Re: [PATCH] mptcp: pm: kernel: use RCU to free endpoint listeners

[Matthieu Baerts <matttbe@kernel.org>]

Hi Kyle,

On 30/10/2026 05:22, Kyle Zeng wrote:
> mptcp_pm_nl_create_listen_socket() starts the TCP listener directly
> instead of going through mptcp_listen(). It consequently misses setting
> SOCK_RCU_FREE on the parent MPTCP socket.
> 
> tcp_child_process() can invoke the listener's subflow_data_ready()
> callback without holding the MPTCP parent lock or a reference to the
> parent. An authenticated MP_JOIN racing with endpoint teardown can
> therefore access the parent after its last reference has been dropped.
> The ADD_ADDR error path can also close an already published listener.
> 
> Set SOCK_RCU_FREE before __inet_listen_sk() publishes the TCP listener,
> matching mptcp_listen(). This protects the parent on every subsequent
> close path, including a failed endpoint addition.
Thank you for the fix, it looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

@Net maintainers: this patch can be applied in -net directly.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.