Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add_timer()

[Matthieu Baerts <matttbe@kernel.org>]

Hi Eric,

(+cc MPTCP ML)

On 17/11/2025 11:07, Eric Dumazet wrote:
> mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
> while another might have free entry already, as reported by syzbot.
> 
> Add RCU protection to fix this issue.

Thank you for the report and even more for the fix!

> Also change confusing add_timer variable with stop_timer boolean.

Indeed, this name was confusing: 'add_timer' is in fact a (too) short
version of "additional address signalling retransmission timer". This
new 'stop_timer' boolean makes sense!

> syzbot report:

(...)

> Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
> Reported-by: syzbot+2a6fbf0f0530375968df@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/691ad3c3.a70a0220.f6df1.0004.GAE@google.com/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Geliang Tang <geliang@kernel.org>

The modification looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

While at it, just to help me to manage the backports:

Cc: stable@vger.kernel.org

> v2: Updated/Added Reported-by:/Closes: tags now syzbot report finally reached netdev@ mailing list.

Out of curiosity, is it not OK to reply to the patch with the new
Reported-by & Closes tags to have them automatically added when applying
the patch? (I was going to do that on the v1, then I saw the v2 just
when I was going to press 'Send' :) )

I don't mind having a v2, it is just to save you time later, but maybe
there is another reason.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.