPvQYbKEWmwRD0pdjPz6kAY7T1mqQp2firAg0jA/iknGaHvhb0WjbhhGWuT/CJevxrOu9YRq9 Ku4aI2JkNUQpyhFXGNIEAzXw= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (223.70.159.239) by smtp.migadu.com with ESMTPS id 0ccf145ba05ba512; Mon, 24 Aug 2026 07:36:39 +0000 X-Mizu-Trace-ID: 0ccf145ba05ba512 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v4 6/6] Squash to previous one Date: Mon, 24 Aug 2026 15:36:25 +0800 Message-ID: <20260824073625.57471-7-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824073625.57471-1-gang.yan@linux.dev> References: <20260824073625.57471-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan Fix the issue sashiko mentioned in [1]. This patch applies the usual RCU discipline to the pointer: mark it __rcu, read it via rcu_dereference() inside RCU read sections, assign it via rcu_assign_pointer(), wait for a grace period before dropping the reference on the ops being replaced, and do the final release from mptcp_destroy() -- after the last msk reference -- instead of mptcp_destroy_common(), which is also reached on mptcp_disconnect(). Also, we need to hold the pm.lock before modify the pm.ops, and using the status of lock to tell rcu it's safe. Keep it as a separate patch to ease the review, but to be squashed into the previous one, which is itself a squash-to for "mptcp: pm: init and release mptcp_pm_ops". [1] https://sashiko.dev/#/patchset/20260819125629.49823-1-gang.yan@linux.de= v?part=3D5 Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/pm.c | 54 +++++++++++++++++++++++++++++++++++--------- net/mptcp/protocol.c | 4 ++++ net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 9 +++++++- 4 files changed, 57 insertions(+), 13 deletions(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 64244a1a01bc..ae75e68bc662 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -27,6 +27,14 @@ static LIST_HEAD(mptcp_pm_list); =20 /* path manager helpers */ =20 +static struct mptcp_pm_ops *mptcp_pm_rcu_deref(struct mptcp_sock *msk) +{ + struct mptcp_pm_ops *pm_ops; + + pm_ops =3D rcu_dereference(msk->pm.ops); + return pm_ops ? pm_ops : &mptcp_pm_kernel; +} + /* if sk is ipv4 or ipv6_only allows only same-family local and remote add= resses, * otherwise allow any matching local/remote pair */ @@ -1049,7 +1057,7 @@ int mptcp_pm_get_local_id(struct mptcp_sock *msk, str= uct sock_common *skc) skc_local.addr.id =3D 0; skc_local.flags =3D MPTCP_PM_ADDR_FLAG_IMPLICIT; =20 - return msk->pm.ops->get_local_id(msk, &skc_local); + return mptcp_pm_rcu_deref(msk)->get_local_id(msk, &skc_local); } =20 bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc) @@ -1058,7 +1066,7 @@ bool mptcp_pm_is_backup(struct mptcp_sock *msk, struc= t sock_common *skc) =20 mptcp_local_address((struct sock_common *)skc, &skc_local); =20 - return msk->pm.ops->get_priority(msk, &skc_local); + return mptcp_pm_rcu_deref(msk)->get_priority(msk, &skc_local); } =20 static void @@ -1158,23 +1166,46 @@ void mptcp_pm_worker(struct mptcp_sock *msk) static void mptcp_pm_ops_init(struct mptcp_sock *msk, struct mptcp_pm_ops *pm_ops) { + struct mptcp_pm_ops *old; + bool need_sync =3D false; + if (!pm_ops || !bpf_try_module_get(pm_ops, pm_ops->owner)) { pr_warn_once("pm %s fails, fallback to default pm", pm_ops->name); pm_ops =3D &mptcp_pm_kernel; } =20 - msk->pm.ops =3D pm_ops; - if (msk->pm.ops->init) - msk->pm.ops->init(msk); + spin_lock_bh(&msk->pm.lock); + old =3D rcu_dereference_protected(msk->pm.ops, + lockdep_is_held(&msk->pm.lock)); + if (old =3D=3D pm_ops) { + need_sync =3D false; + } else { + rcu_assign_pointer(msk->pm.ops, pm_ops); + need_sync =3D !!old; + } + spin_unlock_bh(&msk->pm.lock); + + if (need_sync) + synchronize_rcu(); + if (old) + bpf_module_put(old, old->owner); + + if (pm_ops->init) + pm_ops->init(msk); =20 pr_debug("pm %s initialized\n", pm_ops->name); } =20 -static void mptcp_pm_ops_release(struct mptcp_sock *msk) +void mptcp_pm_ops_release(struct mptcp_sock *msk) { - struct mptcp_pm_ops *pm_ops =3D msk->pm.ops; + struct mptcp_pm_ops *pm_ops; + + spin_lock_bh(&msk->pm.lock); + pm_ops =3D rcu_dereference_protected(msk->pm.ops, + lockdep_is_held(&msk->pm.lock)); + rcu_assign_pointer(msk->pm.ops, NULL); + spin_unlock_bh(&msk->pm.lock); =20 - msk->pm.ops =3D NULL; if (pm_ops->release) pm_ops->release(msk); =20 @@ -1195,8 +1226,6 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) * can be reused (mptcp_disconnect()) and re-selected to a different PM */ mptcp_userspace_pm_free_local_addr_list(msk); - - mptcp_pm_ops_release(msk); } =20 void mptcp_pm_data_reset(struct mptcp_sock *msk) @@ -1204,6 +1233,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) const struct net *net =3D sock_net((struct sock *)msk); u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; + struct mptcp_pm_ops *pm_ops; =20 memset(&pm->reset, 0, sizeof(pm->reset)); pm->rm_list_tx.nr =3D 0; @@ -1211,8 +1241,10 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) WRITE_ONCE(pm->pm_type, pm_type); =20 rcu_read_lock(); - mptcp_pm_ops_init(msk, mptcp_get_path_manager(net)); + pm_ops =3D mptcp_get_path_manager(net); rcu_read_unlock(); + + mptcp_pm_ops_init(msk, pm_ops); } =20 void mptcp_pm_data_init(struct mptcp_sock *msk) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 4d7cb50ec61a..6a139f28c2ae 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3746,6 +3746,9 @@ struct sock *mptcp_sk_clone_init(const struct sock *s= k, inet_sk(nsk)->pinet6 =3D mptcp_inet6_sk(nsk); #endif =20 + msk =3D mptcp_sk(nsk); + RCU_INIT_POINTER(msk->pm.ops, NULL); + __mptcp_init_sock(nsk); =20 #if IS_ENABLED(CONFIG_MPTCP_IPV6) @@ -3815,6 +3818,7 @@ static void mptcp_destroy(struct sock *sk) /* allow the following to close even the initial subflow */ msk->free_first =3D 1; mptcp_destroy_common(msk); + mptcp_pm_ops_release(msk); sk_sockets_allocated_dec(sk); } =20 diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 1deefb8d3fcc..534f83781265 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -221,7 +221,7 @@ struct mptcp_pm_data { struct mptcp_addr_info remote; struct list_head anno_list; struct list_head userspace_pm_local_addr_list; - struct mptcp_pm_ops *ops; + struct mptcp_pm_ops __rcu *ops; /* RCU: read via mptcp_pm_rcu_deref() */ =20 spinlock_t lock; /*protects the whole PM data */ =20 @@ -1101,6 +1101,7 @@ void __init mptcp_pm_init(void); void mptcp_pm_data_init(struct mptcp_sock *msk); void mptcp_pm_data_reset(struct mptcp_sock *msk); void mptcp_pm_destroy(struct mptcp_sock *msk); +void mptcp_pm_ops_release(struct mptcp_sock *msk); int mptcp_pm_parse_addr(struct nlattr *attr, struct genl_info *info, struct mptcp_addr_info *addr); int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info, diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index af81ad5e699d..c4a1169fab07 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -94,14 +94,17 @@ static struct mptcp_sock *subflow_token_join_request(st= ruct request_sock *req) return NULL; } =20 + rcu_read_lock(); local_id =3D mptcp_pm_get_local_id(msk, (struct sock_common *)req); if (local_id < 0) { SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINNOIDFOUND); + rcu_read_unlock(); sock_put((struct sock *)msk); return NULL; } subflow_req->local_id =3D local_id; subflow_req->request_bkup =3D mptcp_pm_is_backup(msk, (struct sock_common= *)req); + rcu_read_unlock(); =20 return msk; } @@ -634,12 +637,16 @@ static int subflow_chk_local_id(struct sock *sk) if (likely(subflow->local_id >=3D 0)) return 0; =20 + rcu_read_lock(); err =3D mptcp_pm_get_local_id(msk, (struct sock_common *)sk); - if (err < 0) + if (err < 0) { + rcu_read_unlock(); return err; + } =20 subflow_set_local_id(subflow, err); subflow->request_bkup =3D mptcp_pm_is_backup(msk, (struct sock_common *)s= k); + rcu_read_unlock(); =20 return 0; } --=20 2.43.0