[PATCH mptcp-next 0/2] mptcp: fix local_addr_used issue in userspace PM

[PATCH mptcp-next 0/2] mptcp: fix local_addr_used issue in userspace PM

[Gang Yan]

This series fixes a local_addr_used counter leak in the userspace PM
netlink REMOVE_ADDR handler and adds a selftest assertion that catches
it.

Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
Gang Yan (2):
      mptcp: pm: userspace: decrement local_addr_used when remove
      selftests: mptcp: check local_addr_used in userspace PM

 net/mptcp/pm_userspace.c                          |  1 +
 tools/testing/selftests/net/mptcp/userspace_pm.sh | 31 +++++++++++++++++++++++
 2 files changed, 32 insertions(+)
---
base-commit: d2cc1d2dd6c52fda38f9a5ef2d5eb2acc5274473
change-id: 20260723-localaddr-117611798ee8

Best regards,
-- 
Gang Yan <yangang@kylinos.cn>

[PATCH mptcp-next 1/2] mptcp: pm: userspace: decrement local_addr_used when remove

[Gang Yan]

From: Gang Yan <yangang@kylinos.cn>

mptcp_userspace_pm_append_new_local_addr() increments msk->pm.local_addr_used
when a new local address is appended, and mptcp_userspace_pm_delete_local_addr()
decrements it when an entry is removed via the subflow destroy path. The
mptcp_pm_nl_remove_doit() netlink REMOVE_ADDR handler, however, only unlinks
the matching entry from msk->pm.userspace_pm_local_addr_list via
list_del_rcu() without touching the counter, so the counter is not changed every
time userspace removes an address by id.

Decrement msk->pm.local_addr_used under the pm lock right after list_del_rcu(),
mirroring the increment site, so the counter stays in sync with the actual
number of entries left in the list.

Assisted-by: Codex:GLM-5.2
Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos")
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
 net/mptcp/pm_userspace.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
index 73094bdbdbf2..6402226a9f0e 100644
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -334,6 +334,7 @@ int mptcp_pm_nl_remove_doit(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	list_del_rcu(&match->list);
+	msk->pm.local_addr_used--;
 	spin_unlock_bh(&msk->pm.lock);
 
 	mptcp_pm_remove_addr_entry(msk, match);

-- 
2.43.0

Re: [PATCH mptcp-next 1/2] mptcp: pm: userspace: decrement local_addr_used when remove

[gang.yan]

July 23, 2026 at 5:55 PM, "Gang Yan" <gang.yan@linux.dev mailto:gang.yan@linux.dev?to=%22Gang%20Yan%22%20%3Cgang.yan%40linux.dev%3E > wrote:


Hi Matt, Hi Ge Liang,
 
Sorry for the confusion. I didn’t notice you(Geliang) had squashed this patch in your prior submission, and I didn’t mean to duplicate work on purpose. My
apologies for the oversight.
 
Separately, I recently spotted a TODO item in the userspace PM code that requires
adding refcount support for entry. I’ve been going through the relevant source
code to get familiar with the logic these days.
 
I’m writing to ask if you have a timeline to merge Ge Liang’s patch series
anytime soon. This is not a reminder by any means. If the merge is still pending,
I can build my development work directly on top of his patches to avoid extra
conflicts.
 
Thanks,
Gang

> 
> From: Gang Yan <yangang@kylinos.cn>
> 
> mptcp_userspace_pm_append_new_local_addr() increments msk->pm.local_addr_used
> when a new local address is appended, and mptcp_userspace_pm_delete_local_addr()
> decrements it when an entry is removed via the subflow destroy path. The
> mptcp_pm_nl_remove_doit() netlink REMOVE_ADDR handler, however, only unlinks
> the matching entry from msk->pm.userspace_pm_local_addr_list via
> list_del_rcu() without touching the counter, so the counter is not changed every
> time userspace removes an address by id.
> 
> Decrement msk->pm.local_addr_used under the pm lock right after list_del_rcu(),
> mirroring the increment site, so the counter stays in sync with the actual
> number of entries left in the list.
> 
> Assisted-by: Codex:GLM-5.2
> Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos")
> Signed-off-by: Gang Yan <yangang@kylinos.cn>
> ---
>  net/mptcp/pm_userspace.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
> index 73094bdbdbf2..6402226a9f0e 100644
> --- a/net/mptcp/pm_userspace.c
> +++ b/net/mptcp/pm_userspace.c
> @@ -334,6 +334,7 @@ int mptcp_pm_nl_remove_doit(struct sk_buff *skb, struct genl_info *info)
>  }
>  
>  list_del_rcu(&match->list);
> + msk->pm.local_addr_used--;
>  spin_unlock_bh(&msk->pm.lock);
>  
>  mptcp_pm_remove_addr_entry(msk, match);
> 
> -- 
> 2.43.0
>

[PATCH mptcp-next 2/2] selftests: mptcp: check local_addr_used in userspace PM

[Gang Yan]

From: Gang Yan <yangang@kylinos.cn>

This patch extends userspace_pm.sh to check the local_addr_used in
'test_announce'/'test_remove'. We need to make sure it should increase
after 'ann' and decline after 'rem'.

Assisted-by: Codex:GLM-5.2
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/userspace_pm.sh | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/net/mptcp/userspace_pm.sh b/tools/testing/selftests/net/mptcp/userspace_pm.sh
index 30a809752d1b..eaf356b9e039 100755
--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh
+++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh
@@ -391,6 +391,17 @@ test_announce()
 	sleep 0.5
 	verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\
 			      "$server_addr_id" "$new4_port"
+
+	# Check local_addr_used was incremented after announces on server
+	local addr_used
+	addr_used=$(ss -N "$ns1" -inmHM "sport = :$app4_port" | \
+		   mptcp_lib_get_info_value "local_addr_used" "local_addr_used")
+	print_test "local_addr_used > 0 after announce"
+	if [ "$addr_used" = 2 ] 2>/dev/null; then
+		test_pass
+	else
+		test_fail "local_addr_used=${addr_used} (expected 2)"
+	fi
 }
 
 verify_remove_event()
@@ -495,6 +506,26 @@ test_remove()
 	print_test "RM_ADDR6 id:server-1 ns1 => ns2"
 	sleep 0.5
 	verify_remove_event "$client_evts" "$REMOVED" "$client6_token" "$server_addr_id"
+
+	# Check local_addr_used was decremented back to 0 after all removes
+	local addr_used
+	addr_used=$(ss -N "$ns1" -inmHM "sport = :$app4_port" | \
+		   mptcp_lib_get_info_value "local_addr_used" "local_addr_used")
+	print_test "local_addr_used=0 on server after remove"
+	if [ "$addr_used" = "0" ]; then
+		test_pass
+	else
+		test_fail "local_addr_used=${addr_used} (expected 0)"
+	fi
+
+	addr_used=$(ss -N "$ns2" -inmHM "sport = :$client4_port" | \
+		   mptcp_lib_get_info_value "local_addr_used" "local_addr_used")
+	print_test "local_addr_used=0 on client after remove"
+	if [ "$addr_used" = "0" ]; then
+		test_pass
+	else
+		test_fail "local_addr_used=${addr_used} (expected 0)"
+	fi
 }
 
 verify_subflow_events()

-- 
2.43.0