[PATCH mptcp-next v5 0/6] mptcp: avoid data-races around the sysctls

[Gang Yan <gang.yan@linux.dev>]

From: Gang Yan <yangang@kylinos.cn>

Changelog:
v5:
 - Patch 6 fixes the use-after-free reported by sashiko in [1]:
   the module reference is now taken inside the same RCU read section as the
   pointer fetch in mptcp_pm_data_reset(), so the ops cannot be freed between
   rcu_read_unlock() and the bpf_try_module_get() that previously lived in
   mptcp_pm_ops_init(). The reference hand-over is seamless: RCU protects
   the fetch, the refcount protects the use. As a consequence,
   mptcp_pm_ops_init() now expects an already-pinned ops and no longer takes
   a reference itself; the fallback to the built-in mptcp_pm_kernel needs no
   reference.

v4:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260824073625.57471-1-gang.yan@linux.dev/

v3:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260819125629.49823-1-gang.yan@linux.dev/

v2:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260818094825.48446-1-gang.yan@linux.dev/

v2:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260817012452.7519-1-gang.yan@linux.dev/

[1] https://sashiko.dev/#/patchset/20260824073625.57471-1-gang.yan@linux.dev?part=6

Gang Yan (5):
  mptcp: sched: change scheduler sysctl atomically
  mptcp: pm: change path_manager sysctl atomically
  mptcp: pm: use WRITE_ONCE() for the pm_type sysctl
  Squash-to "mptcp: pm: init and release mptcp_pm_ops"
  Squash to previous one

Matthieu Baerts (NGI0) (1):
  mptcp: use READ_ONCE() over sysctls

 net/mptcp/ctrl.c     | 141 ++++++++++++++++++++++++++++++++-----------
 net/mptcp/pm.c       |  65 ++++++++++++++------
 net/mptcp/protocol.c |   7 ++-
 net/mptcp/protocol.h |   9 +--
 net/mptcp/sched.c    |   2 +-
 net/mptcp/subflow.c  |   9 ++-
 6 files changed, 172 insertions(+), 61 deletions(-)

-- 
2.43.0