[PATCH mptcp-net] mptcp: pm: cap userspace extra_subflows at U8_MAX

[PATCH mptcp-net] mptcp: pm: cap userspace extra_subflows at U8_MAX

[Quanye Yang via B4 Relay]

From: Quanye Yang <quanyeyang@proton.me>

The userspace PM increments extra_subflows with no upper bound. The
field is a u8, so the 256th extra subflow wraps the counter to 0 and
the next close hits WARN_ON_ONCE().

Refuse admission at U8_MAX for incoming MP_JOIN and for the Netlink
create path.

Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos")
Cc: stable@vger.kernel.org
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/629
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
 net/mptcp/pm.c           |  6 ++++--
 net/mptcp/pm_userspace.c | 20 +++++++++++++-------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index b0b71adefb8f..d2ea0bd39a69 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -563,9 +563,11 @@ bool mptcp_pm_allow_new_subflow(struct mptcp_sock *msk)
 	if (mptcp_pm_is_userspace(msk)) {
 		if (mptcp_userspace_pm_active(msk)) {
 			spin_lock_bh(&pm->lock);
-			pm->extra_subflows++;
+			ret = pm->extra_subflows < U8_MAX;
+			if (ret)
+				pm->extra_subflows++;
 			spin_unlock_bh(&pm->lock);
-			return true;
+			return ret;
 		}
 		return false;
 	}
diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
index fab16d953dbf..6d798dd96702 100644
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -427,16 +427,22 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *skb, struct genl_info *info)
 	local.ifindex = entry.ifindex;
 
 	spin_lock_bh(&msk->pm.lock);
-	msk->pm.extra_subflows++;
-	spin_unlock_bh(&msk->pm.lock);
+	if (msk->pm.extra_subflows == U8_MAX) {
+		spin_unlock_bh(&msk->pm.lock);
+		GENL_SET_ERR_MSG(info, "too many extra subflows");
+		err = -ENOSPC;
+	} else {
+		msk->pm.extra_subflows++;
+		spin_unlock_bh(&msk->pm.lock);
 
-	lock_sock(sk);
-	err = __mptcp_subflow_connect(sk, &local, &addr_r);
-	release_sock(sk);
+		lock_sock(sk);
+		err = __mptcp_subflow_connect(sk, &local, &addr_r);
+		release_sock(sk);
+		if (err)
+			GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err);
+	}
 
 	if (err) {
-		GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err);
-
 		spin_lock_bh(&msk->pm.lock);
 		mptcp_userspace_pm_delete_local_addr(msk, &entry);
 		spin_unlock_bh(&msk->pm.lock);

---
base-commit: 9fbdf9ec14b806afdf66ea265477cb9d4790c866
change-id: 20260902-mptcp-pm-extra-subflows-dfaf79f1f198

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>

Re: [PATCH mptcp-net] mptcp: pm: cap userspace extra_subflows at U8_MAX

[Matthieu Baerts]

Hi Quanye,

+cc Tao

On 02/09/2026 17:39, Quanye Yang via B4 Relay wrote:
> From: Quanye Yang <quanyeyang@proton.me>
> 
> The userspace PM increments extra_subflows with no upper bound. The
> field is a u8, so the 256th extra subflow wraps the counter to 0 and
> the next close hits WARN_ON_ONCE().
> 
> Refuse admission at U8_MAX for incoming MP_JOIN and for the Netlink
> create path.

Thank you for the patch. It looks like Tao already addresses the same
issues, see:

https://lore.kernel.org/20260831093206.689827-1-cui.tao@linux.dev

Do you mind syncing with him, please?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.