==================================================================
BUG: KCSAN: data-race in mptcp_subflow_get_send / tcp_rearm_rto

write to 0xffff88810b3454d2 of 1 bytes by interrupt on cpu 1:
 inet_csk_reset_xmit_timer include/net/inet_connection_sock.h:232 [inline]
 tcp_reset_xmit_timer include/net/tcp.h:1427 [inline]
 tcp_rearm_rto+0x1a9/0x200 net/ipv4/tcp_input.c:3262
 tcp_event_new_data_sent+0x161/0x1c0 net/ipv4/tcp_output.c:83
 tcp_write_xmit+0x1296/0x31c0 net/ipv4/tcp_output.c:2836
 __tcp_push_pending_frames+0x6a/0x1a0 net/ipv4/tcp_output.c:3014
 tcp_push_pending_frames include/net/tcp.h:2106 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5711 [inline]
 tcp_rcv_established+0x953/0xef0 net/ipv4/tcp_input.c:6236
 tcp_v4_do_rcv+0x662/0x740 net/ipv4/tcp_ipv4.c:1909
 tcp_v4_rcv+0x1b13/0x1ed0 net/ipv4/tcp_ipv4.c:2344
 ip_protocol_deliver_rcu+0x36d/0x720 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x17d/0x210 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_local_deliver+0xec/0x1d0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish+0x193/0x1b0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_rcv+0x64/0x140 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
 __netif_receive_skb+0x10a/0x280 net/core/dev.c:5775
 process_backlog+0x22e/0x440 net/core/dev.c:6108
 __napi_poll+0x63/0x3c0 net/core/dev.c:6772
 napi_poll net/core/dev.c:6841 [inline]
 net_rx_action+0x3a1/0x7f0 net/core/dev.c:6963
 handle_softirqs+0xc3/0x280 kernel/softirq.c:554
 do_softirq+0x5e/0x90 kernel/softirq.c:455
 __local_bh_enable_ip+0x6e/0x70 kernel/softirq.c:382
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 unlock_sock_fast include/net/sock.h:1668 [inline]
 mptcp_subflow_cleanup_rbuf net/mptcp/protocol.c:538 [inline]
 mptcp_cleanup_rbuf net/mptcp/protocol.c:569 [inline]
 mptcp_recvmsg+0x851/0x16a0 net/mptcp/protocol.c:2202
 inet_recvmsg+0x171/0x290 net/ipv4/af_inet.c:885
 sock_recvmsg_nosec net/socket.c:1046 [inline]
 sock_recvmsg+0xfe/0x170 net/socket.c:1068
 __sys_recvfrom+0x16b/0x230 net/socket.c:2255
 __do_sys_recvfrom net/socket.c:2273 [inline]
 __se_sys_recvfrom net/socket.c:2269 [inline]
 __x64_sys_recvfrom+0x78/0x90 net/socket.c:2269
 x64_sys_call+0x17e2/0x2e00 arch/x86/include/generated/asm/syscalls_64.h:46
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810b3454d2 of 1 bytes by task 10836 on cpu 0:
 mptcp_timeout_from_subflow net/mptcp/protocol.c:488 [inline]
 mptcp_subflow_get_send+0x1ac/0x7f0 net/mptcp/protocol.c:1432
 mptcp_sched_default_get_subflow net/mptcp/sched.c:25 [inline]
 mptcp_sched_get_send+0x218/0x2e0 net/mptcp/sched.c:171
 __mptcp_push_pending+0x100/0x4e0 net/mptcp/protocol.c:1583
 mptcp_release_cb+0x3ca/0x6d0 net/mptcp/protocol.c:3451
 release_sock+0x13b/0x150 net/core/sock.c:3561
 mptcp_sendmsg+0xcee/0xe60 net/mptcp/protocol.c:1913
 inet6_sendmsg+0xc5/0xd0 net/ipv6/af_inet6.c:661
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x8b/0x180 net/socket.c:745
 ____sys_sendmsg+0x312/0x410 net/socket.c:2597
 ___sys_sendmsg net/socket.c:2651 [inline]
 __sys_sendmsg+0x1e9/0x280 net/socket.c:2680
 __do_sys_sendmsg net/socket.c:2689 [inline]
 __se_sys_sendmsg net/socket.c:2687 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2687
 x64_sys_call+0x26f8/0x2e00 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x05

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10836 Comm: syz.0.2361 Not tainted 6.11.0-rc1-syzkaller-00151-g183d46ff422e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
==================================================================