From: Geliang Tang <tanggeliang@kylinos.cn>

Same as .subflow_established, .established can't be invoked under mptcp
pm lock too.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/mptcp/pm.c        | 2 ++
 net/mptcp/pm_kernel.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index 38abf15718b9..788fbe31a40f 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -938,7 +938,9 @@ void mptcp_pm_worker(struct mptcp_sock *msk)
 	}
 	if (pm->status & BIT(MPTCP_PM_ESTABLISHED)) {
 		pm->status &= ~BIT(MPTCP_PM_ESTABLISHED);
+		spin_unlock_bh(&msk->pm.lock);
 		pm->ops->established(msk);
+		spin_lock_bh(&msk->pm.lock);
 	}
 	if (pm->status & BIT(MPTCP_PM_SUBFLOW_ESTABLISHED)) {
 		pm->status &= ~BIT(MPTCP_PM_SUBFLOW_ESTABLISHED);
diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
index 0c78715ed87f..f8cac996694c 100644
--- a/net/mptcp/pm_kernel.c
+++ b/net/mptcp/pm_kernel.c
@@ -369,7 +369,9 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
 
 static void mptcp_pm_kernel_established(struct mptcp_sock *msk)
 {
+	spin_lock_bh(&msk->pm.lock);
 	mptcp_pm_create_subflow_or_signal_addr(msk);
+	spin_unlock_bh(&msk->pm.lock);
 }
 
 static void mptcp_pm_kernel_subflow_established(struct mptcp_sock *msk)
-- 
2.43.0