[PATCH net-next 01/11] mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow
From: Matthieu Baerts (NGI0)
Date: Wed Aug 12 2026 - 10:56:32 EST
From: Tao Cui <cuitao@xxxxxxxxxx>
extra_subflows is a u8 counter that can underflow if a decrement races
with or precedes an increment. While the recently fixed userspace PM
subflow creation path eliminated the primary cause, add defensive
WARN_ON_ONCE guards at both decrement sites to catch any remaining edge
cases rather than silently wrapping to 255.
Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
---
net/mptcp/pm.c | 3 ++-
net/mptcp/protocol.h | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index d1f73c3e39fa..8b68868255c5 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -670,7 +670,8 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk,
if (mptcp_pm_is_userspace(msk)) {
if (update_subflows) {
spin_lock_bh(&pm->lock);
- pm->extra_subflows--;
+ if (!WARN_ON_ONCE(pm->extra_subflows == 0))
+ pm->extra_subflows--;
spin_unlock_bh(&pm->lock);
}
return;
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index b3af3462bdd1..20627e12c113 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -1254,7 +1254,8 @@ u8 mptcp_pm_get_limit_extra_subflows(const struct mptcp_sock *msk);
/* called under PM lock */
static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk)
{
- if (--msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk))
+ if (!WARN_ON_ONCE(msk->pm.extra_subflows == 0) &&
+ --msk->pm.extra_subflows < mptcp_pm_get_limit_extra_subflows(msk))
WRITE_ONCE(msk->pm.accept_subflow, true);
}
--
2.53.0