Re: [PATCH mptcp-next 1/2] mptcp: pm: bound extra_subflows admission on userspace PM

[Matthieu Baerts <matttbe@kernel.org>]

Hi Tao,

+ cc Quanye

On 31/08/2026 11:32, Tao Cui wrote:
> From: Tao Cui <cuitao@kylinos.cn>
> 
> mptcp_pm_allow_new_subflow() increments the u8 extra_subflows counter
> for every accepted MP_JOIN on sockets using the userspace PM, without
> any limit. A peer establishing more than 255 live subflows wraps the
> counter back to 0, which then makes the underflow guards warn on the
> next subflow close, and permanently corrupts mptcpi_subflows_total
> reported to userspace.
> 
> Refuse new MP_JOINs once the counter has reached U8_MAX, so that it
> cannot wrap anymore.
> 
> Fixes: e99c1ca89071 ("mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow")
> Link: https://github.com/multipath-tcp/mptcp_net-next/issues/629

Do you have a GitHub account? Just to know if we can assign this task to
you (or just leave a message in the comment section).

> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  net/mptcp/pm.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
> index 8b68868255c5..3990f6775723 100644
> --- a/net/mptcp/pm.c
> +++ b/net/mptcp/pm.c
> @@ -562,10 +562,17 @@ bool mptcp_pm_allow_new_subflow(struct mptcp_sock *msk)
>  
>  	if (mptcp_pm_is_userspace(msk)) {
>  		if (mptcp_userspace_pm_active(msk)) {
> +			bool allow;

"ret" could be re-used here.

> +
> +			/* extra_subflows is a u8: don't let a peer wrap it
> +			 * with more than U8_MAX accepted MP_JOINs
> +			 */

I don't think this comment is needed, "< U8_MAX" is probably clear enough.

>  			spin_lock_bh(&pm->lock);
> -			pm->extra_subflows++;
> +			allow = pm->extra_subflows < U8_MAX;
> +			if (allow)
> +				pm->extra_subflows++;
>  			spin_unlock_bh(&pm->lock);
> -			return true;
> +			return allow;
>  		}
>  		return false;
>  	}

So, at the end, we can re-used the same version as Quanye. Would it be
OK for both of you to have a Co-developed-by tag here?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.