Re: [PATCH net] mptcp: pm: in-kernel: fix C-flag endpoint accounting on family mismatch
flat view
From: Matthieu Baerts <matttbe@kernel.org>
Date: 2026-10-06 11:59:06
Also in:
mptcp, stable
Hi Yiming Qian, On 06/10/2026 13:42, Yiming Qian wrote:
fill_local_addresses_vec_c_flag() clears the endpoint ID bit in id_avail_bitmap before checking whether the endpoint's address family matches the remote ADD_ADDR. If it does not match, the loop skips the endpoint without incrementing local_addr_used, leaving id_avail_bitmap and local_addr_used inconsistent. Removing that SUBFLOW endpoint later calls __mark_subflow_endp_available(), which sees the cleared bit, expects local_addr_used to be non-zero, and triggers a WARN and, with panic_on_warn=1, a panic. Keep the endpoints that are skipped during this specific C-flag iteration available by tracking them in a local bitmap passed to select_local_address(), instead of clearing their IDs in the per-socket bitmap. Only IDs of endpoints actually used for a subflow are now cleared and accounted for.
Thank you for the patch. Please do not Cc security@k.o on patches sent to public ML. Here the issue is "just" a WARN produced in some conditions when the user has the rights to delete MPTCP endpoints. (Please remove it from future replies.)
quoted hunk ↗ jump to hunk
diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index 1a77508132354..a5952dd0ae125 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c
(...)
quoted hunk ↗ jump to hunk
@@ -574,22 +578,28 @@ fill_local_addresses_vec_c_flag(struct mptcp_sock *msk, u8 endp_subflow_max = mptcp_pm_get_endp_subflow_max(msk); struct sock *sk = (struct sock *)msk; struct mptcp_pm_local *local; + DECLARE_BITMAP(skip, MPTCP_PM_MAX_ADDR_ID + 1); int i = 0; + bitmap_zero(skip, MPTCP_PM_MAX_ADDR_ID + 1); + while (msk->pm.local_addr_used < endp_subflow_max) { local = &locals[i]; - if (!select_local_address(pernet, msk, local)) + if (!select_local_address(pernet, msk, skip, local)) break; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); - - if (!mptcp_pm_addr_families_match(sk, &local->addr, remote)) + if (!mptcp_pm_addr_families_match(sk, &local->addr, remote)) { + __set_bit(local->addr.id, skip); continue; + } - if (local->addr.id == msk->mpc_endpoint_id) + if (local->addr.id == msk->mpc_endpoint_id) { + __set_bit(local->addr.id, skip); continue; + } + __clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
Why is it not enough to move __clear_bit() to here? Why do you need to modify select_local_address(), etc.? Also, can you also provide a regression test as well, please? Adding a subtest in tools/testing/selftests/net/mptcp/mptcp_join.sh, e.g. in deny_join_id0_tests(), adding a new subcase using "addr_nr_ns2=-1 speed=slow run_tests (...)" to remove the subflow during the connection. Cheers, Matt -- Sponsored by the NGI0 Core fund.