Re: [PATCH mptcp-next v2 4/5] Squash to "mptcp: pm: init and release mptcp_pm_ops"

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Resource Leak on Error Path in `mptcp_net_init`
--

--- Patch [4]: [PATCH mptcp-next v2 4/5] Squash to "mptcp: pm: init and release mptcp_pm_ops" ---
commit b8f493287a2fef63b437fe19fc22666b77c1c08b
Author: Gang Yan <yangang@kylinos.cn>

Squash to "mptcp: pm: init and release mptcp_pm_ops"

This commit introduces lifetime handling for mptcp_pm_ops at the pernet
level. It pins the default mptcp_pm_kernel by taking a module reference
during pernet defaults initialization and releases it during network
namespace exit.

> diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> index 733706f06f1b1..32268aa260976 100644
> --- a/net/mptcp/ctrl.c
> +++ b/net/mptcp/ctrl.c
> @@ -124,7 +124,9 @@ static void mptcp_pernet_set_defaults(struct mptcp_pernet *pernet)
>  	pernet->pm_type = MPTCP_PM_TYPE_KERNEL;
>  
>  	RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default);
> -	RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel);
> +
> +	if (bpf_try_module_get(&mptcp_pm_kernel, mptcp_pm_kernel.owner))
> +		RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel);

[Severity: Medium]
Does this introduce a module reference leak regression on the error path
during network namespace initialization?

When mptcp_pernet_set_defaults() takes this module reference, it is called
from mptcp_net_init() right before mptcp_pernet_new_table():

mptcp_net_init() {
    mptcp_pernet_set_defaults(pernet);
    return mptcp_pernet_new_table(net, pernet);
}

If mptcp_pernet_new_table() fails and returns an error, the error is
propagated without releasing the module reference acquired here. Because the
initialization failed, the core network namespace code will not call the
corresponding exit function mptcp_net_exit() to release it.

Should mptcp_net_init() clean up the reference if mptcp_pernet_new_table()
fails?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818094825.48446-1-gang.yan@linux.dev?part=4