Re: [PATCH mptcp-next v2 2/5] Squash to "bpf: Export mptcp packet scheduler helpers"

[Geliang Tang <geliang@kernel.org>]

Hi Shardul,

Thanks for this v2. It's much better now.

On Fri, 2026-07-03 at 22:27 +0530, Shardul Bankar wrote:
> mptcp_pm_subflow_chk_stale() is exposed to BPF MPTCP packet
> schedulers as
> a kfunc taking a generic "struct sock *ssk", but it treats ssk as a
> subflow TCP socket: it derives the subflow context with
> mptcp_subflow_ctx(), an unchecked cast of inet_csk(ssk)-
> >icsk_ulp_data,
> then reads and writes through it. The verifier only proves ssk is a
> trusted struct sock, not that it is one of msk's subflows, so a
> mistyped
> or foreign socket would make the helper operate on a bogus context.
> 
> Register a bpf_mptcp_pm_subflow_chk_stale() wrapper that validates
> ssk is
> a full MPTCP subflow TCP socket belonging to the passed msk before
> calling
> the helper, which assumes both but checks neither. This mirrors
> bpf_mptcp_subflow_ctx(). A scheduler passing one of its own subflows
> is
> unaffected; the in-tree burst scheduler selftest is updated to the
> wrapper
> name in a separate squash-to.
> 
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
> ---
>  net/mptcp/bpf.c | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
> index 9355fb53e89d5..e2d2c3394ad71 100644
> --- a/net/mptcp/bpf.c
> +++ b/net/mptcp/bpf.c
> @@ -306,6 +306,18 @@ __bpf_kfunc static void
> bpf_mptcp_set_timeout(struct mptcp_sock *msk)
>  	mptcp_set_timeout((struct sock *)msk);
>  }
>  
> +__bpf_kfunc static void
> +bpf_mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct
> sock *ssk)
> +{
> +	if (ssk && sk_fullsock(ssk) && ssk->sk_type == SOCK_STREAM
> &&
> +	    ssk->sk_protocol == IPPROTO_TCP && sk_is_mptcp(ssk)) {
> +		struct mptcp_subflow_context *subflow =
> mptcp_subflow_ctx(ssk);
> +
> +		if (subflow && subflow->conn == (const struct sock
> *)msk)

Sashiko complained that the rcu lock is not held here [1]. It seems we
can add the lock, something like:

    rcu_read_lock();
    subflow = mptcp_subflow_ctx(ssk);
    if (subflow && subflow->conn == (const struct sock *)msk)
            mptcp_pm_subflow_chk_stale(msk, ssk);
    rcu_read_unlock();


WDYT?

Thanks,
-Geliang

[1]
https://sashiko.dev/#/patchset/20260703-mptcp_bpf_kfunc_fixes-v2-0-87ae3c64dc7e@mpiricsoftware.com?part=2

> +			mptcp_pm_subflow_chk_stale(msk, ssk);
> +	}
> +}
> +
>  __bpf_kfunc_end_defs();
>  
>  BTF_KFUNCS_START(bpf_mptcp_iter_kfunc_ids)
> @@ -327,7 +339,7 @@ BTF_ID_FLAGS(func, mptcp_subflow_active)
>  BTF_ID_FLAGS(func, bpf_mptcp_set_timeout)
>  BTF_ID_FLAGS(func, mptcp_wnd_end)
>  BTF_ID_FLAGS(func, bpf_sk_stream_memory_free)
> -BTF_ID_FLAGS(func, mptcp_pm_subflow_chk_stale, KF_SLEEPABLE)
> +BTF_ID_FLAGS(func, bpf_mptcp_pm_subflow_chk_stale, KF_SLEEPABLE)
>  BTF_KFUNCS_END(bpf_mptcp_common_kfunc_ids)
>  
>  static int bpf_mptcp_common_kfunc_filter(const struct bpf_prog
> *prog, u32 kfunc_id)