[PATCH mptcp-next 0/2] mptcp: fix disconnect races around the PM and cb flags

[PATCH mptcp-next 0/2] mptcp: fix disconnect races around the PM and cb flags

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

Hi,

This is the follow-up series promised in reply to the Sashiko
review of the extra_subflows fixes [1]: two pre-existing issues in
the disconnect path that were reported there but left out of that
series on purpose.

Patch 1 fixes a subflow socket leak: mptcp_disconnect() clears
msk->cb_flags with a plain write and can drop a pending
MPTCP_FLUSH_JOIN_LIST, so a subflow queued in the join list while
the socket is being disconnected is never flushed by
mptcp_release_cb(), and mptcp_destroy_common() only iterates
conn_list. The flush flag is now preserved across the disconnect,
and the masking is done under the data lock like the flag setter.

Patch 2 closes a data race reported on the same socket state:
mptcp_pm_data_reset() clears the PM data with a plain memset while
the RX path accesses the same fields under pm->lock. The reset now
takes pm->lock, with no lock inversion, as the callers hold the
socket lock at most.

Both are independent of the extra_subflows series [2], which only
made the accounting robust against the counter imbalance these
races can leave behind. Paolo's recent "mptcp: prevent race
between disconnect() and rtx" fixes a third race in the same
window.

Validated with the virtme CI (mptcp selftests).

[1] https://lore.kernel.org/all/739848e0-1d35-4ed7-afd7-4b0609ddb8d0@linux.dev/
[2] https://lore.kernel.org/all/20260903131416.1112393-1-cui.tao@linux.dev/

Tao Cui (2):
  mptcp: keep pending join list flush across disconnect
  mptcp: pm: take pm->lock in mptcp_pm_data_reset()

 net/mptcp/pm.c       | 5 +++++
 net/mptcp/protocol.c | 8 +++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH mptcp-next 1/2] mptcp: keep pending join list flush across disconnect

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

mptcp_disconnect() clears msk->cb_flags with a plain write, dropping
any pending MPTCP_FLUSH_JOIN_LIST. When an MP_JOIN is processed while
the parent socket is being disconnected, the subflow is queued in
msk->join_list and the flag is set under the data lock, but the plain
write can erase it: mptcp_release_cb() then skips the flush, and as
mptcp_destroy_common() only iterates conn_list, the subflow sockets
queued in the join list are leaked. Flags that were already pending
before the disconnect are dropped the same way.

Only clear the other flags and keep MPTCP_FLUSH_JOIN_LIST, so the
join list is flushed from mptcp_release_cb() at sock lock release
time as originally intended. Do the masking under the data lock, as
mptcp_finish_join() sets the flag while queuing the subflow.

Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 net/mptcp/protocol.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index e1f08f71cdb16..7445de5a80ff4 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3615,7 +3615,13 @@ static int mptcp_disconnect(struct sock *sk, int flags)
 	WRITE_ONCE(msk->flags, 0);
 	spin_unlock_bh(&msk->fallback_lock);
 
-	msk->cb_flags = 0;
+	/* keep a pending join list flush: mptcp_destroy_common()
+	 * leaves the list to mptcp_release_cb(), the data lock
+	 * matches the flag setter in mptcp_finish_join()
+	 */
+	mptcp_data_lock(sk);
+	msk->cb_flags &= BIT(MPTCP_FLUSH_JOIN_LIST);
+	mptcp_data_unlock(sk);
 	msk->recovery = false;
 	WRITE_ONCE(msk->can_ack, false);
 	WRITE_ONCE(msk->fully_established, false);
-- 
2.43.0

[PATCH mptcp-next 2/2] mptcp: pm: take pm->lock in mptcp_pm_data_reset()

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

mptcp_pm_data_reset() clears the PM state with a plain memset while
the RX path can access the same fields in BH context under pm->lock:
on a disconnecting socket, mptcp_pm_allow_new_subflow() and friends
can run concurrently with the reset and see partially cleared data.

Take pm->lock around the reset. All the callers hold the socket lock
at most, so there is no lock inversion.

Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 net/mptcp/pm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index 8b68868255c50..e224aa6f63dd9 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -1179,6 +1179,10 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk)
 	u8 pm_type = mptcp_get_pm_type(sock_net((struct sock *)msk));
 	struct mptcp_pm_data *pm = &msk->pm;
 
+	/* the whole PM data is protected by pm->lock, the reset can
+	 * race with the RX path on a disconnecting socket
+	 */
+	spin_lock_bh(&pm->lock);
 	memset(&pm->reset, 0, sizeof(pm->reset));
 	pm->rm_list_tx.nr = 0;
 	pm->rm_list_rx.nr = 0;
@@ -1201,6 +1205,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk)
 
 		bitmap_fill(pm->id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
 	}
+	spin_unlock_bh(&pm->lock);
 }
 
 void mptcp_pm_data_init(struct mptcp_sock *msk)
-- 
2.43.0