[PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[Matthieu Baerts (NGI0)]

This address Eric's comments from [1].

Note that the CI will complain that not each patch can be built
individually. That's normal: the fix from patch 2 has to be split in
patch 3, to be applied in the right commit.

Link: https://lore.kernel.org/mptcp/20260601-net-next-mptcp-add-addr6-port-ts-v1-0-4fc25dfef62e@kernel.org/T/#u [1]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Matthieu Baerts (NGI0) (4):
      Squash to: "mptcp: introduce add_addr_v6_port_drop_ts sysctl knob"
      Squash to "tcp: allow mptcp to drop TS for some packets"
      Squash to "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"
      mptcp: use READ_ONCE() over sysctls

 include/net/mptcp.h   |  7 ++++---
 net/ipv4/tcp_output.c | 10 +++++++---
 net/mptcp/ctrl.c      | 18 +++++++++---------
 net/mptcp/options.c   | 13 ++++++-------
 4 files changed, 26 insertions(+), 22 deletions(-)
---
base-commit: 7676d254f320f9cce3ca42d8347334fe334dfe58
change-id: 20260601-mptcp-add-addr6-port-ts-fixes-v2-b49a2a862c47

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH mptcp-next 1/4] Squash to: "mptcp: introduce add_addr_v6_port_drop_ts sysctl knob"

[Matthieu Baerts (NGI0)]

Use READ_ONCE() over sysctls. This will avoid future patches from KCSAN
bots.

Link: https://lore.kernel.org/CANn89iL=os-60kDKqMDdyiXuPF5CG=eejS0vmthwpDGXz_Bp8A@mail.gmail.com
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index c94a192f4118..63c5747f0f63 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -97,7 +97,7 @@ const char *mptcp_get_scheduler(const struct net *net)
 
 unsigned int mptcp_add_addr_v6_port_drop_ts(const struct net *net)
 {
-	return mptcp_get_pernet(net)->add_addr_v6_port_drop_ts;
+	return READ_ONCE(mptcp_get_pernet(net)->add_addr_v6_port_drop_ts);
 }
 
 static void mptcp_pernet_set_defaults(struct mptcp_pernet *pernet)

-- 
2.53.0

[PATCH mptcp-next 2/4] Squash to "tcp: allow mptcp to drop TS for some packets"

[Matthieu Baerts (NGI0)]

Not to pass another local variables' addresses which forces the compiler
to use a stack canary in this hot function, even for non-MPTCP flows.

See Eric's comment.

Notes:

 - Using a free unused bit in struct mptcp_out_options. A bit "hackish",
   but I didn't see another way to avoid passing a local variable
   address.

 - Still adding a new parameter to mptcp_established_options, clearer.

 - IS_ENABLED(CONFIG_MPTCP) is needed to avoid compilation errors when
   reading/setting opts->mptcp.drop_ts.

Link: https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETbmQ@mail.gmail.com
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 include/net/mptcp.h   |  7 ++++---
 net/ipv4/tcp_output.c | 10 +++++++---
 net/mptcp/options.c   |  3 +--
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index d1227b71b217..f6074eeff8c3 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -68,7 +68,8 @@ struct mptcp_out_options {
 	u8 reset_reason:4,
 	   reset_transient:1,
 	   csum_reqd:1,
-	   allow_join_id0:1;
+	   allow_join_id0:1,
+	   drop_ts:1;
 	union {
 		struct {
 			u64 sndr_key;
@@ -156,7 +157,7 @@ bool mptcp_synack_options(const struct request_sock *req, unsigned int *size,
 			  struct mptcp_out_options *opts);
 bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
 			       unsigned int *size, unsigned int remaining,
-			       bool *drop_ts, struct mptcp_out_options *opts);
+			       bool has_ts, struct mptcp_out_options *opts);
 bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb);
 
 void mptcp_write_options(struct tcphdr *th, __be32 *ptr, struct tcp_sock *tp,
@@ -275,7 +276,7 @@ static inline bool mptcp_established_options(struct sock *sk,
 					     struct sk_buff *skb,
 					     unsigned int *size,
 					     unsigned int remaining,
-					     bool *drop_ts,
+					     bool has_ts,
 					     struct mptcp_out_options *opts)
 {
 	return false;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 53ee4c8f5f8c..dbeb02f8481b 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1173,6 +1173,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 		size += TCPOLEN_TSTAMP_ALIGNED;
 	}
 
+#if IS_ENABLED(CONFIG_MPTCP)
 	/* MPTCP options have precedence over SACK for the limited TCP
 	 * option space because a MPTCP connection would be forced to
 	 * fall back to regular TCP if a required multipath option is
@@ -1181,18 +1182,21 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 	 */
 	if (sk_is_mptcp(sk)) {
 		unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
-		bool drop_ts = opts->options & OPTION_TS;
+		bool has_ts = opts->options & OPTION_TS;
 		unsigned int opt_size = 0;
 
+		opts->mptcp.drop_ts = 0;
+
 		if (mptcp_established_options(sk, skb, &opt_size, remaining,
-					      &drop_ts, &opts->mptcp)) {
+					      has_ts, &opts->mptcp)) {
 			opts->options |= OPTION_MPTCP;
 			size += opt_size;
 
-			if (drop_ts)
+			if (opts->mptcp.drop_ts)
 				opts->options &= ~OPTION_TS;
 		}
 	}
+#endif
 
 	eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack;
 	if (unlikely(eff_sacks)) {
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 533226205d78..a7785453b5e0 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -823,7 +823,7 @@ static bool mptcp_established_options_mp_fail(struct sock *sk, int *size,
 
 bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
 			       unsigned int *size, unsigned int remaining,
-			       bool *drop_ts, struct mptcp_out_options *opts)
+			       bool has_ts, struct mptcp_out_options *opts)
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
@@ -833,7 +833,6 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
 	int opt_size = 0;
 
 	opts->suboptions = 0;
-	*drop_ts = false;
 
 	/* Force later mptcp_write_options(), but do not use any actual
 	 * option space.

-- 
2.53.0

[PATCH mptcp-next 3/4] Squash to "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[Matthieu Baerts (NGI0)]

Follow-up needed after having applied the previous commit.

See Eric's comment.

Link: https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETbmQ@mail.gmail.com
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/options.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index a7785453b5e0..1845cf5bb377 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -659,13 +659,14 @@ static u64 add_addr_generate_hmac(u64 key1, u64 key2,
 static bool mptcp_established_options_add_addr(struct sock *sk,
 					       struct sk_buff *skb, int *size,
 					       unsigned int remaining,
-					       bool *drop_ts,
+					       bool has_ts,
 					       struct mptcp_out_options *opts)
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
 	bool drop_other_suboptions = false;
 	struct mptcp_addr_info addr;
+	bool drop_ts = has_ts;
 	bool echo;
 
 	/* add addr will strip the existing options, be sure to avoid breaking
@@ -674,7 +675,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk,
 	if (!mptcp_pm_should_add_signal(msk) ||
 	    (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) ||
 	    !mptcp_pm_add_addr_signal(msk, skb, size, remaining, &addr, &echo,
-				      &drop_other_suboptions, drop_ts))
+				      &drop_other_suboptions, &drop_ts))
 		return false;
 
 	/*
@@ -695,6 +696,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk,
 		 */
 		opts->ahmac = 0;
 	}
+	opts->drop_ts = drop_ts;
 	opts->addr = addr;
 	opts->suboptions |= OPTION_MPTCP_ADD_ADDR;
 	if (!echo) {
@@ -827,7 +829,6 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
-	bool add_addr_drop_ts = *drop_ts;
 	bool snd_data_fin;
 	bool ret = false;
 	int opt_size = 0;
@@ -878,11 +879,10 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
 	*size += opt_size;
 	remaining -= opt_size;
 	if (mptcp_established_options_add_addr(sk, skb, &opt_size, remaining,
-					       &add_addr_drop_ts, opts)) {
+					       has_ts, opts)) {
 		*size += opt_size;
 		remaining -= opt_size;
 		ret = true;
-		*drop_ts = add_addr_drop_ts;
 	} else if (mptcp_established_options_rm_addr(sk, &opt_size, remaining, opts)) {
 		*size += opt_size;
 		remaining -= opt_size;

-- 
2.53.0

[PATCH mptcp-next 4/4] mptcp: use READ_ONCE() over sysctls

[Matthieu Baerts (NGI0)]

To avoid KCSAN issues.

This patch is in theory for -net, and will need to be split in multiple
patches, with different Fixes tags. But I prefer to wait for Eric's
patches, as I noticed he already started to modify mptcp_is_enabled:

  https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETbmQ@mail.gmail.com

Still, keeping this patch in this series, not to forget about it.

Reported-by: Eric Dumazet <edumazet@google.com>
Closes: https://lore.kernel.org/CANn89iL=os-60kDKqMDdyiXuPF5CG=eejS0vmthwpDGXz_Bp8A@mail.gmail.com
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/ctrl.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index 63c5747f0f63..1dee42601700 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -50,39 +50,39 @@ static struct mptcp_pernet *mptcp_get_pernet(const struct net *net)
 
 int mptcp_is_enabled(const struct net *net)
 {
-	return mptcp_get_pernet(net)->mptcp_enabled;
+	return READ_ONCE(mptcp_get_pernet(net)->mptcp_enabled);
 }
 
 unsigned int mptcp_get_add_addr_timeout(const struct net *net)
 {
-	return mptcp_get_pernet(net)->add_addr_timeout;
+	return READ_ONCE(mptcp_get_pernet(net)->add_addr_timeout);
 }
 
 int mptcp_is_checksum_enabled(const struct net *net)
 {
-	return mptcp_get_pernet(net)->checksum_enabled;
+	return READ_ONCE(mptcp_get_pernet(net)->checksum_enabled);
 }
 
 int mptcp_allow_join_id0(const struct net *net)
 {
-	return mptcp_get_pernet(net)->allow_join_initial_addr_port;
+	return READ_ONCE(mptcp_get_pernet(net)->allow_join_initial_addr_port);
 }
 
 unsigned int mptcp_stale_loss_cnt(const struct net *net)
 {
-	return mptcp_get_pernet(net)->stale_loss_cnt;
+	return READ_ONCE(mptcp_get_pernet(net)->stale_loss_cnt);
 }
 
 unsigned int mptcp_close_timeout(const struct sock *sk)
 {
 	if (sock_flag(sk, SOCK_DEAD))
 		return TCP_TIMEWAIT_LEN;
-	return mptcp_get_pernet(sock_net(sk))->close_timeout;
+	return READ_ONCE(mptcp_get_pernet(sock_net(sk))->close_timeout);
 }
 
 int mptcp_get_pm_type(const struct net *net)
 {
-	return mptcp_get_pernet(net)->pm_type;
+	return READ_ONCE(mptcp_get_pernet(net)->pm_type);
 }
 
 const char *mptcp_get_path_manager(const struct net *net)
@@ -551,7 +551,7 @@ void mptcp_active_detect_blackhole(struct sock *ssk, bool expired)
 
 	net = sock_net(ssk);
 	timeouts = inet_csk(ssk)->icsk_retransmits;
-	to_max = mptcp_get_pernet(net)->syn_retrans_before_tcp_fallback;
+	to_max = READ_ONCE(mptcp_get_pernet(net)->syn_retrans_before_tcp_fallback);
 
 	if (timeouts == to_max || (timeouts < to_max && expired)) {
 		subflow->mpc_drop = 1;

-- 
2.53.0

Re: [PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[MPTCP CI]

Hi Matthieu,

Thank you for your modifications, that's great!

But sadly, our CI spotted some issues with it when trying to build it.

You can find more details there:

  https://github.com/multipath-tcp/mptcp_net-next/actions/runs/26744856471

Status: failure
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/1e1fdfa4d98f
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1103837

Feel free to reply to this email if you cannot access logs, if you need
some support to fix the error, if this doesn't seem to be caused by your
modifications or if the error is a false positive one.

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[MPTCP CI]

Hi Matthieu,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Unstable: 2 failed test(s): selftest_mptcp_connect selftest_mptcp_connect_checksum ⚠️ 
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/26744856498

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/1e1fdfa4d98f
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1103837


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[Matthieu Baerts]

Hello,

On 01/06/2026 18:27, Matthieu Baerts (NGI0) wrote:
> This address Eric's comments from [1].
> 
> Note that the CI will complain that not each patch can be built
> individually. That's normal: the fix from patch 2 has to be split in
> patch 3, to be applied in the right commit.

I'm going to apply patches 1-3, because they have been requested by
Eric, I guess that's fine. After that, I will apply Eric's patch [1]
with the small fix in our tree, resolve conflicts, and send an extra fix.

[1] https://lore.kernel.org/20260601091816.444738-1-edumazet@google.com

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 0/4] Fixes for "mptcp: pm: drop TCP TS with ADD_ADDRv6 + port"

[Matthieu Baerts]

On 02/06/2026 16:31, Matthieu Baerts wrote:
> Hello,
> 
> On 01/06/2026 18:27, Matthieu Baerts (NGI0) wrote:
>> This address Eric's comments from [1].
>>
>> Note that the CI will complain that not each patch can be built
>> individually. That's normal: the fix from patch 2 has to be split in
>> patch 3, to be applied in the right commit.
> 
> I'm going to apply patches 1-3, because they have been requested by
> Eric, I guess that's fine. After that, I will apply Eric's patch [1]
> with the small fix in our tree, resolve conflicts, and send an extra fix.

*Eric's patch*

New patches for t/upstream:
- ab84e16ad93d: mptcp: change mptcp_established_options() to return opt_size
- 1ac623cbe9db: conflict in t/mptcp-options-suboptions-sizes-can-be-negative
- 5876b14f5c8a: conflict in t/tcp-allow-mptcp-to-drop-TS-for-some-packets
- 3dfc91dff1d0: conflict in t/mptcp-pm-drop-TCP-TS-with-ADD_ADDRv6-port
- Results: 7676d254f320..00d928af360b (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/c7e8a9cddd2beb5eae02e8af51de83483f6b25aa/checks


*Squash-to patches*

New patches for t/upstream:
- 2889b65f2e3a: "squashed" patch 1/4 in "mptcp: introduce
add_addr_v6_port_drop_ts sysctl knob"
- 8d5986a8c346: "squashed" (with conflicts) in "tcp: allow mptcp to drop
TS for some packets"
- f1a8e699dcb7: "squashed" (with conflicts) in "mptcp: pm: drop TCP TS
with ADD_ADDRv6 + port"
- Results: 00d928af360b..39cfd0474a57 (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/3c61701c6140a3b53e64a488ba135da8470d5de4/checks


Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 4/4] mptcp: use READ_ONCE() over sysctls

[Geliang Tang]

Hi Matt,

Thanks for this patch.

On Mon, 2026-06-01 at 18:27 +1000, Matthieu Baerts (NGI0) wrote:
> To avoid KCSAN issues.
> 
> This patch is in theory for -net, and will need to be split in
> multiple
> patches, with different Fixes tags. But I prefer to wait for Eric's
> patches, as I noticed he already started to modify mptcp_is_enabled:
> 
>  
> https://lore.kernel.org/CANn89iLdwhhwLyO6zRjWMEY3t9g60ZE8ZhOVx33ucg_uRETbmQ@mail.gmail.com
> 
> Still, keeping this patch in this series, not to forget about it.
> 
> Reported-by: Eric Dumazet <edumazet@google.com>
> Closes:
> https://lore.kernel.org/CANn89iL=os-60kDKqMDdyiXuPF5CG=eejS0vmthwpDGXz_Bp8A@mail.gmail.com
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> ---
>  net/mptcp/ctrl.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> index 63c5747f0f63..1dee42601700 100644
> --- a/net/mptcp/ctrl.c
> +++ b/net/mptcp/ctrl.c
> @@ -50,39 +50,39 @@ static struct mptcp_pernet
> *mptcp_get_pernet(const struct net *net)
>  
>  int mptcp_is_enabled(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->mptcp_enabled;
> +	return READ_ONCE(mptcp_get_pernet(net)->mptcp_enabled);
>  }
>  
>  unsigned int mptcp_get_add_addr_timeout(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->add_addr_timeout;
> +	return READ_ONCE(mptcp_get_pernet(net)->add_addr_timeout);
>  }
>  
>  int mptcp_is_checksum_enabled(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->checksum_enabled;
> +	return READ_ONCE(mptcp_get_pernet(net)->checksum_enabled);
>  }
>  
>  int mptcp_allow_join_id0(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->allow_join_initial_addr_port;
> +	return READ_ONCE(mptcp_get_pernet(net)-
> >allow_join_initial_addr_port);
>  }
>  
>  unsigned int mptcp_stale_loss_cnt(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->stale_loss_cnt;
> +	return READ_ONCE(mptcp_get_pernet(net)->stale_loss_cnt);
>  }
>  
>  unsigned int mptcp_close_timeout(const struct sock *sk)
>  {
>  	if (sock_flag(sk, SOCK_DEAD))
>  		return TCP_TIMEWAIT_LEN;
> -	return mptcp_get_pernet(sock_net(sk))->close_timeout;
> +	return READ_ONCE(mptcp_get_pernet(sock_net(sk))-
> >close_timeout);
>  }
>  
>  int mptcp_get_pm_type(const struct net *net)
>  {
> -	return mptcp_get_pernet(net)->pm_type;
> +	return READ_ONCE(mptcp_get_pernet(net)->pm_type);
>  }
>  
>  const char *mptcp_get_path_manager(const struct net *net)
> @@ -551,7 +551,7 @@ void mptcp_active_detect_blackhole(struct sock
> *ssk, bool expired)
>  
>  	net = sock_net(ssk);
>  	timeouts = inet_csk(ssk)->icsk_retransmits;
> -	to_max = mptcp_get_pernet(net)-
> >syn_retrans_before_tcp_fallback;
> +	to_max = READ_ONCE(mptcp_get_pernet(net)-
> >syn_retrans_before_tcp_fallback);
>  
>  	if (timeouts == to_max || (timeouts < to_max && expired)) {
>  		subflow->mpc_drop = 1;
> 

I hesitated for a moment about why READ_ONCE() was not added in
mptcp_get_path_manager() and mptcp_get_scheduler(), and the result is
that they are defined as arrays rather than pointers, so READ_ONCE() is
not applicable.

So this patch looks good to me.

    Reviewed-by: Geliang Tang <geliang@kernel.org>

Thanks,
-Geliang