[PATCH net] mptcp: upgrade network refcount before socket lock

[PATCH net] mptcp: upgrade network refcount before socket lock

[Runyu Xiao]

sk_net_refcnt_upgrade() calls get_net_track() with GFP_KERNEL and can enter
direct reclaim. Calling it while holding the newly created subflow socket
lock can create a reclaim-to-socket-lock dependency cycle.

Upgrade the network reference before taking the socket lock. The socket is
newly created and has not been exposed to other code at this point, so the
fields changed by sk_net_refcnt_upgrade() are not accessed concurrently.
The error path still releases the socket normally after the upgrade.

The PatchProof static-analysis tool detected a GFP_KERNEL allocation while
the socket lock is held. Manual source review of v7.1.5 and current
mainline confirmed the lock and allocation ordering.

A source-level check found `sk_net_refcnt_upgrade()` after
`lock_sock_nested()` in the original function and before it after this
change. A POSIX-thread lock-order model made the reclaim lock unavailable
while the socket lock was held, observed `EBUSY` for the reclaim lock, and
then completed with the reclaim-first order. The model checks the ordering
invariant only; it does not execute the kernel MPTCP path. No live lockdep
MPTCP test or reclaim fault injection was run.

Fixes: 1d2f3d3c6268 ("mptcp: adjust to use netns refcount tracker")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 net/mptcp/subflow.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index e1f20ff8fdb4..a9f951cc6a0e 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1786,6 +1786,12 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
 	if (err)
 		return err;
 
+	/* kernel sockets do not by default acquire net ref, but TCP timer
+	 * needs it.
+	 * Update ns_tracker to current stack trace and refcounted tracker.
+	 */
+	sk_net_refcnt_upgrade(sf->sk);
+
 	lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
 
 	err = security_mptcp_add_subflow(sk, sf->sk);
@@ -1795,11 +1801,6 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
 	/* the newly created socket has to be in the same cgroup as its parent */
 	mptcp_attach_cgroup(sk, sf->sk);
 
-	/* kernel sockets do not by default acquire net ref, but TCP timer
-	 * needs it.
-	 * Update ns_tracker to current stack trace and refcounted tracker.
-	 */
-	sk_net_refcnt_upgrade(sf->sk);
 	err = tcp_set_ulp(sf->sk, "mptcp");
 	if (err)
 		goto err_free;
-- 
2.34.1

Re: [PATCH net] mptcp: upgrade network refcount before socket lock

[gang.yan]

August 9, 2026 at 5:19 PM, "Runyu Xiao" <runyu.xiao@seu.edu.cn mailto:runyu.xiao@seu.edu.cn?to=%22Runyu%20Xiao%22%20%3Crunyu.xiao%40seu.edu.cn%3E > wrote:

Hi,

Thanks for your patch.

> 
> sk_net_refcnt_upgrade() calls get_net_track() with GFP_KERNEL and can enter
> direct reclaim. Calling it while holding the newly created subflow socket
> lock can create a reclaim-to-socket-lock dependency cycle.
> 
> Upgrade the network reference before taking the socket lock. The socket is
> newly created and has not been exposed to other code at this point, so the
> fields changed by sk_net_refcnt_upgrade() are not accessed concurrently.
> The error path still releases the socket normally after the upgrade.
> 
> The PatchProof static-analysis tool detected a GFP_KERNEL allocation while
> the socket lock is held. Manual source review of v7.1.5 and current
> mainline confirmed the lock and allocation ordering.
> 
> A source-level check found `sk_net_refcnt_upgrade()` after
> `lock_sock_nested()` in the original function and before it after this
> change. A POSIX-thread lock-order model made the reclaim lock unavailable
> while the socket lock was held, observed `EBUSY` for the reclaim lock, and
> then completed with the reclaim-first order. The model checks the ordering
> invariant only; it does not execute the kernel MPTCP path. No live lockdep
> MPTCP test or reclaim fault injection was run.
> 

Maybe the commit message seems too long. Could you please send a v2 with a more
concise commit message? For your reference, here is a suggested simplified version:

'''
sk_net_refcnt_upgrade() performs a GFP_KERNEL allocation (via get_net_track()
→ ref_tracker_alloc()), which can enter direct reclaim and establish a
socket_lock → fs_reclaim dependency. Move it before lock_sock_nested(), mirroring
the convention documented in net/rds/tcp.c:rds_tcp_tune(). 

The socket is freshly created and unpublished at this point, so sk_net_refcnt/
ns_tracker are not touched by any concurrent path; the error path still releases
via sock_release() which handles both refcounted and non-refcounted trackers.
'''

Please note that this suggested text is generated by AI, so please review it
carefully before adopting it. Also, the next patch can only be sent to mptcp@lists.linux.dev,
no need to cc to others.


> Fixes: 1d2f3d3c6268 ("mptcp: adjust to use netns refcount tracker")
> Cc: stable@vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  net/mptcp/subflow.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index e1f20ff8fdb4..a9f951cc6a0e 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -1786,6 +1786,12 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
>  if (err)
>  return err;
>  
> + /* kernel sockets do not by default acquire net ref, but TCP timer
> + * needs it.
> + * Update ns_tracker to current stack trace and refcounted tracker.
> + */
> + sk_net_refcnt_upgrade(sf->sk);
> +
>  lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
> 
>  err = security_mptcp_add_subflow(sk, sf->sk);
> @@ -1795,11 +1801,6 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
>  /* the newly created socket has to be in the same cgroup as its parent */
>  mptcp_attach_cgroup(sk, sf->sk);
>  
> - /* kernel sockets do not by default acquire net ref, but TCP timer
> - * needs it.
> - * Update ns_tracker to current stack trace and refcounted tracker.
> - */
> - sk_net_refcnt_upgrade(sf->sk);
>  err = tcp_set_ulp(sf->sk, "mptcp");
>  if (err)
>  goto err_free;

LKGM!
You can add 'Acked-by: Gang Yan <gang.yan@linux.dev>' in your next patch.

Thanks
Gang

> -- 
> 2.34.1
>

Re: [PATCH net] mptcp: upgrade network refcount before socket lock

[Matthieu Baerts]

Hi Runyu,

On 09/08/2026 11:19, Runyu Xiao wrote:
> sk_net_refcnt_upgrade() calls get_net_track() with GFP_KERNEL and can enter
> direct reclaim. Calling it while holding the newly created subflow socket
> lock can create a reclaim-to-socket-lock dependency cycle.
> 
> Upgrade the network reference before taking the socket lock. The socket is
> newly created and has not been exposed to other code at this point, so the
> fields changed by sk_net_refcnt_upgrade() are not accessed concurrently.
> The error path still releases the socket normally after the upgrade.

Thank you for the patch! Even if I agree with Gang that the commit
message could be improved, the code looks good to me, and probably best
not to increase the traffic on the netdev list. So it looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

@Net maintainers: this patch can be applied to net directly.

> The PatchProof static-analysis tool detected a GFP_KERNEL allocation while
> the socket lock is held. Manual source review of v7.1.5 and current
> mainline confirmed the lock and allocation ordering.
> 
> A source-level check found `sk_net_refcnt_upgrade()` after
> `lock_sock_nested()` in the original function and before it after this
> change. A POSIX-thread lock-order model made the reclaim lock unavailable
> while the socket lock was held, observed `EBUSY` for the reclaim lock, and
> then completed with the reclaim-first order. The model checks the ordering
> invariant only; it does not execute the kernel MPTCP path. No live lockdep
> MPTCP test or reclaim fault injection was run.

Interesting. By chance, any reproducer to share?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH net] mptcp: upgrade network refcount before socket lock

[Kuniyuki Iwashima]

From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Sun,  9 Aug 2026 17:19:49 +0800
> sk_net_refcnt_upgrade() calls get_net_track() with GFP_KERNEL and can enter
> direct reclaim. Calling it while holding the newly created subflow socket
> lock can create a reclaim-to-socket-lock dependency cycle.

I guess this involves NBD, and then it should be false-positive.

It makes lockdep complain about all sleepable memory allocation
under lock_sock() for TCP/AF_UNIX-SOCK_STREAM sockets.

NBD must process TX requests asynchronously to remove the dependency.


> 
> Upgrade the network reference before taking the socket lock. The socket is
> newly created and has not been exposed to other code at this point, so the
> fields changed by sk_net_refcnt_upgrade() are not accessed concurrently.
> The error path still releases the socket normally after the upgrade.
> 
> The PatchProof static-analysis tool detected a GFP_KERNEL allocation while
> the socket lock is held. Manual source review of v7.1.5 and current
> mainline confirmed the lock and allocation ordering.
> 
> A source-level check found `sk_net_refcnt_upgrade()` after
> `lock_sock_nested()` in the original function and before it after this
> change. A POSIX-thread lock-order model made the reclaim lock unavailable
> while the socket lock was held, observed `EBUSY` for the reclaim lock, and
> then completed with the reclaim-first order. The model checks the ordering
> invariant only; it does not execute the kernel MPTCP path. No live lockdep
> MPTCP test or reclaim fault injection was run.
> 
> Fixes: 1d2f3d3c6268 ("mptcp: adjust to use netns refcount tracker")
> Cc: stable@vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  net/mptcp/subflow.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index e1f20ff8fdb4..a9f951cc6a0e 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -1786,6 +1786,12 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
>  	if (err)
>  		return err;
>  
> +	/* kernel sockets do not by default acquire net ref, but TCP timer
> +	 * needs it.
> +	 * Update ns_tracker to current stack trace and refcounted tracker.
> +	 */
> +	sk_net_refcnt_upgrade(sf->sk);
> +
>  	lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
>  
>  	err = security_mptcp_add_subflow(sk, sf->sk);
> @@ -1795,11 +1801,6 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
>  	/* the newly created socket has to be in the same cgroup as its parent */
>  	mptcp_attach_cgroup(sk, sf->sk);
>  
> -	/* kernel sockets do not by default acquire net ref, but TCP timer
> -	 * needs it.
> -	 * Update ns_tracker to current stack trace and refcounted tracker.
> -	 */
> -	sk_net_refcnt_upgrade(sf->sk);
>  	err = tcp_set_ulp(sf->sk, "mptcp");
>  	if (err)
>  		goto err_free;
> -- 
> 2.34.1