Re: [PATCH mptcp-net v4 0/2] mptcp: pm: fix extra_subflows underflow for userspace PM

[Matthieu Baerts <matttbe@kernel.org>]

Hi Tao,

On 22/05/2026 18:46, Tao Cui wrote:
> This is v4 of the series that fixes extra_subflows u8 underflow bugs
> in the MPTCP userspace path manager.
> 
> extra_subflows is a u8 field in struct mptcp_pm_data. The userspace PM
> increments it after __mptcp_subflow_connect() succeeds, but
> __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to
> roll back the pre-increment done by the kernel PM. Because the userspace
> PM hasn't incremented yet at that point, this decrement is spurious and
> causes extra_subflows to underflow from 0 to 255.
> 
> Patch 1 fixes the underflow by aligning the userspace PM with the kernel
> PM: increment extra_subflows before calling __mptcp_subflow_connect(),
> so the existing error path in subflow.c correctly rolls it back on
> failure. This also eliminates the race window described in v3 patch 2
> where the worker could decrement before the user thread increments.
> 
> Patch 2 adds a selftest to validate that subflow creation failure with
> an unreachable address does not corrupt the extra_subflows counter.
Thank you for the v4, the series looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.