[PATCH net] mptcp: pm: in-kernel: fix C-flag endpoint accounting on family mismatch
flat view
WARM2d
From: Yiming Qian <hidden>
Date: 2026-10-06 11:44:20
Also in:
mptcp, stable
Subsystem:
networking [general], networking [mptcp], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Matthieu Baerts, Mat Martineau, Linus Torvalds
fill_local_addresses_vec_c_flag() clears the endpoint ID bit in
id_avail_bitmap before checking whether the endpoint's address family
matches the remote ADD_ADDR. If it does not match, the loop skips the
endpoint without incrementing local_addr_used, leaving id_avail_bitmap
and local_addr_used inconsistent.
Removing that SUBFLOW endpoint later calls
__mark_subflow_endp_available(), which sees the cleared bit, expects
local_addr_used to be non-zero, and triggers a WARN and, with
panic_on_warn=1, a panic.
Keep the endpoints that are skipped during this specific C-flag
iteration available by tracking them in a local bitmap passed to
select_local_address(), instead of clearing their IDs in the per-socket
bitmap. Only IDs of endpoints actually used for a subflow are now
cleared and accounted for.
Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag")
Cc: stable@vger.kernel.org
Signed-off-by: Yiming Qian <redacted>
---
net/mptcp/pm_kernel.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
index 1a77508132354..a5952dd0ae125 100644
--- a/net/mptcp/pm_kernel.c
+++ b/net/mptcp/pm_kernel.c@@ -120,6 +120,7 @@ static bool has_subflow_daddr(const struct mptcp_sock *msk, static bool select_local_address(const struct pm_nl_pernet *pernet, const struct mptcp_sock *msk, + const unsigned long *skip, struct mptcp_pm_local *new_local) { struct mptcp_pm_addr_entry *entry;
@@ -135,6 +136,9 @@ select_local_address(const struct pm_nl_pernet *pernet, if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap)) continue; + if (skip && test_bit(entry->addr.id, skip)) + continue; + new_local->addr = entry->addr; new_local->flags = entry->flags; new_local->ifindex = entry->ifindex;
@@ -401,7 +405,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) if (signal_and_subflow) signal_and_subflow = false; - else if (!select_local_address(pernet, msk, &local)) + else if (!select_local_address(pernet, msk, NULL, &local)) break; fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
@@ -574,22 +578,28 @@ fill_local_addresses_vec_c_flag(struct mptcp_sock *msk, u8 endp_subflow_max = mptcp_pm_get_endp_subflow_max(msk); struct sock *sk = (struct sock *)msk; struct mptcp_pm_local *local; + DECLARE_BITMAP(skip, MPTCP_PM_MAX_ADDR_ID + 1); int i = 0; + bitmap_zero(skip, MPTCP_PM_MAX_ADDR_ID + 1); + while (msk->pm.local_addr_used < endp_subflow_max) { local = &locals[i]; - if (!select_local_address(pernet, msk, local)) + if (!select_local_address(pernet, msk, skip, local)) break; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); - - if (!mptcp_pm_addr_families_match(sk, &local->addr, remote)) + if (!mptcp_pm_addr_families_match(sk, &local->addr, remote)) { + __set_bit(local->addr.id, skip); continue; + } - if (local->addr.id == msk->mpc_endpoint_id) + if (local->addr.id == msk->mpc_endpoint_id) { + __set_bit(local->addr.id, skip); continue; + } + __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); msk->pm.local_addr_used++; msk->pm.extra_subflows++; i++;
--
2.34.1