From nobody Sat Sep 5 05:49:54 2026 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9AD84446E4 for ; Thu, 3 Sep 2026 08:35:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788424526; cv=none; b=da5mL4pJhqQZ/q0JXM7Jawt8yZqmR9hwaiEB4/UlBcisz7zKYBAE1ARE09XtWdHp+C71YVA76Uf9srAOG1NrDX7A/7e1PRxdnApyO/tbA0y4OLx71QKYqtv0Uymd0Lv6vX8I2RYGz8RkZxB6xnCJ/oEEAf+7eNiKWK6J960FVGc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788424526; c=relaxed/simple; bh=/MjYt2ta9mFvbu69n1CKfGpTEP3/Cm6uJX62W/imdDY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=b7a3FAPay3rtWYkPpsN5D6Q5D1GkTTOqz6Aa2R3XYkiKekKo0Z5/hjFOQda9rbEI5/O0TlT0McePrzkRS9avtucMgF82qiTmzPpUyrOGg78AySclHxT25uzK2/n6myIoHf4qoIv/1dtTibR4MwEifkzZxp/IVeH7wBIIKjLxVd0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mISsdnk1; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mISsdnk1" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-49cd9add88aso13042305e9.3 for ; Thu, 03 Sep 2026 01:35:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788424522; x=1789029322; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=66m0kEzVw0wUaLA90qEFlh+4kl2dF1iPNWHMpLLgPYk=; b=mISsdnk1YY0+ldzoPogWGOc6F4mxcxV64grlq/F0zjzxKJTbPbX88Up4uF2BK09NYY P1E12TKBvM7BjsEPlo8cvfnnLsYbjmp/tmZaq00SujVJvmS51ZzdA95hH7qkmImA2nvc updZxhje0S5zBgx3aXD1jJJ+zRmzQYdb2Bf7veyevz51UOSC2pwp4/yPyDeUQxbeiE3y OJiBgRk3F6fw4XuMIICM4DFX+Zl0E5t8ilfUck9UoZCoFQsA/24KLBDdJlK04zD6OmYg DMJB52nS4ILaBfRqny/o/mQ6afFhTd3ThCrFY8NkylSglmR65/qZkxalDaWkjmPnJ/I5 SOGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788424522; x=1789029322; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=66m0kEzVw0wUaLA90qEFlh+4kl2dF1iPNWHMpLLgPYk=; b=H4uguazSbo0cPRaP+uZjrYbCsC66cP+NNiq9xXNnfere13n0BIwJFiiCKn9OzZLaK8 DTOqje0CAj8/235GkBvKLXI9npxV4miSnoDN7iD8stx4LCXyPk/ahdXLMv3EIgtgi4ZU hQII+JfGeIrSNBS1aGIf3mhSAF0WPyu+NcntxmWG27/H/M2p7weN5p260O/F+Kw9X8YY MS4xVoLsS255/+7PDq5CcXll4Vtt59cY8144Qf7aYK/7buMkOZRY1+jRoCvoe1zO+206 wwjYZY6QjjXEe1cJiugieR0E/zLFT9HnlD9w90K+91LuC3ar1l266wXqF0oXMwIW/S2x qAfQ== X-Forwarded-Encrypted: i=1; AKwUvBxzsm0NMrvaa0IHNCAQJgF5XiQr73kfzIHtUhX8kK69DwY8W9hnB+kdxsjmWfoDl0i9+6wGgnI+OayVXbY=@vger.kernel.org X-Gm-Message-State: AFuF++kRpfkMmCsNyzYcgIAe9XxD1UFoVgXLlXFZMWYH5ckfxIXSrhY2 JD5J3I8Lp30o4dgaXtFiXf3TB3ZSCEGMROOm0Mv9utTNpMCKy7oDKvi1 X-Gm-Gg: AYBFou1i5tQVezx8aJQhCNWBkN558PKDxuBRi4oryLx9RsGaRnS3SO2PnzLGCM/JbrA ddKNPJ7/d10Xn4DjURpXrW/AFs0KZ/ePCWzNaD9RP7yzhNJl62Y0wYyPvYo6CsFXR42nDnFUbYj Y8pAZA/DaTF6rhaHc/elxX+GmqWjVfMYnaLmbK4vnAk7qMFiIBLbCoazuSK5+MxHdQCYLs0qtUp 5AXsao9DG0ZoqotEgPki58iuO6/e6vB9OKotM+4Y5YoMqKc7E4WgbP2Jz55vRQXrJY5kobMVlLp dgxCIoSX52zBII2RVM74e6jOVH8U8zyRFXENzKXYjmkRjXh0ZH0M+83C+h9nOPYEjWsIcq99bLf mNHyEc+mOPWbcmVILaYKYKvpT+/aqY2NEvt0uzxk14SMcC/q0l9dnTaC3viI5EIvvGtJG7HUQs1 9MGkIJRNRt5uqTPmcMOsfG+xsHbBRLiICkR+aEyWzQvaDOlH8Na9tu75+9SCOcjhC4FKsaFORAL xMLkfg1PVdqRUBwpC5BfUkU/ugfuiIY2QTQvNi7hQiGvZv6io2fXU51rbx4NzEF4jptbXH976JN utg295pNjPNu5G7N46MNqpntdWrNb2uZQIWfZeRlhWDuuAa9KsHvbmSdawJo8yQIoB9U93fbaUi DTlFG X-Received: by 2002:a7b:ca42:0:b0:49b:92df:87be with SMTP id 5b1f17b1804b1-49ce55fbdbemr129735745e9.4.1788424521705; Thu, 03 Sep 2026 01:35:21 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ce58da3acsm228357425e9.0.2026.09.03.01.35.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 01:35:21 -0700 (PDT) From: Karl Mehltretter To: stable@vger.kernel.org Cc: Karl Mehltretter , Greg Kroah-Hartman , Matthieu Baerts , Mat Martineau , Geliang Tang , Jakub Kicinski , Sasha Levin , netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 5.10.y 1/2] mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Date: Thu, 3 Sep 2026 10:35:11 +0200 Message-Id: <20260903083512.99864-2-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903083512.99864-1-kmehltretter@gmail.com> References: <20260903083512.99864-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Matthieu Baerts (NGI0) [ Upstream commit 9634cb35af17019baec21ca648516ce376fa10e6 ] When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ Karl Mehltretter: applied to pm_netlink.c; retained v5.10's ID 0 guard and routed it through the common refcount drop. ] Assisted-by: LLM Signed-off-by: Karl Mehltretter --- net/mptcp/pm_netlink.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index d4d56f0af3e0a..aee3a8dd9287a 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -217,14 +217,11 @@ static void mptcp_pm_add_timer(struct timer_list *tim= er) =20 pr_debug("msk=3D%p\n", msk); =20 - if (!msk) - return; - - if (inet_sk_state_load(sk) =3D=3D TCP_CLOSE) - return; + if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + goto exit; =20 if (!entry->addr.id) - return; + goto exit; =20 bh_lock_sock(sk); if (sock_owned_by_user(sk)) { @@ -253,6 +250,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) =20 out: bh_unlock_sock(sk); +exit: __sock_put(sk); } =20 --=20 2.53.0 From nobody Sat Sep 5 05:49:54 2026 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 431CB443AAE for ; Thu, 3 Sep 2026 08:35:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788424529; cv=none; b=daS97nmUhLh2/wEqJJrc8PO5uWH3loOKqjYmA8jxjBVjcmHP6q4ZgCtgsNeJ4qMoAdKbUUNdGRWu7EFHaz3CubhZCGBBj/84Q/zVdVz5VsvzNdNGY7v3O4GHnEs7p6Wo3QPofzQZprYEuEO22q3Pi3lsf5szWvqEXh+u7BO9IlM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788424529; c=relaxed/simple; bh=DjStITYR2s8Pxf0tCTvMNBrFzY7SIq7O1NXLlAuL/U8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=RQICbcGXld4xbpQq7WbZQitB0SzbZRnVJ4tVp14lgNh86r5T7QVsrUvCAmYdHaaxt9C43Q/ZwxqajTTknQtL/OeD9TDvImT0p7nvPJKm5X7UyaxjVuox0MY1b2xkYdmfZHDjFimpw94KdFECnkhiF5FTeJLWvBbPrySxJCaHwDA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=X0m9OBmc; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="X0m9OBmc" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-49b965570d7so19280475e9.0 for ; Thu, 03 Sep 2026 01:35:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788424524; x=1789029324; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EYvbakm1Bwgdxf94CO815zX0bPm8KsoE2kOWQFAcVLk=; b=X0m9OBmck21pOkLB/p29B1PwqCPhFqkUO3p5SKoazEnJ+Dr5/6izKz5lQAUE+XXBZa IbvWgQiL+sWXRguzzrkhKbK4RB3mr74uN6Ez+RNp58tN/ic3vGAs4BBkbvI5OhrznAa+ 7YAfupZdlNaBDJAMhf+ley2aCvwELVrqSNkSMquhOwjTnhSUm1IUGNmZeBcduJqHIxLF EiY/AVQi3m8X9KMA+YuwFCSQI8e4/MuOJKJpydNTvOQzvK/ryiG/rFrm1l9Ip9sX5VDE SQKjxQ1M4/6lfINf+LNrNSnQy0Lj7mnrLYvU2mIjln99dNzL4Pkfg1rAUA+7P/gTBTR0 rGrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788424524; x=1789029324; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EYvbakm1Bwgdxf94CO815zX0bPm8KsoE2kOWQFAcVLk=; b=ZzTqkbLS9J/jQ6p1tgvtc13yI+Ex/KVIiUoCoziJ8Mmt6GYDh3kq2/ZqfxEmKvr1HE +P55pJqHrHOaQC7+6kuVly8uElcmK4Vb+Dc1K+Lmybbw/usBjeurBxWibaMT6QhORqXk ZAsuDzI14Z5RnfpKkFzqsQhNXTlEZaCDG4RJ+jOlmUclEbeRrSqR72Te7m62u1Cjhsx9 dgmzjvYHIOkXUXwHeHThW3L9aorGXO+l1WXAl7w0V5fE7y8YESy7/8Sm3AOQcu3RsMJK 60FuK0z1Cs3zi15t3TauAnL+1EpyUh3+jwC9P/4jSDP2s+TbdMWRRfK7CF7iMGPnOXXm 0ZRg== X-Forwarded-Encrypted: i=1; AKwUvByJc5LMNXFjC1OmuWgoYD7y+HuRWNrzntul7bYkssZikheIC571B+hdZlkrL70//z8rXqQQtL/YbGgdDLM=@vger.kernel.org X-Gm-Message-State: AFuF++lpjy5xbwziOE99aNPxcz9lWJopQod6E5/IJ/BJjVqF6ro3l4Xa EABRUHy4PdebK42yAMVgatrE7biMjsIxx+CVs/gcV4qLsPpUAS63hHg7 X-Gm-Gg: AYBFou2bgL5doNDgNPwewsPktiy3E1yY96SS7aPlXOU/wMNg1yphHb5HHUr9XSEJ2fX EqiujEjWm7jTd8WmwvgBg+KYhhyILPCZ0ga1oCGvZat07vrfA7bsh1aKC9oI03P5Q/KDiKx8igv XOCep/fznFh7uEsA8bISov+OaN9QaDFu79OoyasYdFk46N3gsLzCgGZVPpHenKUv3cSs6Z3DquK 2WcjLbgn3jKjI9R2UJTbcia2HZufVdG8rXqNPDI4/Q9FvHORAfl0Tz2rd2ONx+H/ka02+/qgP0a Q2BYHmNj69Cc0q63SEbaD7WXW5wye1o9yWLR690PdEBFc+iiZVfLm5yzKB5J6R5/xHTXSFddx0E CFNp0Aondl0Me1x69mcU8vjGN1o1Yd/O04NlcohsghxuM8jekP4fOPecXvMrQX7YGsPJS066hyy FXkr5joYsU+GDBeizsHngODBWQVTipfc2Udn94HBg5p/ZggtzxesR6RfxKOwoxKffmz5nXzDbh9 iNMmuy7blj+d9Pgj9ENZV3FTRrmIAiYg+KvFzLnvkoiEGf2jHCmUM6z1EJFg1AFCt+cuexD8Uwv 1tLWEpoBRHOtr/If0OQ48q32u8wvpeDPPCdFAjYB9dnr5N+VeDtBnMnun+1r7ObPfCwizpKzkqN wIgbL X-Received: by 2002:a05:600c:630e:b0:49c:e27c:6b10 with SMTP id 5b1f17b1804b1-49ce55ecea8mr189868675e9.3.1788424523511; Thu, 03 Sep 2026 01:35:23 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ce58da3acsm228357425e9.0.2026.09.03.01.35.21 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 01:35:23 -0700 (PDT) From: Karl Mehltretter To: stable@vger.kernel.org Cc: Karl Mehltretter , Greg Kroah-Hartman , Matthieu Baerts , Mat Martineau , Geliang Tang , Jakub Kicinski , Sasha Levin , netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 5.10.y 2/2] mptcp: pm: ADD_ADDR rtx: free sk if last Date: Thu, 3 Sep 2026 10:35:12 +0200 Message-Id: <20260903083512.99864-3-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903083512.99864-1-kmehltretter@gmail.com> References: <20260903083512.99864-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Matthieu Baerts (NGI0) [ Upstream commit b7b9a461569734d33d3259d58d2507adfac107ed ] When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on "itself". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca= 8091060a4@kernel.org Signed-off-by: Jakub Kicinski [ Karl Mehltretter: applied to pm_netlink.c and retained v5.10's fixed retransmission delays while centralizing timer rearming. ] Assisted-by: LLM Signed-off-by: Karl Mehltretter --- net/mptcp/pm_netlink.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index aee3a8dd9287a..89570f83f96b0 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -34,6 +34,7 @@ struct mptcp_pm_add_entry { struct timer_list add_timer; struct mptcp_sock *sock; u8 retrans_times; + bool timer_done; struct rcu_head rcu; }; =20 @@ -214,24 +215,25 @@ static void mptcp_pm_add_timer(struct timer_list *tim= er) struct mptcp_pm_add_entry *entry =3D from_timer(entry, timer, add_timer); struct mptcp_sock *msk =3D entry->sock; struct sock *sk =3D (struct sock *)msk; + unsigned int timeout =3D 0; =20 pr_debug("msk=3D%p\n", msk); =20 + bh_lock_sock(sk); if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) - goto exit; + goto out; =20 if (!entry->addr.id) - goto exit; + goto out; =20 - bh_lock_sock(sk); if (sock_owned_by_user(sk)) { /* Try again later. */ - sk_reset_timer(sk, timer, jiffies + HZ / 20); + timeout =3D HZ / 20; goto out; } =20 if (mptcp_pm_should_add_signal(msk)) { - sk_reset_timer(sk, timer, jiffies + TCP_RTO_MAX / 8); + timeout =3D TCP_RTO_MAX / 8; goto out; } =20 @@ -244,14 +246,18 @@ static void mptcp_pm_add_timer(struct timer_list *tim= er) } =20 if (entry->retrans_times < ADD_ADDR_RETRANS_MAX) - sk_reset_timer(sk, timer, jiffies + TCP_RTO_MAX); + timeout =3D TCP_RTO_MAX; =20 spin_unlock_bh(&msk->pm.lock); =20 out: + if (timeout) + sk_reset_timer(sk, timer, jiffies + timeout); + else + /* if sock_put calls sk_free: avoid waiting for this timer */ + entry->timer_done =3D true; bh_unlock_sock(sk); -exit: - __sock_put(sk); + sock_put(sk); } =20 struct mptcp_pm_add_entry * @@ -304,6 +310,7 @@ static bool mptcp_pm_alloc_anno_list(struct mptcp_sock = *msk, add_entry->retrans_times =3D 0; =20 timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); + add_entry->timer_done =3D false; sk_reset_timer(sk, &add_entry->add_timer, jiffies + TCP_RTO_MAX); =20 return true; @@ -322,7 +329,8 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk) spin_unlock_bh(&msk->pm.lock); =20 list_for_each_entry_safe(entry, tmp, &free_list, list) { - sk_stop_timer_sync(sk, &entry->add_timer); + if (!entry->timer_done) + sk_stop_timer_sync(sk, &entry->add_timer); kfree_rcu(entry, rcu); } } --=20 2.53.0