[PATCH net-next 01/11] mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
Date: 2026-08-12 14:56:01
Also in:
lkml, mptcp
Subsystem:
networking [general], networking [mptcp], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Matthieu Baerts, Mat Martineau, Linus Torvalds
From: Tao Cui <redacted> extra_subflows is a u8 counter that can underflow if a decrement races with or precedes an increment. While the recently fixed userspace PM subflow creation path eliminated the primary cause, add defensive WARN_ON_ONCE guards at both decrement sites to catch any remaining edge cases rather than silently wrapping to 255. Signed-off-by: Tao Cui <redacted> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> --- net/mptcp/pm.c | 3 ++- net/mptcp/protocol.h | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index d1f73c3e39fa..8b68868255c5 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c@@ -670,7 +670,8 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, if (mptcp_pm_is_userspace(msk)) { if (update_subflows) { spin_lock_bh(&pm->lock); - pm->extra_subflows--; + if (!WARN_ON_ONCE(pm->extra_subflows == 0)) + pm->extra_subflows--; spin_unlock_bh(&pm->lock); } return;
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index b3af3462bdd1..20627e12c113 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h@@ -1254,7 +1254,8 @@ u8 mptcp_pm_get_limit_extra_subflows(const struct mptcp_sock *msk); /* called under PM lock */ static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk) { - if (--msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk)) + if (!WARN_ON_ONCE(msk->pm.extra_subflows == 0) && + --msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk)) WRITE_ONCE(msk->pm.accept_subflow, true); }
--
2.53.0