diff options
| author | Tao Cui <cuitao@kylinos.cn> | 2026-08-12 16:55:36 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-08-17 17:25:49 -0700 |
| commit | e99c1ca890716a45d843f289c617d1bca00ba237 (patch) | |
| tree | e411646a1f7f7c1b413ead9317bcdf371872a49f /net | |
| parent | ff31c9a708e646732f4ca880bc75f7a63b6099ba (diff) | |
mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow
extra_subflows is a u8 counter that can underflow if a decrement races
with or precedes an increment. While the recently fixed userspace PM
subflow creation path eliminated the primary cause, add defensive
WARN_ON_ONCE guards at both decrement sites to catch any remaining edge
cases rather than silently wrapping to 255.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-1-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mptcp/pm.c | 3 | ||||
| -rw-r--r-- | net/mptcp/protocol.h | 3 |
2 files changed, 4 insertions, 2 deletions
diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index d1f73c3e39fa..8b68868255c5 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -670,7 +670,8 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, if (mptcp_pm_is_userspace(msk)) { if (update_subflows) { spin_lock_bh(&pm->lock); - pm->extra_subflows--; + if (!WARN_ON_ONCE(pm->extra_subflows == 0)) + pm->extra_subflows--; spin_unlock_bh(&pm->lock); } return; diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index b3af3462bdd1..20627e12c113 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -1254,7 +1254,8 @@ u8 mptcp_pm_get_limit_extra_subflows(const struct mptcp_sock *msk); /* called under PM lock */ static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk) { - if (--msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk)) + if (!WARN_ON_ONCE(msk->pm.extra_subflows == 0) && + --msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk)) WRITE_ONCE(msk->pm.accept_subflow, true); } |