From: Gang Yan <yangang@kylinos.cn>
Changlog:
v7:
Patch 5:
- Rephrase the commit message accoding to sashiko's comments.[1]
Patch 6:
- Fix the use-after-free reported by sashiko [2]: the module reference is
now taken inside the same RCU read section as the pointer fetch in
mptcp_pm_data_reset(), so the ops cannot be freed between the
rcu_read_unlock() and the bpf_try_module_get() that previously
lived in mptcp_pm_ops_init(). The fallback to mptcp_pm_kernel now
takes a reference as well, fixing a pre-existing refcount
underflow when MPTCP is built as a module.
- Fix the reported use-after-free in [2]: take the module reference inside
the same RCU read section as the pointer fetch.
- The remaining of [2] are not actual issues, along with the
"scheduling while atomic" one which does not apply: lock_sock()
has mutex semantics, no spinlock is held across synchronize_rcu().
- Clear the pm.ops inherited by cloned sockets before re-selecting
it: the clone entered the swap logic with a reference it never
took, and the grace period wait could run in RX softirq.
- Wait for a grace period before releasing the retired ops in all
cases (same-ops reuse and final destruction included).
v6:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260904093531.20023-1-gang.yan@linux.dev/
v5:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260828060643.14397-1-gang.yan@linux.dev/
v4:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260824073625.57471-1-gang.yan@linux.dev/
v3:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260819125629.49823-1-gang.yan@linux.dev/
v2:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260818094825.48446-1-gang.yan@linux.dev/
v2:
Link: https://patchwork.kernel.org/project/mptcp/cover/20260817012452.7519-1-gang.yan@linux.dev/
[1] https://sashiko.dev/#/patchset/20260904093531.20023-1-gang.yan@linux.dev?part=5
[2] https://sashiko.dev/#/patchset/20260904093531.20023-1-gang.yan@linux.dev?part=6
Gang Yan (5):
mptcp: sched: change scheduler sysctl atomically
mptcp: pm: change path_manager sysctl atomically
mptcp: pm: use WRITE_ONCE() for the pm_type sysctl
Squash-to "mptcp: pm: init and release mptcp_pm_ops"
Squash to previous one
Matthieu Baerts (NGI0) (1):
mptcp: use READ_ONCE() over sysctls
net/mptcp/ctrl.c | 141 ++++++++++++++++++++++++++++++++-----------
net/mptcp/pm.c | 64 ++++++++++++++------
net/mptcp/protocol.c | 7 ++-
net/mptcp/protocol.h | 9 +--
net/mptcp/sched.c | 2 +-
net/mptcp/subflow.c | 9 ++-
6 files changed, 171 insertions(+), 61 deletions(-)
--
2.43.0