Re: [PATCH mptcp-net v2] mptcp: fix extra_subflows leak on failed passive join

[Matthieu Baerts <matttbe@kernel.org>]

Hi Geliang, Chenguang,

On 01/07/2026 08:32, Geliang Tang wrote:
> Hi Chenguang,
> 
> Thanks for this v2. However, if there are no code changes, there is no
> need to send a v2; we can just reply to the email thread on v1 to
> discuss it. 

Indeed. Also, it is easier if you start a new thread with a link to the
previous version, than replying to a previous version.

> On Wed, 2026-07-01 at 11:20 +0800, Chenguang Zhao wrote:
>> From: Chenguang Zhao <zhaochenguang@kylinos.cn>
>>
>> mptcp_pm_allow_new_subflow() increments extra_subflows
>> before __mptcp_finish_join() on the passive MP_JOIN path.
>> On synchronous join failure the subflow is dropped without
>> calling mptcp_close_ssk(), so the counter is not rolled back.

What do you mean by saying "On synchronous join failure"? When I look at
the packetdrill test, we are not talking about synchronous MP_JOIN (SYN
+ MP_JOIN packets in both directions), right?

>> Call mptcp_pm_close_subflow() when the join completion fails.
>>
>> Fixes: 3e5014909b56 ("mptcp: cleanup MPJ subflow list handling")
>> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
>> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
>> ---
>> v2:
>>  Hi Matthieu,
>>  Thanks for the review.
>>  - I spotted this by reading the code. I don't have a reproducer
>>    yet. I also see we already have a Packetdrill test for
>>    synchronous connect failure (simult_connect.pkt), but not for
>>    synchronous join failure. I'll add a similar Packetdrill test
>>    for that case and send it in a follow-up patch.
>>  - Add Fixes and Reviewd-by tag.
>>  - I looked again at the history, and I think the Fixes tag
>>    should point to 3e5014909b56 ("mptcp: cleanup MPJ subflow list
>>    handling"), not 10f6d46c943d ("mptcp: fix race between MP_JOIN and
>> close"). 
> 
> The Fixes tag is incorrect and should be 10f6d46c943d ("mptcp: fix race
> between MP_JOIN and close"), because that commit introduced the call to
> mptcp_pm_allow_new_subflow. There is no need to send a v3, as this can
> be updated when applying.

+1

> I have changed the status of v2 to "Queued" and v1 to "Superseded".
I will wait to get the packetdrill test ready before applying this patch.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.