Re: [PATCH net v2] mptcp: pm: drop pending ADD_ADDR when removing id 0 endpoint

[Matthieu Baerts <matttbe@kernel.org>]

Hi Kalpan,

On 29/05/2026 17:18, Kalpan Jani wrote:
> Hi Matt,
> 
>> Did it work with packetdrill?
> 
> I worked on a packetdrill test based on add_addr4_server.pkt with the
> MP_JOIN extra subflow and the delete/re-add sequence. The environment
> is working (add_addr4_server.pkt passes cleanly), but I was not able
> to reliably trigger the WARN through packetdrill within the test
> timeframe.
> 
> The difficulty is that the id 0 ADD_ADDR is only sent when the
> endpoint is re-added after the connection is established AND after
> mptcp_nl_remove_id_zero_address() has run to restore the
> id_avail_bitmap bit via __mark_subflow_endp_available(). Getting
> packetdrill to control this timing precisely — while also keeping
> conn_list non-empty so mptcp_nl_remove_id_zero_address() actually
> processes the msk — proved tricky.

I understand it might be tricky, but do you mind sharing what you have
so far. Maybe someone else can help you to reproduce the issue. Also, it
might be enough to have a test that can reproduce the WARN not 100% of
the time, as long as it is not 0. I will wait for this test before
applying the v3.

At least having something exercising new paths: here, having the new
call to mptcp_remove_anno_list_by_saddr() returning true.

> syzbot is reproducing the bug reliably on current upstream (3 crashes
> between 2026/05/19 and 2026/05/22 on kernels including cca95436be15).
> The syzbot reproducer is the most reliable pre-fix evidence available.

Because syzbot didn't manage to generate a reproducer, we cannot really
rely on syzbot to say that the bug is fixed. 3 crashes out of how many
thousands/millions attempts? :)

> I will continue working on the packetdrill test and send it as a
> follow-up once I have a clean before/after result. For v3 I have
> addressed your comment shortening request.

Thanks!

Do not forget to wait ~1 day between submissions, otherwise it is even
harder for reviewers and various tools to follow the modifications and
discussions.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.