[PATCH mptcp-net] mptcp: pm: kernel: c-flag: mark as used only when it is

[PATCH mptcp-net] mptcp: pm: kernel: c-flag: mark as used only when it is

[Matthieu Baerts (NGI0)]

The ID was marked as used before checking if it could actually be used
in all conditions: if the families match and the local endpoint is not
the one linked to the initial endpoint.

Marking endpoints as used while they are not can have an impact on the
local_addr_used counter when endpoints are removed -- CAP_NET_ADMIN is
required -- and active connections have such badly marked endpoints. In
this case, the local counter will be decremented while it shouldn't. If
the counter was already at 0, this warning will be emitted:

  WARNING: net/mptcp/pm_kernel.c:1080 at __mark_subflow_endp_available+0x46/0x50, CPU#0: a.out/149
  RIP: 0010:__mark_subflow_endp_available (net/mptcp/pm_kernel.c:1080 (discriminator 2) net/mptcp/pm_kernel.c:1076 (discriminator 2))
  Call Trace:
   mptcp_pm_nl_del_addr_doit (net/mptcp/pm_kernel.c:1112 net/mptcp/pm_kernel.c:1227)
   genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)

The fix is easy: simply moving the '__clear_bit' instruction after the
two checks that would cause the endpoint not to be used.

Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Closes: https://lore.kernel.org/20261006114409.117190-1-yimingqian591@gmail.com
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Note: this patch supersedes the patch mentioned above: the author
doesn't seem to be willing to send a v2. Because security@k.o was Cc'ed
on public ML, that's forcing us not to wait, even if this fix is just
about a counter that will be wrongly decremented when MPTCP endpoints
are removed (requiring CAP_NET_ADMIN). Put the original author as
"Reported-by" following the recommendations given to maintainers in such
cases.
---
 net/mptcp/pm_kernel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
index d3014bf57bf3..3e473a81389d 100644
--- a/net/mptcp/pm_kernel.c
+++ b/net/mptcp/pm_kernel.c
@@ -582,14 +582,14 @@ fill_local_addresses_vec_c_flag(struct mptcp_sock *msk,
 		if (!select_local_address(pernet, msk, local))
 			break;
 
-		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
-
 		if (!mptcp_pm_addr_families_match(sk, &local->addr, remote))
 			continue;
 
 		if (local->addr.id == msk->mpc_endpoint_id)
 			continue;
 
+		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
+
 		msk->pm.local_addr_used++;
 		msk->pm.extra_subflows++;
 		i++;

---
base-commit: 1c36f79c9bd761bc3a41d246d7a4242b287d2fc7
change-id: 20261006-mptcp-pm-cflag-clear-when-used-ee817b26a553

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

Re: [PATCH mptcp-net] mptcp: pm: kernel: c-flag: mark as used only when it is

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] mptcp: infinite loop in fill_local_addresses_vec_c_flag() on skipped endpoint
--

commit 13a1b915ae070fcc7bed06cf022912abbebad663
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>

mptcp: pm: kernel: c-flag: mark as used only when it is

This commit moves the clearing of local->addr.id in msk->pm.id_avail_bitmap
in fill_local_addresses_vec_c_flag() until after checking that the address
families match and the local endpoint is not msk->mpc_endpoint_id.

> diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
> index d3014bf57bf3c..3e473a81389d3 100644
> --- a/net/mptcp/pm_kernel.c
> +++ b/net/mptcp/pm_kernel.c
> @@ -582,14 +582,14 @@ fill_local_addresses_vec_c_flag(struct mptcp_sock *msk,
>  		if (!select_local_address(pernet, msk, local))
>  			break;
>  
> -		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
> -
>  		if (!mptcp_pm_addr_families_match(sk, &local->addr, remote))
>  			continue;
>  
>  		if (local->addr.id == msk->mpc_endpoint_id)
>  			continue;
>  
> +		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);

[Severity: Critical]
Could moving __clear_bit() after the continue statements cause an infinite
loop in fill_local_addresses_vec_c_flag()?

In net/mptcp/pm_kernel.c, select_local_address() always scans
pernet->endp_list from the head and returns the first subflow endpoint whose
ID is still set in msk->pm.id_avail_bitmap:

net/mptcp/pm_kernel.c:select_local_address() {
	...
	list_for_each_entry_rcu(entry, &pernet->endp_list, list) {
		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW))
			continue;

		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
			continue;

		new_local->addr = entry->addr;
		new_local->flags = entry->flags;
		new_local->ifindex = entry->ifindex;
		found = true;
		break;
	}
	...
}

When __mptcp_pm_kernel_worker() -> mptcp_pm_nl_add_addr_received() ->
fill_local_addresses_vec() -> fill_local_addresses_vec_c_flag() runs and the
selected endpoint either fails mptcp_pm_addr_families_match() or matches
msk->mpc_endpoint_id, the loop takes a continue branch without clearing
local->addr.id in msk->pm.id_avail_bitmap or incrementing
msk->pm.local_addr_used.

On the next iteration of while (msk->pm.local_addr_used < endp_subflow_max),
wouldn't select_local_address() return the exact same endpoint again and loop
indefinitely?

> +
>  		msk->pm.local_addr_used++;
>  		msk->pm.extra_subflows++;
>  		i++;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022-mptcp-pm-cflag-clear-when-used-v1-1-516c09b4ee65@kernel.org?part=1

Re: [PATCH mptcp-net] mptcp: pm: kernel: c-flag: mark as used only when it is

[Matthieu Baerts]

On 22/10/2026 11:24, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] mptcp: infinite loop in fill_local_addresses_vec_c_flag() on skipped endpoint
> --
> 
> commit 13a1b915ae070fcc7bed06cf022912abbebad663
> Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> 
> mptcp: pm: kernel: c-flag: mark as used only when it is
> 
> This commit moves the clearing of local->addr.id in msk->pm.id_avail_bitmap
> in fill_local_addresses_vec_c_flag() until after checking that the address
> families match and the local endpoint is not msk->mpc_endpoint_id.
> 
>> diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
>> index d3014bf57bf3c..3e473a81389d3 100644
>> --- a/net/mptcp/pm_kernel.c
>> +++ b/net/mptcp/pm_kernel.c
>> @@ -582,14 +582,14 @@ fill_local_addresses_vec_c_flag(struct mptcp_sock *msk,
>>  		if (!select_local_address(pernet, msk, local))
>>  			break;
>>  
>> -		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
>> -
>>  		if (!mptcp_pm_addr_families_match(sk, &local->addr, remote))
>>  			continue;
>>  
>>  		if (local->addr.id == msk->mpc_endpoint_id)
>>  			continue;
>>  
>> +		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
> 
> [Severity: Critical]
> Could moving __clear_bit() after the continue statements cause an infinite
> loop in fill_local_addresses_vec_c_flag()?

Mmh, yes, now I remember why __clear_bit was there...

Because this's "urgent", I will send a v2 soon with what the original
author did + a few fixes.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-net] mptcp: pm: kernel: c-flag: mark as used only when it is

[MPTCP CI]

Hi Matthieu,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/39756392967

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/d52f4467784e
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1191156


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)