MPTCP v0.95 kernel crash

hi @cpaasch

I use mptcp kernel v095， I download small file， When it reaches 8Wqps， cpu idle 40%，kernel crash. mptcp test version ： https://github.com/multipath-tcp/mptcp/tree/v0.95

linux message file: messages.txt

Jan 19 14:05:32 n25-146-093 kernel: [ 260.907073] ------------[ cut here ]------------ Jan 19 14:05:32 n25-146-093 kernel: [ 260.907074] refcount_t: underflow; use-after-free. Jan 19 14:05:32 n25-146-093 kernel: [ 260.907088] WARNING: CPU: 22 PID: 15586 at lib/refcount.c:187 refcount_sub_and_test_checked+0x3e/0x50 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907089] Modules linked in: binfmt_misc(E) tcp_diag(E) inet_diag(E) xt_tcpudp(E) xt_DSCP(E) xt_comment(E) iptable_mangle(E) ip_tables(E) x_tables(E) overlay(E) 8021q(E) garp(E) stp(E) mrp(E) llc(E) msr(E) intel_rapl(E) skx_edac(E) nfit(E) libnvdimm(E) x86_pkg_temp_thermal(E) coretemp(E) kvm_intel(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) pcbc(E) aesni_intel(E) aes_x86_64(E) crypto_simd(E) cryptd(E) glue_helper(E) intel_cstate(E) intel_uncore(E) intel_rapl_perf(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) pcspkr(E) sg(E) ast(E) ttm(E) drm_kms_helper(E) joydev(E) drm(E) evdev(E) i2c_algo_bit(E) ioatdma(E) mei_me(E) iTCO_wdt(E) iTCO_vendor_support(E) dca(E) mei(E) lpc_ich(E) wmi(E) ipmi_si(E) ipmi_devintf(E) ipmi_msghandler(E) pcc_cpufreq(E) button(E) tcp_bbr(E) Jan 19 14:05:32 n25-146-093 kernel: [ 260.907126] autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) mlx5_core(E) mpt3sas(E) ahci(E) raid_class(E) libahci(E) xhci_pci(E) crc32c_intel(E) devlink(E) scsi_transport_sas(E) xhci_hcd(E) libata(E) i2c_i801(E) usbcore(E) scsi_mod(E) Jan 19 14:05:32 n25-146-093 kernel: [ 260.907142] CPU: 22 PID: 15586 Comm: nginx Kdump: loaded Tainted: G E 4.19.55+ #1 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907142] Hardware name: Sugon I620-G30/60P24-US, BIOS BJGS2030 06/14/2018 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907144] RIP: 0010:refcount_sub_and_test_checked+0x3e/0x50 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907145] Code: 75 0c f0 0f b1 16 75 27 85 d2 0f 94 c0 c3 80 3d aa b0 d2 00 00 75 15 48 c7 c7 20 86 a7 a7 c6 05 9a b0 d2 00 01 e8 12 33 cb ff <0f> 0b 31 c0 c3 83 f8 ff 75 bf eb f6 66 0f 1f 44 00 00 48 89 fe bf Jan 19 14:05:32 n25-146-093 kernel: [ 260.907146] RSP: 0018:ffff94e53f583d60 EFLAGS: 00010282 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907148] RAX: 0000000000000000 RBX: ffff94e4f928c980 RCX: 0000000000000006 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907148] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff94e53f5966b0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907149] RBP: ffff94e5085abd40 R08: 0000000000000001 R09: 00000000000005fb Jan 19 14:05:32 n25-146-093 kernel: [ 260.907149] R10: fffffc14bdd06540 R11: 0000000000000000 R12: 000000000000613a Jan 19 14:05:32 n25-146-093 kernel: [ 260.907150] R13: ffff94e5190b18c0 R14: 000000000000613b R15: 000000000000613a Jan 19 14:05:32 n25-146-093 kernel: [ 260.907152] FS: 00007f847ce72700(0000) GS:ffff94e53f580000(0000) knlGS:0000000000000000 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907152] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907153] CR2: 0000000002446a28 CR3: 0000002d5ec3e006 CR4: 00000000007606e0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907154] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907154] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907155] PKRU: 55555554 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907155] Call Trace: Jan 19 14:05:32 n25-146-093 kernel: [ 260.907157] Jan 19 14:05:32 n25-146-093 kernel: [ 260.907159] mptcp_mpcb_put+0x12/0x50 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907162] mptcp_sock_destruct+0x71/0xe0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907164] sk_destruct+0x21/0x1c0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907167] skb_release_head_state+0x68/0xc0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907168] skb_release_all+0xe/0x30 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907170] napi_consume_skb+0x4b/0x100 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907187] mlx5e_poll_tx_cq+0x1e3/0x520 [mlx5_core] Jan 19 14:05:32 n25-146-093 kernel: [ 260.907198] mlx5e_napi_poll+0x69/0xca0 [mlx5_core] Jan 19 14:05:32 n25-146-093 kernel: [ 260.907201] ? kmem_cache_free_bulk+0x282/0x2f0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907202] ? kmem_cache_free_bulk+0x282/0x2f0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907203] net_rx_action+0x292/0x400 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907206] __do_softirq+0x108/0x2b8 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907208] do_softirq_own_stack+0x2a/0x40 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907209] Jan 19 14:05:32 n25-146-093 kernel: [ 260.907210] do_softirq.part.21+0x56/0x60 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907211] local_bh_enable_ip+0x60/0x70 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907213] ip_finish_output2+0x1a7/0x430 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907216] ? ip_output+0x71/0xf0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907217] ip_output+0x71/0xf0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907219] ? ip_fragment.constprop.49+0x80/0x80 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907220] ip_queue_xmit+0x158/0x3d0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907222] tcp_transmit_skb+0x4b6/0x9d0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907225] tcp_write_xmit+0x24b/0xe30 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907227] __tcp_push_pending_frames+0x32/0xd0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907228] tcp_sendmsg_locked+0x3ab/0xe50 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907229] tcp_sendmsg+0x27/0x40 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907232] sock_sendmsg+0x30/0x40 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907234] sock_write_iter+0x87/0x100 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907235] do_iter_readv_writev+0x131/0x1b0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907237] do_iter_write+0x80/0x180 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907238] vfs_writev+0x98/0x110 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907241] ? __audit_syscall_entry+0x103/0x130 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907242] ? do_writev+0x66/0x110 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907243] do_writev+0x66/0x110 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907247] do_syscall_64+0x4f/0xf0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907248] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907250] RIP: 0033:0x7f847b85b2a7 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907251] Code: 48 83 c8 ff eb d5 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 05 3e 95 2c 00 85 c0 75 27 48 63 d2 48 63 ff b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 3b 2c 00 f7 d8 64 89 02 48 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907252] RSP: 002b:00007ffcae8efad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907253] RAX: ffffffffffffffda RBX: 00007f846cd21620 RCX: 00007f847b85b2a7 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907253] RDX: 0000000000000001 RSI: 00007ffcae8efb30 RDI: 0000000000000301 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907254] RBP: 00007f846cd21620 R08: 0000000000000038 R09: 000000007fffefff Jan 19 14:05:32 n25-146-093 kernel: [ 260.907255] R10: 00000000024b4ac8 R11: 0000000000000246 R12: 00007ffcae8eff30 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907255] R13: 000000007fffefff R14: 0000000000000038 R15: 00000000024b4ba0 Jan 19 14:05:32 n25-146-093 kernel: [ 260.907256] ---[ end trace ff4137374c46d07e ]---

multipath-tcp / mptcp

MPTCP v0.95 kernel crash #376