Re: [PATCH 5.10.y] mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

[Matthieu Baerts <matttbe@kernel.org>]

Hi Sasha,

On 19/05/2026 21:52, Sasha Levin wrote:
> From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
> 
> [ Upstream commit 9634cb35af17019baec21ca648516ce376fa10e6 ]
> 
> When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().
> It should then be released in all cases at the end.
> 
> Some (unlikely) checks were returning directly instead of calling
> sock_put() to decrease the refcount. Jump to a new 'exit' label to call
> __sock_put() (which will become sock_put() in the next commit) to fix
> this potential leak.
> 
> While at it, drop the '!msk' check which cannot happen because it is
> never reset, and explicitly mark the remaining one as "unlikely".
> 
> Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
> Cc: stable@vger.kernel.org
> Reviewed-by: Mat Martineau <martineau@kernel.org>
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca8091060a4@kernel.org
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> [ reused existing `out:` label instead of introducing a new `exit:` label since stable's `out:` only does `__sock_put(sk)` ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
See my comment for the same patch for 6.6: this conflict shouldn't exist
if "mptcp: pm: ADD_ADDR rtx: fix potential data-race" you sent earlier
is applied first. A new version is then needed.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.