From nobody Fri Sep 25 10:03:24 2026 Received: from mta0.migadu.com (out-130.mta0.migadu.com [91.218.175.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9DF147A877 for ; Wed, 23 Sep 2026 09:49:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156973; cv=none; b=J0OAJVSit/mlGnYUv//IfjVKfdTzkEcwFDwHg6nSNCaXOtXtcd15Wj8gCliwagv4H3lC/GpIaw4Fpux96Pahs1KvjWMRB2cEdblUmoV4Zs7UmxiT9FWOImyytpVEk0fDq4bHrlJN2JjASLV6y8HH2qjWvvI4XeZvrT5cEpIjZv0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156973; c=relaxed/simple; bh=G3UjKi5QqTNfN3P+lpJbpK+yMuoPI3PE14JX/0oo18k=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JrsMcLRTXM3lg6UF/rjISwAm5XDeBc/0N+glH+Db/SgJpF9c+clCAIX+2Df1eVqCVWRaPkmPgEZHPQqJh7Hbk/h1fPQbvz/n74LKXobxWtXvYVcYpHOFBnwMysUcvfZoFZekWF7vsvZpKtqDvbiV7l8ueaDp0+cSONBse6pYWpg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=I34MWUao; arc=none smtp.client-ip=91.218.175.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="I34MWUao" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=G3UjKi5QqTNfN3P+lpJbpK+yMuoPI3PE14JX/0oo18k=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156969; v=1; x=1790761769; b=I34MWUaouY0obWJoxYmVdBDQcvqLFlePyITzdM49MnM89O7uLDHSB7dyXbz3ZW1u5MYxh6Uv SXakLYf5ozN9gz3ecfeImrTRITtDNuK6xZZe1luETEIzH0YqOtynWOEtoFijYCcyeNNwmA+SKTl IQdabJTPwQCJfd1Po5o0zFFI= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id 0b7d57820d159796; Wed, 23 Sep 2026 09:49:29 +0000 X-Mizu-Trace-ID: 0b7d57820d159796 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 1/6] mptcp: sched: change scheduler sysctl atomically Date: Wed, 23 Sep 2026 17:49:14 +0800 Message-ID: <5f5b9bf61035ef04b11ca1a994ac15145a67984f.1790147728.git.yangang@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan The per-netns scheduler name is stored as an inline char[] buffer and updated via strscpy() from the sysctl handler. A concurrent reader (e.g. mptcp_init_sock() resolving the default scheduler) can observe a half-written name, which is also flagged by KCSAN. READ_ONCE() does not help here as it cannot read a multi-byte string atomically. Following the tcp_congestion_control() model, store a pointer to the immutable struct mptcp_sched_ops instead of the name string. A pointer store is a single atomic word, so readers always observe a consistent value, and mptcp_get_scheduler() can now return the ops directly instead of going through mptcp_sched_find() again. Assisted-by: Claude:GLM5.2 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/626 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 63 +++++++++++++++++++++++++++++++++++--------- net/mptcp/protocol.c | 3 +-- net/mptcp/protocol.h | 3 ++- net/mptcp/sched.c | 2 +- 4 files changed, 54 insertions(+), 17 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 63c5747f0f63..7d0f3421bd04 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -39,7 +39,7 @@ struct mptcp_pernet { u8 allow_join_initial_addr_port; u8 pm_type; u8 add_addr_v6_port_drop_ts; - char scheduler[MPTCP_SCHED_NAME_MAX]; + struct mptcp_sched_ops __rcu *scheduler; char path_manager[MPTCP_PM_NAME_MAX]; }; =20 @@ -90,9 +90,17 @@ const char *mptcp_get_path_manager(const struct net *net) return mptcp_get_pernet(net)->path_manager; } =20 -const char *mptcp_get_scheduler(const struct net *net) +static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) { - return mptcp_get_pernet(net)->scheduler; + struct mptcp_sched_ops *sched; + + sched =3D rcu_dereference(pernet->scheduler); + return sched ? sched : &mptcp_sched_default; +} + +struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net) +{ + return mptcp_pernet_sched(mptcp_get_pernet(net)); } =20 unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net) @@ -112,23 +120,33 @@ static void mptcp_pernet_set_defaults(struct mptcp_pe= rnet *pernet) pernet->allow_join_initial_addr_port =3D 1; pernet->stale_loss_cnt =3D 4; pernet->pm_type =3D MPTCP_PM_TYPE_KERNEL; - strscpy(pernet->scheduler, "default", sizeof(pernet->scheduler)); + + if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) + RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); + strscpy(pernet->path_manager, "kernel", sizeof(pernet->path_manager)); pernet->add_addr_v6_port_drop_ts =3D 1; } =20 #ifdef CONFIG_SYSCTL -static int mptcp_set_scheduler(char *scheduler, const char *name) +static int mptcp_set_scheduler(struct mptcp_pernet *pernet, const char *na= me) { - struct mptcp_sched_ops *sched; + struct mptcp_sched_ops *sched, *prev; int ret =3D 0; =20 rcu_read_lock(); sched =3D mptcp_sched_find(name); - if (sched) - strscpy(scheduler, name, MPTCP_SCHED_NAME_MAX); - else + if (sched) { + if (bpf_try_module_get(sched, sched->owner)) { + prev =3D xchg(&pernet->scheduler, sched); + if (prev) + bpf_module_put(prev, prev->owner); + } else { + ret =3D -EBUSY; + } + } else { ret =3D -ENOENT; + } rcu_read_unlock(); =20 return ret; @@ -137,7 +155,9 @@ static int mptcp_set_scheduler(char *scheduler, const c= har *name) static int proc_scheduler(const struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *ppos) { - char (*scheduler)[MPTCP_SCHED_NAME_MAX] =3D ctl->data; + struct mptcp_pernet *pernet =3D container_of(ctl->data, + struct mptcp_pernet, + scheduler); char val[MPTCP_SCHED_NAME_MAX]; struct ctl_table tbl =3D { .data =3D val, @@ -145,11 +165,13 @@ static int proc_scheduler(const struct ctl_table *ctl= , int write, }; int ret; =20 - strscpy(val, *scheduler, MPTCP_SCHED_NAME_MAX); + rcu_read_lock(); + strscpy(val, mptcp_pernet_sched(pernet)->name, MPTCP_SCHED_NAME_MAX); + rcu_read_unlock(); =20 ret =3D proc_dostring(&tbl, write, buffer, lenp, ppos); if (write && ret =3D=3D 0) - ret =3D mptcp_set_scheduler(*scheduler, val); + ret =3D mptcp_set_scheduler(pernet, val); =20 return ret; } @@ -563,18 +585,33 @@ void mptcp_active_detect_blackhole(struct sock *ssk, = bool expired) static int __net_init mptcp_net_init(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + int ret; =20 mptcp_pernet_set_defaults(pernet); =20 - return mptcp_pernet_new_table(net, pernet); + ret =3D mptcp_pernet_new_table(net, pernet); + if (ret) { + struct mptcp_sched_ops *sched; + + sched =3D rcu_dereference_protected(pernet->scheduler, true); + if (sched) + bpf_module_put(sched, sched->owner); + } + + return ret; } =20 /* Note: the callback will only be called per extra netns */ static void __net_exit mptcp_net_exit(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); + struct mptcp_sched_ops *sched; =20 mptcp_pernet_del_table(pernet); + + sched =3D rcu_dereference_protected(pernet->scheduler, true); + if (sched) + bpf_module_put(sched, sched->owner); } =20 static struct pernet_operations mptcp_pernet_ops =3D { diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 09779428e9ea..eb066f2152f7 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3275,8 +3275,7 @@ static int mptcp_init_sock(struct sock *sk) return -ENOMEM; =20 rcu_read_lock(); - ret =3D mptcp_init_sched(mptcp_sk(sk), - mptcp_sched_find(mptcp_get_scheduler(net))); + ret =3D mptcp_init_sched(mptcp_sk(sk), mptcp_get_scheduler(net)); rcu_read_unlock(); if (ret) return ret; diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 4bf04f9ecbd9..c5972e5cd3ca 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -818,7 +818,7 @@ unsigned int mptcp_stale_loss_cnt(const struct net *net= ); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); const char *mptcp_get_path_manager(const struct net *net); -const char *mptcp_get_scheduler(const struct net *net); +struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 void mptcp_active_disable(struct sock *sk); @@ -1170,6 +1170,7 @@ int mptcp_pm_remove_addr(struct mptcp_sock *msk, cons= t struct mptcp_rm_list *rm_ =20 /* the default path manager, used in mptcp_pm_unregister */ extern struct mptcp_pm_ops mptcp_pm_kernel; +extern struct mptcp_sched_ops mptcp_sched_default; =20 struct mptcp_pm_ops *mptcp_pm_find(const char *name); int mptcp_pm_register(struct mptcp_pm_ops *pm_ops); diff --git a/net/mptcp/sched.c b/net/mptcp/sched.c index 1e59072d478c..0d13ee46ffdf 100644 --- a/net/mptcp/sched.c +++ b/net/mptcp/sched.c @@ -40,7 +40,7 @@ static int mptcp_sched_default_get_retrans(struct mptcp_s= ock *msk) return 0; } =20 -static struct mptcp_sched_ops mptcp_sched_default =3D { +struct mptcp_sched_ops mptcp_sched_default =3D { .get_send =3D mptcp_sched_default_get_send, .get_retrans =3D mptcp_sched_default_get_retrans, .name =3D "default", --=20 2.43.0 From nobody Fri Sep 25 10:03:24 2026 Received: from mta0.migadu.com (out-132.mta0.migadu.com [91.218.175.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EEAC47A0C4 for ; Wed, 23 Sep 2026 09:49:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.132 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156975; cv=none; b=OtG8VT4W7cdnEH0JMzxuJIcuCPctu/K043o3Nm/5HxDQsHpnrs9dS2UxVGfYgzFto6+CWfLa9Df0y3gJgeAtnWte4dKKIna+G1Tycd8hiya0UJycLzOPsNSuSzpJZLStxWExFGBrliGpu/ZZnvJocr2ubpFAcRH44a9VpFm7WJc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156975; c=relaxed/simple; bh=utTM0/lQYToL6zZ8DwY94D8SUGu6eO8DtDS8VhPWBUc=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Iw0ItdFUzPsNoWFqKY+RwS0thhy/oL3AJnq/xK/XoDd1TB7CRu6epk7fRnX5/qCnYp65Tu4P7uu5g3YjhfVLGh2rgub39cjkNTr9vq5K81KaIDTNoj/wMnhatO0nzD7eJC8g5Xs4YU7iUET59y9lymLbfzyJ71IPv6JlGRWvB2Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=MIrOXbbc; arc=none smtp.client-ip=91.218.175.132 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="MIrOXbbc" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=utTM0/lQYToL6zZ8DwY94D8SUGu6eO8DtDS8VhPWBUc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156971; v=1; x=1790761771; b=MIrOXbbct4gdmP2C8qvlO2CRwR7G1LcvO/bxyKxZ/093f15YKQLsMKRJLJrW9pIRo+bhlNQm zrOtGe8ZpgfYdisAdMMyqsPj/u5dO2NKLGA/hVlbYT7Lv/4Z+zMYflr75q95SmkMaceFu3/N96w VpwYqY9ErhPFQWjV89jtCKjk= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id d1e3e3f1c8280b1d; Wed, 23 Sep 2026 09:49:31 +0000 X-Mizu-Trace-ID: d1e3e3f1c8280b1d X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 2/6] mptcp: pm: change path_manager sysctl atomically Date: Wed, 23 Sep 2026 17:49:15 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan The per-netns path manager name is stored as an inline char[] buffer and updated via strscpy() from the sysctl handler. A concurrent reader can observe a half-written name (KCSAN), which READ_ONCE() cannot fix for a multi-byte string. Following the tcp_congestion_control() model (and the scheduler change in the previous patch), store a pointer to the immutable struct mptcp_pm_ops instead of the name string. No module reference is taken on the path manager ops for now, as they can only be registered from built-in code on one side, and on the other side the reference counting will be introduced by the last patch of this series, together with the BPF path manager support. Assisted-by: Claude:GLM5.2 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/626 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 33 +++++++++++++++++++++++---------- net/mptcp/pm.c | 3 ++- net/mptcp/protocol.h | 3 +-- 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 7d0f3421bd04..76ff2a41ba38 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -40,7 +40,7 @@ struct mptcp_pernet { u8 pm_type; u8 add_addr_v6_port_drop_ts; struct mptcp_sched_ops __rcu *scheduler; - char path_manager[MPTCP_PM_NAME_MAX]; + struct mptcp_pm_ops __rcu *path_manager; }; =20 static struct mptcp_pernet *mptcp_get_pernet(const struct net *net) @@ -85,9 +85,20 @@ int mptcp_get_pm_type(const struct net *net) return mptcp_get_pernet(net)->pm_type; } =20 -const char *mptcp_get_path_manager(const struct net *net) +static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp_pernet *pernet) { - return mptcp_get_pernet(net)->path_manager; + struct mptcp_pm_ops *pm_ops; + + pm_ops =3D rcu_dereference(pernet->path_manager); + return pm_ops ? pm_ops : &mptcp_pm_kernel; +} + +void mptcp_get_path_manager(const struct net *net, char *name) +{ + rcu_read_lock(); + strscpy(name, mptcp_pernet_pm(mptcp_get_pernet(net))->name, + MPTCP_PM_NAME_MAX); + rcu_read_unlock(); } =20 static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) @@ -124,7 +135,8 @@ static void mptcp_pernet_set_defaults(struct mptcp_pern= et *pernet) if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); =20 - strscpy(pernet->path_manager, "kernel", sizeof(pernet->path_manager)); + RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); + pernet->add_addr_v6_port_drop_ts =3D 1; } =20 @@ -210,7 +222,7 @@ static int proc_blackhole_detect_timeout(const struct c= tl_table *table, return ret; } =20 -static int mptcp_set_path_manager(char *path_manager, const char *name) +static int mptcp_set_path_manager(struct mptcp_pernet *pernet, const char = *name) { struct mptcp_pm_ops *pm_ops; int ret =3D 0; @@ -218,7 +230,7 @@ static int mptcp_set_path_manager(char *path_manager, c= onst char *name) rcu_read_lock(); pm_ops =3D mptcp_pm_find(name); if (pm_ops) - strscpy(path_manager, name, MPTCP_PM_NAME_MAX); + xchg(&pernet->path_manager, pm_ops); else ret =3D -ENOENT; rcu_read_unlock(); @@ -232,7 +244,6 @@ static int proc_path_manager(const struct ctl_table *ct= l, int write, struct mptcp_pernet *pernet =3D container_of(ctl->data, struct mptcp_pernet, path_manager); - char (*path_manager)[MPTCP_PM_NAME_MAX] =3D ctl->data; char pm_name[MPTCP_PM_NAME_MAX]; const struct ctl_table tbl =3D { .data =3D pm_name, @@ -240,11 +251,13 @@ static int proc_path_manager(const struct ctl_table *= ctl, int write, }; int ret; =20 - strscpy(pm_name, *path_manager, MPTCP_PM_NAME_MAX); + rcu_read_lock(); + strscpy(pm_name, mptcp_pernet_pm(pernet)->name, MPTCP_PM_NAME_MAX); + rcu_read_unlock(); =20 ret =3D proc_dostring(&tbl, write, buffer, lenp, ppos); if (write && ret =3D=3D 0) { - ret =3D mptcp_set_path_manager(*path_manager, pm_name); + ret =3D mptcp_set_path_manager(pernet, pm_name); if (ret =3D=3D 0) { u8 pm_type =3D __MPTCP_PM_TYPE_NR; =20 @@ -276,7 +289,7 @@ static int proc_pm_type(const struct ctl_table *ctl, in= t write, pm_name =3D "kernel"; else if (pm_type =3D=3D MPTCP_PM_TYPE_USERSPACE) pm_name =3D "userspace"; - mptcp_set_path_manager(pernet->path_manager, pm_name); + mptcp_set_path_manager(pernet, pm_name); } =20 return ret; diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index d7c5b50b34cc..69a38cb48977 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1204,7 +1204,7 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) void mptcp_pm_data_reset(struct mptcp_sock *msk) { const struct net *net =3D sock_net((struct sock *)msk); - const char *pm_name =3D mptcp_get_path_manager(net); + char pm_name[MPTCP_PM_NAME_MAX]; u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; =20 @@ -1213,6 +1213,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) pm->rm_list_rx.nr =3D 0; WRITE_ONCE(pm->pm_type, pm_type); =20 + mptcp_get_path_manager(net, pm_name); rcu_read_lock(); mptcp_pm_ops_init(msk, pm_name); rcu_read_unlock(); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index c5972e5cd3ca..9f0484286a90 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -817,7 +817,7 @@ int mptcp_allow_join_id0(const struct net *net); unsigned int mptcp_stale_loss_cnt(const struct net *net); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); -const char *mptcp_get_path_manager(const struct net *net); +void mptcp_get_path_manager(const struct net *net, char *name); struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 @@ -1168,7 +1168,6 @@ int mptcp_pm_announce_addr(struct mptcp_sock *msk, bool echo); int mptcp_pm_remove_addr(struct mptcp_sock *msk, const struct mptcp_rm_lis= t *rm_list); =20 -/* the default path manager, used in mptcp_pm_unregister */ extern struct mptcp_pm_ops mptcp_pm_kernel; extern struct mptcp_sched_ops mptcp_sched_default; =20 --=20 2.43.0 From nobody Fri Sep 25 10:03:24 2026 Received: from mta0.migadu.com (out-133.mta0.migadu.com [91.218.175.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E70F44779B1 for ; Wed, 23 Sep 2026 09:49:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.133 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156978; cv=none; b=AaOAFC+jsZiN4rSRqe817I3GEXj0nviO9IMdfMZdT9G0IDVSvX+4w0WCtDmUZ/nUMTQ7yauxegg1didrBiqJoSmPZPh6utrS3pqoYJprMyO7r2SPulbDsWXXQW4Szu5c0VfFNTuFCabhiZqzPkgiRgOdb02387G43SxJcVdwJak= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156978; c=relaxed/simple; bh=f8tgCjT83aIcTUbhHk9sOl+jqy/sFiMJokips0njS/M=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Q6dnlPkjnPSBODcmEC3dVWuFhzBLd+uoOVzaJdRs+1ysCgqmzShevsmxARHBtByBtmRLLfpfEqCQBEc0t12b10FhfDkKd+jbErF4uRkNCcGQtnqEoCaDse/M6PgBZogBCVYFu+AMGFkanZXeh8wlIgu82zYt9ss33jk02Vx6CM8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=lW1vwz5X; arc=none smtp.client-ip=91.218.175.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="lW1vwz5X" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=f8tgCjT83aIcTUbhHk9sOl+jqy/sFiMJokips0njS/M=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156974; v=1; x=1790761774; b=lW1vwz5XlEf8EjpG/uDPrfqEZspPLFnXR4ZfsEXFKiu4dfsYZV7FP3+RRZjTT9kVzYh6Lraj +y0hy00oXaEF7uElAkEHjj32yR4Pl5ojilJfdHG+c+eXfUXF8isi1rw7r62XlcdjOW9GXwS5Wad 7QsDWsE2A6cxi0QLr/tFY6PQ= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id 481d9ad2d4ce4dea; Wed, 23 Sep 2026 09:49:34 +0000 X-Mizu-Trace-ID: 481d9ad2d4ce4dea X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 3/6] mptcp: use READ_ONCE() over sysctls Date: Wed, 23 Sep 2026 17:49:16 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Matthieu Baerts (NGI0)" To avoid KCSAN issues. This patch is in theory for -net, and will need to be split in multiple patches, with different Fixes tags. But I prefer to wait for Eric's patches, as I noticed he already started to modify mptcp_is_enabled: https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETb= mQ@mail.gmail.com Still, keeping this patch in this series, not to forget about it. Reported-by: Eric Dumazet Closes: https://lore.kernel.org/CANn89iL=3Dos-60kDKqMDdyiXuPF5CG=3DeejS0vmt= hwpDGXz_Bp8A@mail.gmail.com Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/ctrl.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 76ff2a41ba38..5a75f9b76d15 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -50,39 +50,39 @@ static struct mptcp_pernet *mptcp_get_pernet(const stru= ct net *net) =20 int mptcp_is_enabled(const struct net *net) { - return mptcp_get_pernet(net)->mptcp_enabled; + return READ_ONCE(mptcp_get_pernet(net)->mptcp_enabled); } =20 unsigned int mptcp_get_add_addr_timeout(const struct net *net) { - return mptcp_get_pernet(net)->add_addr_timeout; + return READ_ONCE(mptcp_get_pernet(net)->add_addr_timeout); } =20 int mptcp_is_checksum_enabled(const struct net *net) { - return mptcp_get_pernet(net)->checksum_enabled; + return READ_ONCE(mptcp_get_pernet(net)->checksum_enabled); } =20 int mptcp_allow_join_id0(const struct net *net) { - return mptcp_get_pernet(net)->allow_join_initial_addr_port; + return READ_ONCE(mptcp_get_pernet(net)->allow_join_initial_addr_port); } =20 unsigned int mptcp_stale_loss_cnt(const struct net *net) { - return mptcp_get_pernet(net)->stale_loss_cnt; + return READ_ONCE(mptcp_get_pernet(net)->stale_loss_cnt); } =20 unsigned int mptcp_close_timeout(const struct sock *sk) { if (sock_flag(sk, SOCK_DEAD)) return TCP_TIMEWAIT_LEN; - return mptcp_get_pernet(sock_net(sk))->close_timeout; + return READ_ONCE(mptcp_get_pernet(sock_net(sk))->close_timeout); } =20 int mptcp_get_pm_type(const struct net *net) { - return mptcp_get_pernet(net)->pm_type; + return READ_ONCE(mptcp_get_pernet(net)->pm_type); } =20 static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp_pernet *pernet) @@ -586,7 +586,7 @@ void mptcp_active_detect_blackhole(struct sock *ssk, bo= ol expired) =20 net =3D sock_net(ssk); timeouts =3D inet_csk(ssk)->icsk_retransmits; - to_max =3D mptcp_get_pernet(net)->syn_retrans_before_tcp_fallback; + to_max =3D READ_ONCE(mptcp_get_pernet(net)->syn_retrans_before_tcp_fallba= ck); =20 if (timeouts =3D=3D to_max || (timeouts < to_max && expired)) { subflow->mpc_drop =3D 1; --=20 2.43.0 From nobody Fri Sep 25 10:03:24 2026 Received: from mta1.migadu.com (out-194.mta1.migadu.com [95.215.58.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E54E3C9ED6 for ; Wed, 23 Sep 2026 09:49:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.194 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156983; cv=none; b=X4+IbRrgunM+mJQTKkC1OWYpX6/eMIZ7Wh1t//XPLoQTB7swyFxQasFfbqGgh62vfD/+dcrPbQkilHi+iQxqFARVfDeBwv7Ng5NiOnA9WAO28MK4vlC31mNkEMsQHaaklzyPH1A7mdUVmaU7nA4fpUBlFTqAw9UcpvfDp5lmYoA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156983; c=relaxed/simple; bh=rtw1YyrIvzIHYWYdRXpdAafdWLiYM50DLewJZDMU6SY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kx1n6ZmJjzkG9D2/CRZA9RAENMrC1XPX3gM8P+oHYhsZHfpoFRxSt+1bKMjNFA3IwCsc+KGKxIkODeYG6wKdepY6HQVmIhlakLc6EMe0N6/MUKqP7BznK1cEeHTYdkzFo1FB3CVe8ym1jWUuYNLTSi1i4YdZXy4dFADAzlYDOmU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=rQ6KHRut; arc=none smtp.client-ip=95.215.58.194 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="rQ6KHRut" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=rtw1YyrIvzIHYWYdRXpdAafdWLiYM50DLewJZDMU6SY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156979; v=1; x=1790761779; b=rQ6KHRut33ZzqQoZvq1GQpRGASw0UGFQZqpJSjgsLp7Xo2L9aoheimAM8vIRfwE/CtGmVly+ +btiYgbV6F4w/Ltyltv+/MAhiAywwFnFWXuMoXcOQ+dH4/1nfj5L/3Z76ljfGA1y3Id/oQBS4HU UAXS6lo0ZCifI3at4yOWgRT8= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id fddd15738cf691a5; Wed, 23 Sep 2026 09:49:39 +0000 X-Mizu-Trace-ID: fddd15738cf691a5 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 4/6] mptcp: pm: use WRITE_ONCE() for the pm_type sysctl Date: Wed, 23 Sep 2026 17:49:17 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan Write pernet->pm_type with WRITE_ONCE() in proc_path_manager(), pairing it with the READ_ONCE() readers introduced earlier in this series. Note that updating net.mptcp.path_manager swaps the ops pointer first, then writes the derived pm_type: a socket created in between may see the new ops with the old pm_type. As the net.mptcp.pm_type knob is deprecated since v6.15 and will be removed, the race is not fixed on purpose; document it above the assignment so it does not get reported again. Suggested-by: Matthieu Baerts Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 5a75f9b76d15..87491b961bf2 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -265,7 +265,13 @@ static int proc_path_manager(const struct ctl_table *c= tl, int write, pm_type =3D MPTCP_PM_TYPE_KERNEL; else if (strncmp(pm_name, "userspace", MPTCP_PM_NAME_MAX) =3D=3D 0) pm_type =3D MPTCP_PM_TYPE_USERSPACE; - pernet->pm_type =3D pm_type; + + /* Pre-existing race: two sequential writes, a socket + * created in between may see the new ops with the old + * pm_type. The knob is deprecated since v6.15 and will + * be removed: not fixed on purpose. + */ + WRITE_ONCE(pernet->pm_type, pm_type); } } =20 --=20 2.43.0 From nobody Fri Sep 25 10:03:24 2026 Received: from mta1.migadu.com (out-195.mta1.migadu.com [95.215.58.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37F303C9ED6 for ; Wed, 23 Sep 2026 09:49:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156986; cv=none; b=c6DI55oXTKG8NFuydRnVSkrDn2/uxyd5rS/gCPdE4cmoGzYPTc4f3B9cGhVQOcdAwK5cOr0xBY5pX6UBeC+RrZU2uqqJKsVqk3zluKYtTG0jSt8+BASjNSl5MZYMg6zhdUb+2kBSvYJy30acDqrY8okkD2U2u01hpTqDRIAReMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156986; c=relaxed/simple; bh=lx1D2fK75kpBVoxuBbG7AY5KaAkG5d2hwZmGlzG47ZA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=emUPfWzZwPe2LG3wsOQoDcp162BDUd7ZYm1xm2OnjlL3N2P8LSlQFLQnrLW+dJa5b1y3TlK8uH84PHpDVVUV1Odk7V6wgSS3mrtjClLHgAndQ/MgVoeHM5/GEwVrnOqE+2zu2lFSVzfpGeZ+J0aiyFapY+zih0Tr2DTQNOQ+LY4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=krlD0Bo2; arc=none smtp.client-ip=95.215.58.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="krlD0Bo2" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=lx1D2fK75kpBVoxuBbG7AY5KaAkG5d2hwZmGlzG47ZA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156981; v=1; x=1790761781; b=krlD0Bo2QMkAQxLcTqqUa/fINtXjzVLGu9PvY+9Ofa7yfGXYLYFk91SMcL4lPHhsNVkG3KvP jG7Sc1hReIc7CgF5vNFw+5Zi23o0YbJSb+cMLJL/qqt6K6ozQQDoMZoaAwdr4PlSrcshLacTfvG gv2l9GXuoeawBNi3UGIEcic8= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id 0d353de286d155cf; Wed, 23 Sep 2026 09:49:41 +0000 X-Mizu-Trace-ID: 0d353de286d155cf X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 5/6] Squash-to "mptcp: pm: init and release mptcp_pm_ops" Date: Wed, 23 Sep 2026 17:49:18 +0800 Message-ID: <53dbfd02e31ed5843449abf36f2d07984743f94e.1790147728.git.yangang@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan This commit introduces the mptcp_pm_ops lifetime handling on sockets (mptcp_pm_ops_init/release taking a module reference), and would then be the first one where the per-net path manager can belong to an unloadable module: a pernet slot must therefore hold a reference on the ops it stores, which is what this patch adds. mptcp_pm_ops_init() also takes the ops pointer directly instead of the name, and mptcp_get_path_manager() returns the ops: the redundant mptcp_pm_find() list walk from the name is avoided, as done for the scheduler side earlier in this series. Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/ctrl.c | 35 +++++++++++++++++++++++++---------- net/mptcp/pm.c | 12 ++++-------- net/mptcp/protocol.h | 2 +- 3 files changed, 30 insertions(+), 19 deletions(-) diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index 87491b961bf2..6379a9f481ac 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -93,12 +93,9 @@ static struct mptcp_pm_ops *mptcp_pernet_pm(struct mptcp= _pernet *pernet) return pm_ops ? pm_ops : &mptcp_pm_kernel; } =20 -void mptcp_get_path_manager(const struct net *net, char *name) +struct mptcp_pm_ops *mptcp_get_path_manager(const struct net *net) { - rcu_read_lock(); - strscpy(name, mptcp_pernet_pm(mptcp_get_pernet(net))->name, - MPTCP_PM_NAME_MAX); - rcu_read_unlock(); + return mptcp_pernet_pm(mptcp_get_pernet(net)); } =20 static struct mptcp_sched_ops *mptcp_pernet_sched(struct mptcp_pernet *per= net) @@ -135,7 +132,8 @@ static void mptcp_pernet_set_defaults(struct mptcp_pern= et *pernet) if (bpf_try_module_get(&mptcp_sched_default, mptcp_sched_default.owner)) RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default); =20 - RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); + if (bpf_try_module_get(&mptcp_pm_kernel, mptcp_pm_kernel.owner)) + RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel); =20 pernet->add_addr_v6_port_drop_ts =3D 1; } @@ -224,15 +222,22 @@ static int proc_blackhole_detect_timeout(const struct= ctl_table *table, =20 static int mptcp_set_path_manager(struct mptcp_pernet *pernet, const char = *name) { - struct mptcp_pm_ops *pm_ops; + struct mptcp_pm_ops *pm_ops, *prev; int ret =3D 0; =20 rcu_read_lock(); pm_ops =3D mptcp_pm_find(name); - if (pm_ops) - xchg(&pernet->path_manager, pm_ops); - else + if (pm_ops) { + if (bpf_try_module_get(pm_ops, pm_ops->owner)) { + prev =3D xchg(&pernet->path_manager, pm_ops); + if (prev) + bpf_module_put(prev, prev->owner); + } else { + ret =3D -EBUSY; + } + } else { ret =3D -ENOENT; + } rcu_read_unlock(); =20 return ret; @@ -611,10 +616,15 @@ static int __net_init mptcp_net_init(struct net *net) ret =3D mptcp_pernet_new_table(net, pernet); if (ret) { struct mptcp_sched_ops *sched; + struct mptcp_pm_ops *pm; =20 sched =3D rcu_dereference_protected(pernet->scheduler, true); if (sched) bpf_module_put(sched, sched->owner); + + pm =3D rcu_dereference_protected(pernet->path_manager, true); + if (pm) + bpf_module_put(pm, pm->owner); } =20 return ret; @@ -625,12 +635,17 @@ static void __net_exit mptcp_net_exit(struct net *net) { struct mptcp_pernet *pernet =3D mptcp_get_pernet(net); struct mptcp_sched_ops *sched; + struct mptcp_pm_ops *pm; =20 mptcp_pernet_del_table(pernet); =20 sched =3D rcu_dereference_protected(pernet->scheduler, true); if (sched) bpf_module_put(sched, sched->owner); + + pm =3D rcu_dereference_protected(pernet->path_manager, true); + if (pm) + bpf_module_put(pm, pm->owner); } =20 static struct pernet_operations mptcp_pernet_ops =3D { diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 69a38cb48977..64244a1a01bc 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1155,13 +1155,11 @@ void mptcp_pm_worker(struct mptcp_sock *msk) spin_unlock_bh(&msk->pm.lock); } =20 -static void mptcp_pm_ops_init(struct mptcp_sock *msk, const char *pm_name) +static void mptcp_pm_ops_init(struct mptcp_sock *msk, + struct mptcp_pm_ops *pm_ops) { - struct mptcp_pm_ops *pm_ops; - - pm_ops =3D mptcp_pm_find(pm_name); if (!pm_ops || !bpf_try_module_get(pm_ops, pm_ops->owner)) { - pr_warn_once("pm %s fails, fallback to default pm", pm_name); + pr_warn_once("pm %s fails, fallback to default pm", pm_ops->name); pm_ops =3D &mptcp_pm_kernel; } =20 @@ -1204,7 +1202,6 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) void mptcp_pm_data_reset(struct mptcp_sock *msk) { const struct net *net =3D sock_net((struct sock *)msk); - char pm_name[MPTCP_PM_NAME_MAX]; u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; =20 @@ -1213,9 +1210,8 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) pm->rm_list_rx.nr =3D 0; WRITE_ONCE(pm->pm_type, pm_type); =20 - mptcp_get_path_manager(net, pm_name); rcu_read_lock(); - mptcp_pm_ops_init(msk, pm_name); + mptcp_pm_ops_init(msk, mptcp_get_path_manager(net)); rcu_read_unlock(); } =20 diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 9f0484286a90..33c9893921b6 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -817,7 +817,7 @@ int mptcp_allow_join_id0(const struct net *net); unsigned int mptcp_stale_loss_cnt(const struct net *net); unsigned int mptcp_close_timeout(const struct sock *sk); int mptcp_get_pm_type(const struct net *net); -void mptcp_get_path_manager(const struct net *net, char *name); +struct mptcp_pm_ops *mptcp_get_path_manager(const struct net *net); struct mptcp_sched_ops *mptcp_get_scheduler(const struct net *net); unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net); =20 --=20 2.43.0 From nobody Fri Sep 25 10:03:24 2026 Received: from mta0.migadu.com (out-136.mta0.migadu.com [91.218.175.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA5BB47798A for ; Wed, 23 Sep 2026 09:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.136 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156990; cv=none; b=T1HPhuJVXjZqsLIW9XDEcYZF0pahiKSL0z19769Ip+xTvtBQjs/ng/NljST7js1OMt3QrfZmLODr7DTTwwFgXgrdxHwpWCMhGp7CVR3uFczPK5ZmL/rTRyPHSzKH4JUiVGKpr5ZvGHILj19WE43wwgBLK14UOxGU8qVL4MvPuSQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790156990; c=relaxed/simple; bh=i/wJE61RyabtROpRE7XVkfVZtpMuBwKcAkzgkxf+xbo=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ucvx2xvMfS3a3kqSkjP/WunprZUVM4QUmMahAhFWCWTqJfUlvWlZkvVigXuOj9PA4jPfPDBwQ/B56ods6hU33CxIuHWsVkGw5X6pmadQwtJ9/PLPl09ePSZ2ymUC1bmOdqhk+GuRjqFE1aH7946mOZ+iwNiMmOwMt0gnsIs5k5Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=bIpc5m5m; arc=none smtp.client-ip=91.218.175.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="bIpc5m5m" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=i/wJE61RyabtROpRE7XVkfVZtpMuBwKcAkzgkxf+xbo=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790156986; v=1; x=1790761786; b=bIpc5m5m6t3TPhwlweatWaWqh28oXQuqzkinbv8xmrOLtS3ROXyLzALdWl5I8lt46PxU2UR3 5Y6czqJNyxEP+yM2jpw5mQ+6eD0rgCKVFyKh57iWbiJQ1FOmPQj6aV8E4HJm9FdpDYW9WbS8ONI tsIyrgjBoVC8LUpUB4QGl5os= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id ad98ce0523c7bd28; Wed, 23 Sep 2026 09:49:46 +0000 X-Mizu-Trace-ID: ad98ce0523c7bd28 X-Migadu-Flow: FLOW_OUT From: Gang Yan To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v7 6/6] Squash to previous one Date: Wed, 23 Sep 2026 17:49:19 +0800 Message-ID: <6a1cbdd1a0f4866ff6cda3b8679450172c203f5b.1790147728.git.yangang@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan Apply RCU discipline to msk->pm.ops: mark it __rcu, read it through rcu_dereference() inside RCU read sections, publish it with rcu_assign_pointer() under pm.lock, and wait for a grace period before dropping the reference on the ops being retired -- both when it is replaced on a reset and at the final release, moved from mptcp_destroy_common() (also reached on mptcp_disconnect()) to mptcp_destroy(), the final close path: mptcp_token_destroy() has already removed the socket from the token hash by then, so no new reader can find the msk anymore. Note that rcu_assign_pointer() before pm_ops->init(msk) does not publish a partially initialised object: the ops are registered immutable, init() only prepares the per-socket state, and the msk is not reachable by readers until its token is registered. Note that for the in-tree path managers none of this changes behaviour: neither defines release(), their init() only re-sets flags, and the per-socket state is freed unconditionally by mptcp_pm_destroy() on every disconnect. Keep it as a separate patch to ease the review, but to be squashed into the previous one, which is itself a squash-to for "mptcp: pm: init and release mptcp_pm_ops". [1] https://sashiko.dev/#/patchset/20260819125629.49823-1-gang.yan@linux.de= v?part=3D5 Assisted-by: Claude:GLM5.2 Co-developed-by: Tao Cui Signed-off-by: Tao Cui Signed-off-by: Gang Yan --- net/mptcp/pm.c | 59 +++++++++++++++++++++++++++++++++----------- net/mptcp/protocol.c | 4 +++ net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 9 ++++++- 4 files changed, 59 insertions(+), 16 deletions(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 64244a1a01bc..66fb7c3d9c82 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -27,6 +27,14 @@ static LIST_HEAD(mptcp_pm_list); =20 /* path manager helpers */ =20 +static struct mptcp_pm_ops *mptcp_pm_rcu_deref(struct mptcp_sock *msk) +{ + struct mptcp_pm_ops *pm_ops; + + pm_ops =3D rcu_dereference(msk->pm.ops); + return pm_ops ? pm_ops : &mptcp_pm_kernel; +} + /* if sk is ipv4 or ipv6_only allows only same-family local and remote add= resses, * otherwise allow any matching local/remote pair */ @@ -1049,7 +1057,7 @@ int mptcp_pm_get_local_id(struct mptcp_sock *msk, str= uct sock_common *skc) skc_local.addr.id =3D 0; skc_local.flags =3D MPTCP_PM_ADDR_FLAG_IMPLICIT; =20 - return msk->pm.ops->get_local_id(msk, &skc_local); + return mptcp_pm_rcu_deref(msk)->get_local_id(msk, &skc_local); } =20 bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc) @@ -1058,7 +1066,7 @@ bool mptcp_pm_is_backup(struct mptcp_sock *msk, struc= t sock_common *skc) =20 mptcp_local_address((struct sock_common *)skc, &skc_local); =20 - return msk->pm.ops->get_priority(msk, &skc_local); + return mptcp_pm_rcu_deref(msk)->get_priority(msk, &skc_local); } =20 static void @@ -1158,23 +1166,39 @@ void mptcp_pm_worker(struct mptcp_sock *msk) static void mptcp_pm_ops_init(struct mptcp_sock *msk, struct mptcp_pm_ops *pm_ops) { - if (!pm_ops || !bpf_try_module_get(pm_ops, pm_ops->owner)) { - pr_warn_once("pm %s fails, fallback to default pm", pm_ops->name); - pm_ops =3D &mptcp_pm_kernel; + struct mptcp_pm_ops *old; + + spin_lock_bh(&msk->pm.lock); + old =3D rcu_dereference_protected(msk->pm.ops, + lockdep_is_held(&msk->pm.lock)); + if (old !=3D pm_ops) + rcu_assign_pointer(msk->pm.ops, pm_ops); + spin_unlock_bh(&msk->pm.lock); + + if (old) { + synchronize_rcu(); + if (old->release) + old->release(msk); + bpf_module_put(old, old->owner); } =20 - msk->pm.ops =3D pm_ops; - if (msk->pm.ops->init) - msk->pm.ops->init(msk); + if (pm_ops->init) + pm_ops->init(msk); =20 pr_debug("pm %s initialized\n", pm_ops->name); } =20 -static void mptcp_pm_ops_release(struct mptcp_sock *msk) +void mptcp_pm_ops_release(struct mptcp_sock *msk) { - struct mptcp_pm_ops *pm_ops =3D msk->pm.ops; + struct mptcp_pm_ops *pm_ops; =20 - msk->pm.ops =3D NULL; + spin_lock_bh(&msk->pm.lock); + pm_ops =3D rcu_dereference_protected(msk->pm.ops, + lockdep_is_held(&msk->pm.lock)); + rcu_assign_pointer(msk->pm.ops, NULL); + spin_unlock_bh(&msk->pm.lock); + + synchronize_rcu(); if (pm_ops->release) pm_ops->release(msk); =20 @@ -1195,8 +1219,6 @@ void mptcp_pm_destroy(struct mptcp_sock *msk) * can be reused (mptcp_disconnect()) and re-selected to a different PM */ mptcp_userspace_pm_free_local_addr_list(msk); - - mptcp_pm_ops_release(msk); } =20 void mptcp_pm_data_reset(struct mptcp_sock *msk) @@ -1204,6 +1226,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) const struct net *net =3D sock_net((struct sock *)msk); u8 pm_type =3D mptcp_get_pm_type(net); struct mptcp_pm_data *pm =3D &msk->pm; + struct mptcp_pm_ops *pm_ops; =20 memset(&pm->reset, 0, sizeof(pm->reset)); pm->rm_list_tx.nr =3D 0; @@ -1211,8 +1234,16 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk) WRITE_ONCE(pm->pm_type, pm_type); =20 rcu_read_lock(); - mptcp_pm_ops_init(msk, mptcp_get_path_manager(net)); + pm_ops =3D mptcp_get_path_manager(net); + if (!pm_ops || !bpf_try_module_get(pm_ops, pm_ops->owner)) { + pr_warn_once("pm %s fails, fallback to default pm", + pm_ops ? pm_ops->name : NULL); + pm_ops =3D &mptcp_pm_kernel; + bpf_try_module_get(pm_ops, pm_ops->owner); + } rcu_read_unlock(); + + mptcp_pm_ops_init(msk, pm_ops); } =20 void mptcp_pm_data_init(struct mptcp_sock *msk) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index eb066f2152f7..48c0434ab0d3 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3759,6 +3759,9 @@ struct sock *mptcp_sk_clone_init(const struct sock *s= k, inet_sk(nsk)->pinet6 =3D mptcp_inet6_sk(nsk); #endif =20 + msk =3D mptcp_sk(nsk); + RCU_INIT_POINTER(msk->pm.ops, NULL); + __mptcp_init_sock(nsk); =20 #if IS_ENABLED(CONFIG_MPTCP_IPV6) @@ -3828,6 +3831,7 @@ static void mptcp_destroy(struct sock *sk) /* allow the following to close even the initial subflow */ msk->free_first =3D 1; mptcp_destroy_common(msk); + mptcp_pm_ops_release(msk); sk_sockets_allocated_dec(sk); } =20 diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 33c9893921b6..309e2251f2f3 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -236,7 +236,7 @@ struct mptcp_pm_data { struct mptcp_addr_info remote; struct list_head anno_list; struct list_head userspace_pm_local_addr_list; - struct mptcp_pm_ops *ops; + struct mptcp_pm_ops __rcu *ops; /* RCU: read via mptcp_pm_rcu_deref() */ =20 spinlock_t lock; /*protects the whole PM data */ =20 @@ -1116,6 +1116,7 @@ void __init mptcp_pm_init(void); void mptcp_pm_data_init(struct mptcp_sock *msk); void mptcp_pm_data_reset(struct mptcp_sock *msk); void mptcp_pm_destroy(struct mptcp_sock *msk); +void mptcp_pm_ops_release(struct mptcp_sock *msk); int mptcp_pm_parse_addr(struct nlattr *attr, struct genl_info *info, struct mptcp_addr_info *addr); int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info, diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 14aa82647c3d..4953cfa329e8 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -94,14 +94,17 @@ static struct mptcp_sock *subflow_token_join_request(st= ruct request_sock *req) return NULL; } =20 + rcu_read_lock(); local_id =3D mptcp_pm_get_local_id(msk, (struct sock_common *)req); if (local_id < 0) { SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINNOIDFOUND); + rcu_read_unlock(); sock_put((struct sock *)msk); return NULL; } subflow_req->local_id =3D local_id; subflow_req->request_bkup =3D mptcp_pm_is_backup(msk, (struct sock_common= *)req); + rcu_read_unlock(); =20 return msk; } @@ -638,12 +641,16 @@ static int subflow_chk_local_id(struct sock *sk) if (likely(subflow->local_id >=3D 0)) return 0; =20 + rcu_read_lock(); err =3D mptcp_pm_get_local_id(msk, (struct sock_common *)sk); - if (err < 0) + if (err < 0) { + rcu_read_unlock(); return err; + } =20 subflow_set_local_id(subflow, err); subflow->request_bkup =3D mptcp_pm_is_backup(msk, (struct sock_common *)s= k); + rcu_read_unlock(); =20 return 0; } --=20 2.43.0