Re: [PATCH mptcp-next 2/2] mptcp: pm: fix extra_subflows u8 underflow in userspace PM

[Geliang Tang <geliang@kernel.org>]

On Sat, 2026-05-09 at 15:56 +0800, Tao Cui wrote:
> extra_subflows is a u8 field in struct mptcp_pm_data.  Two paths in
> the
> userspace PM can cause it to underflow from 0 to 255, after which the
> counter is permanently corrupted and future subflow creation is
> blocked.
> 
> 1) __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on
> failure
>    to roll back the pre-increment done by kernel PM's fill_*()
> helpers.
>    The userspace PM does not pre-increment — it only increments after
>    __mptcp_subflow_connect() succeeds — so this decrement is
> spurious.
> 
> 2) mptcp_pm_subflow_check_next() decrements unconditionally for the
>    userspace PM without checking that the counter is non-zero.
> 
> Fix (1) by gating mptcp_pm_close_subflow() on the PM type and fix (2)
> by adding an underflow guard.

Please split this patch into two patches, one for (1), the other for
(2).

Thanks,
-Geliang

> 
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  net/mptcp/pm.c      | 3 ++-
>  net/mptcp/subflow.c | 3 ++-
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
> index 3c152bf66cd5..a83a56b467f9 100644
> --- a/net/mptcp/pm.c
> +++ b/net/mptcp/pm.c
> @@ -655,7 +655,8 @@ void mptcp_pm_subflow_check_next(struct
> mptcp_sock *msk,
>  	if (mptcp_pm_is_userspace(msk)) {
>  		if (update_subflows) {
>  			spin_lock_bh(&pm->lock);
> -			pm->extra_subflows--;
> +			if (pm->extra_subflows)
> +				pm->extra_subflows--;
>  			spin_unlock_bh(&pm->lock);
>  		}
>  		return;
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index d562e149606f..c45ad67cb650 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -1716,7 +1716,8 @@ int __mptcp_subflow_connect(struct sock *sk,
> const struct mptcp_pm_local *local,
>  	/* we account subflows before the creation, and this
> failures will not
>  	 * be caught by sk_state_change()
>  	 */
> -	mptcp_pm_close_subflow(msk);
> +	if (!mptcp_pm_is_userspace(msk))
> +		mptcp_pm_close_subflow(msk);
>  	return err;
>  }
>