Re: [PATCH net] mptcp: pm: kernel: use RCU to free endpoint listeners

[Matthieu Baerts <matttbe@kernel.org>]

Hi Eric,

On 04/11/2026 13:53, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> mptcp_pm_nl_create_listen_socket() starts the TCP listener directly
> instead of going through mptcp_listen(). It consequently misses setting
> SOCK_RCU_FREE on the parent MPTCP socket.
> 
> tcp_child_process() can invoke the listener's subflow_data_ready()
> callback without holding the MPTCP parent lock or a reference to the
> parent. An authenticated MP_JOIN racing with endpoint teardown can
> therefore access the parent after its last reference has been dropped.
> The ADD_ADDR error path can also close an already published listener.
> 
> Set SOCK_RCU_FREE before __inet_listen_sk() publishes the TCP listener,
> matching mptcp_listen(). This protects the parent on every subsequent
> close path, including a failed endpoint addition.

Thank you for the patch! But it looks like Kyle already sent it earlier
to the same list:

https://lore.kernel.org/20261030042255.74216-1-kylebot@openai.com

Probably best to drop this one here?

(It's not clear what PW state we want to set for this case)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.