[PATCH mptcp-next v7 0/6] mptcp: avoid data-races around the sysctls

[Gang Yan <gang.yan@linux.dev>]

From: Gang Yan <yangang@kylinos.cn>

Changlog:
v7:
Patch 5:
 - Rephrase the commit message accoding to sashiko's comments.[1]

Patch 6:
 - Fix the use-after-free reported by sashiko [2]: the module reference is
   now taken inside the same RCU read section as the pointer fetch in
   mptcp_pm_data_reset(), so the ops cannot be freed between the
   rcu_read_unlock() and the bpf_try_module_get() that previously
   lived in mptcp_pm_ops_init(). The fallback to mptcp_pm_kernel now
   takes a reference as well, fixing a pre-existing refcount
   underflow when MPTCP is built as a module.
 - Fix the reported use-after-free in [2]: take the module reference inside
   the same RCU read section as the pointer fetch.
 - The remaining of [2] are not actual issues, along with the
   "scheduling while atomic" one which does not apply: lock_sock()
   has mutex semantics, no spinlock is held across synchronize_rcu().
 - Clear the pm.ops inherited by cloned sockets before re-selecting
   it: the clone entered the swap logic with a reference it never
   took, and the grace period wait could run in RX softirq.
 - Wait for a grace period before releasing the retired ops in all
   cases (same-ops reuse and final destruction included).
v6:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260904093531.20023-1-gang.yan@linux.dev/
v5:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260828060643.14397-1-gang.yan@linux.dev/

v4:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260824073625.57471-1-gang.yan@linux.dev/

v3:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260819125629.49823-1-gang.yan@linux.dev/

v2:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260818094825.48446-1-gang.yan@linux.dev/

v2:
 Link: https://patchwork.kernel.org/project/mptcp/cover/20260817012452.7519-1-gang.yan@linux.dev/

[1] https://sashiko.dev/#/patchset/20260904093531.20023-1-gang.yan@linux.dev?part=5
[2] https://sashiko.dev/#/patchset/20260904093531.20023-1-gang.yan@linux.dev?part=6

Gang Yan (5):
  mptcp: sched: change scheduler sysctl atomically
  mptcp: pm: change path_manager sysctl atomically
  mptcp: pm: use WRITE_ONCE() for the pm_type sysctl
  Squash-to "mptcp: pm: init and release mptcp_pm_ops"
  Squash to previous one

Matthieu Baerts (NGI0) (1):
  mptcp: use READ_ONCE() over sysctls

 net/mptcp/ctrl.c     | 141 ++++++++++++++++++++++++++++++++-----------
 net/mptcp/pm.c       |  64 ++++++++++++++------
 net/mptcp/protocol.c |   7 ++-
 net/mptcp/protocol.h |   9 +--
 net/mptcp/sched.c    |   2 +-
 net/mptcp/subflow.c  |   9 ++-
 6 files changed, 171 insertions(+), 61 deletions(-)

-- 
2.43.0