Re: [PATCH mptcp-net v3] mptcp: pm: userspace: unify entry free path via RCU callback

[Matthieu Baerts <matttbe@kernel.org>]

Hi Geliang,

On 01/07/2026 08:11, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> In mptcp_pm_nl_remove_doit(), sk_omem_alloc is decremented immediately
> but the memory is freed later via kfree_rcu(). This allows a CAP_NET_ADMIN
> user to bypass the socket memory quota and exhaust kernel memory by
> accumulating RCU callbacks.
> 
> Fix by using call_rcu() with a custom callback that uses sock_kfree_s()
> to free the entry and decrement sk_omem_alloc atomically. To ensure the
> socket remains valid until the callback runs, take a reference with
> sock_hold() when storing the socket pointer in the entry, and release it
> with sock_put() in the callback.
> 
> Convert the synchronous freeing paths in free_local_addr_list() and
> delete_local_addr() to use the same RCU callback, ensuring the socket
> reference is properly released.
> 
> Additionally, mptcp_userspace_pm_append_new_local_addr() now checks
> SOCK_DEAD under the spinlock before allocating. A SYN+JOIN handler
> holding an msk reference from mptcp_token_get_sock() could otherwise
> race with __mptcp_destroy_sock() - sock_orphan() sets SOCK_DEAD and
> then mptcp_userspace_pm_release() clears the list, so a new entry
> allocated after that point would never be freed and its sock_hold()
> would leak the msk permanently.

(...)

> diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
> index da40c6f3705f..250736eae0be 100644
> --- a/net/mptcp/protocol.h
> +++ b/net/mptcp/protocol.h
> @@ -257,6 +257,8 @@ struct mptcp_pm_addr_entry {
>  	u32			flags;
>  	int			ifindex;
>  	struct socket		*lsk;
> +	struct sock		*sk;

Also, I don't think 'lsk' is used with the userspace PM: can we re-use
it instead of adding a new one? (Or using an anonymous union?)

> +	struct rcu_head		rcu;
>  };
>  
>  struct mptcp_data_frag {

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.