==================================================================
BUG: KCSAN: data-race in mptcp_subflow_get_send / tcp_rearm_rto

write to 0xffff888102c954d2 of 1 bytes by interrupt on cpu 0:
 inet_csk_clear_xmit_timer include/net/inet_connection_sock.h:200 [inline]
 tcp_rearm_rto+0x8b/0x200 net/ipv4/tcp_input.c:3241
 tcp_set_xmit_timer net/ipv4/tcp_input.c:3262 [inline]
 tcp_ack+0x2717/0x2f70 net/ipv4/tcp_input.c:4022
 tcp_rcv_established+0x46b/0xef0 net/ipv4/tcp_input.c:6214
 tcp_v4_do_rcv+0x662/0x740 net/ipv4/tcp_ipv4.c:1909
 tcp_v4_rcv+0x1b13/0x1ed0 net/ipv4/tcp_ipv4.c:2344
 ip_protocol_deliver_rcu+0x36d/0x720 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x17d/0x210 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_local_deliver+0xec/0x1d0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish+0x193/0x1b0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_rcv+0x64/0x140 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core net/core/dev.c:5660 [inline]
 __netif_receive_skb+0x10a/0x280 net/core/dev.c:5774
 process_backlog+0x22e/0x440 net/core/dev.c:6107
 __napi_poll+0x63/0x3c0 net/core/dev.c:6771
 napi_poll net/core/dev.c:6840 [inline]
 net_rx_action+0x3a1/0x7f0 net/core/dev.c:6962
 handle_softirqs+0xc3/0x280 kernel/softirq.c:554
 do_softirq+0x5e/0x90 kernel/softirq.c:455
 __local_bh_enable_ip+0x6e/0x70 kernel/softirq.c:382
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 unlock_sock_fast include/net/sock.h:1668 [inline]
 mptcp_subflow_cleanup_rbuf net/mptcp/protocol.c:536 [inline]
 mptcp_cleanup_rbuf net/mptcp/protocol.c:567 [inline]
 mptcp_recvmsg+0x851/0x16a0 net/mptcp/protocol.c:2200
 inet_recvmsg+0x171/0x290 net/ipv4/af_inet.c:885
 sock_recvmsg_nosec net/socket.c:1046 [inline]
 sock_recvmsg+0xfe/0x170 net/socket.c:1068
 __sys_recvfrom+0x16b/0x230 net/socket.c:2255
 __do_sys_recvfrom net/socket.c:2273 [inline]
 __se_sys_recvfrom net/socket.c:2269 [inline]
 __x64_sys_recvfrom+0x78/0x90 net/socket.c:2269
 x64_sys_call+0x17e2/0x2e00 arch/x86/include/generated/asm/syscalls_64.h:46
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888102c954d2 of 1 bytes by task 8601 on cpu 1:
 mptcp_timeout_from_subflow net/mptcp/protocol.c:486 [inline]
 mptcp_subflow_get_send+0x182/0x7b0 net/mptcp/protocol.c:1430
 mptcp_sched_default_get_subflow net/mptcp/sched.c:25 [inline]
 mptcp_sched_get_send+0x218/0x2e0 net/mptcp/sched.c:171
 __mptcp_push_pending+0x100/0x4e0 net/mptcp/protocol.c:1581
 mptcp_release_cb+0x3ca/0x6d0 net/mptcp/protocol.c:3449
 release_sock+0x13b/0x150 net/core/sock.c:3561
 sk_stream_wait_memory+0x4d9/0x8a0 net/core/stream.c:145
 mptcp_sendmsg+0xa80/0xe60 net/mptcp/protocol.c:1902
 inet6_sendmsg+0xc5/0xd0 net/ipv6/af_inet6.c:661
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x8b/0x180 net/socket.c:745
 ____sys_sendmsg+0x312/0x410 net/socket.c:2597
 ___sys_sendmsg net/socket.c:2651 [inline]
 __sys_sendmsg+0x1e9/0x280 net/socket.c:2680
 __do_sys_sendmsg net/socket.c:2689 [inline]
 __se_sys_sendmsg net/socket.c:2687 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2687
 x64_sys_call+0x26f8/0x2e00 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x05 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8601 Comm: syz.4.916 Not tainted 6.11.0-rc1-syzkaller-00063-g21b136cc63d2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
==================================================================