Re: [PATCH mptcp-next v2 4/5] Squash to "mptcp: pm: init and release mptcp_pm_ops"

[gang.yan@linux.dev]

August 18, 2026 at 6:03 PM, sashiko-bot@kernel.org mailto:sashiko-bot@kernel.org  wrote:


> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Resource Leak on Error Path in `mptcp_net_init`
> --
> 
> --- Patch [4]: [PATCH mptcp-next v2 4/5] Squash to "mptcp: pm: init and release mptcp_pm_ops" ---
> commit b8f493287a2fef63b437fe19fc22666b77c1c08b
> Author: Gang Yan <yangang@kylinos.cn>
> 
> Squash to "mptcp: pm: init and release mptcp_pm_ops"
> 
> This commit introduces lifetime handling for mptcp_pm_ops at the pernet
> level. It pins the default mptcp_pm_kernel by taking a module reference
> during pernet defaults initialization and releases it during network
> namespace exit.
> 
> > 
> > diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> >  index 733706f06f1b1..32268aa260976 100644
> >  --- a/net/mptcp/ctrl.c
> >  +++ b/net/mptcp/ctrl.c
> >  @@ -124,7 +124,9 @@ static void mptcp_pernet_set_defaults(struct mptcp_pernet *pernet)
> >  pernet->pm_type = MPTCP_PM_TYPE_KERNEL;
> >  
> >  RCU_INIT_POINTER(pernet->scheduler, &mptcp_sched_default);
> >  - RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel);
> >  +
> >  + if (bpf_try_module_get(&mptcp_pm_kernel, mptcp_pm_kernel.owner))
> >  + RCU_INIT_POINTER(pernet->path_manager, &mptcp_pm_kernel);
> > 
> [Severity: Medium]
> Does this introduce a module reference leak regression on the error path
> during network namespace initialization?
> 
> When mptcp_pernet_set_defaults() takes this module reference, it is called
> from mptcp_net_init() right before mptcp_pernet_new_table():
> 
> mptcp_net_init() {
>  mptcp_pernet_set_defaults(pernet);
>  return mptcp_pernet_new_table(net, pernet);
> }
> 
> If mptcp_pernet_new_table() fails and returns an error, the error is
> propagated without releasing the module reference acquired here. Because the
> initialization failed, the core network namespace code will not call the
> corresponding exit function mptcp_net_exit() to release it.
> 
> Should mptcp_net_init() clean up the reference if mptcp_pernet_new_table()
> fails?
> 

Good catch.

Maybe check the return val of mptcp_pernet_new_table could handle this. It can
be done in v3.

Thanks
Gang


> [ ... ]
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260818094825.48446-1-gang.yan@linux.dev?part=4
>