[PATCH mptcp-next 0/2] mptcp: fix disconnect races around the PM and cb flags

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

Hi,

This is the follow-up series promised in reply to the Sashiko
review of the extra_subflows fixes [1]: two pre-existing issues in
the disconnect path that were reported there but left out of that
series on purpose.

Patch 1 fixes a subflow socket leak: mptcp_disconnect() clears
msk->cb_flags with a plain write and can drop a pending
MPTCP_FLUSH_JOIN_LIST, so a subflow queued in the join list while
the socket is being disconnected is never flushed by
mptcp_release_cb(), and mptcp_destroy_common() only iterates
conn_list. The flush flag is now preserved across the disconnect,
and the masking is done under the data lock like the flag setter.

Patch 2 closes a data race reported on the same socket state:
mptcp_pm_data_reset() clears the PM data with a plain memset while
the RX path accesses the same fields under pm->lock. The reset now
takes pm->lock, with no lock inversion, as the callers hold the
socket lock at most.

Both are independent of the extra_subflows series [2], which only
made the accounting robust against the counter imbalance these
races can leave behind. Paolo's recent "mptcp: prevent race
between disconnect() and rtx" fixes a third race in the same
window.

Validated with the virtme CI (mptcp selftests).

[1] https://lore.kernel.org/all/739848e0-1d35-4ed7-afd7-4b0609ddb8d0@linux.dev/
[2] https://lore.kernel.org/all/20260903131416.1112393-1-cui.tao@linux.dev/

Tao Cui (2):
  mptcp: keep pending join list flush across disconnect
  mptcp: pm: take pm->lock in mptcp_pm_data_reset()

 net/mptcp/pm.c       | 5 +++++
 net/mptcp/protocol.c | 8 +++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

-- 
2.43.0