Re: [PATCH mptcp-next v2 3/3] mptcp: pm: userspace: cap extra_subflows on Netlink subflow creation

[Matthieu Baerts <matttbe@kernel.org>]

Hi Tao, Quanye,

On 03/09/2026 15:14, Tao Cui wrote:
> From: Quanye Yang <quanyeyang@proton.me>
> 
> mptcp_pm_nl_subflow_create_doit() also increments the u8 extra_subflows
> counter without any limit: a client with CAP_NET_ADMIN can create more
> than 255 extra subflows via Netlink and wrap the counter back to 0,
> with the same effects as the MP_JOIN path now bounded separately:
> the underflow guards warn on the next subflow close, and
> mptcpi_subflows_total reported to userspace is corrupted.
> 
> Refuse the subflow creation with -ENOSPC once the counter has reached
> U8_MAX, and clean up the local address entry in that case as well.
> 
> Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos")
> Link: https://lore.kernel.org/all/20260902-mptcp-pm-extra-subflows-v1-1-68540a866e5a@proton.me/
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/629
> 

(no empty line here)

> Signed-off-by: Quanye Yang <quanyeyang@proton.me>
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  net/mptcp/pm_userspace.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
> index b94fbb483bf9..3371e17d01b9 100644
> --- a/net/mptcp/pm_userspace.c
> +++ b/net/mptcp/pm_userspace.c
> @@ -417,6 +417,12 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *skb, struct genl_info *info)
>  	local.ifindex = entry.ifindex;
>  
>  	spin_lock_bh(&msk->pm.lock);
> +	if (msk->pm.extra_subflows == U8_MAX) {
> +		spin_unlock_bh(&msk->pm.lock);
> +		GENL_SET_ERR_MSG(info, "too many extra subflows");
> +		err = -ENOSPC;
> +		goto delete_addr;
> +	}
>  	msk->pm.extra_subflows++;
>  	spin_unlock_bh(&msk->pm.lock);
>  
> @@ -424,9 +430,11 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *skb, struct genl_info *info)
>  	err = __mptcp_subflow_connect(sk, &local, &addr_r);
>  	release_sock(sk);
>  
> -	if (err) {
> +	if (err)
>  		GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err);
>  
> +delete_addr:

Can you not have the label inside the if-statement?

    if (err) {
        GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err);

  delete_addr:
        (...)

> +	if (err) {
>  		spin_lock_bh(&msk->pm.lock);
>  		mptcp_userspace_pm_delete_local_addr(msk, &entry);

Maybe you can add something in the commit message for the reviewers:

  The same error path is followed after
  mptcp_userspace_pm_append_new_local_addr, which should probably not
  delete the local address unconditionally, but this is a pre-existing
  issue that will be addressed separately.

>  		spin_unlock_bh(&msk->pm.lock);

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.