From nobody Fri Oct 31 16:20:38 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F19782D8782; Tue, 28 Oct 2025 08:17:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639437; cv=none; b=JYw5vnSyfMwdE0eEu144yV7NFLcFoQFtLd8kBrILRU6Kl8kpiIOvpRgsSEsjci9oodBlCSnE4CJ7faonoDN3Fbd53jDCKHZrMv2CLJHCYdKmFg1H2eCkKeBlmu2ybl4q8OTubAKxsECCBBBYHTuSrWgR011Axa1maTzhPr8S7S8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639437; c=relaxed/simple; bh=6WX9H7zmpRjzBOI6W8cx5XIfmf0YPXzBr0NE/lefUIw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XsM/cmHCUZPH9fxqViPEgNSxQ2C41PiLOPUW5q5iMXzTghLz6UXh/vPcnjGWociUQ5mCXAcPernuDcBvQ33UNNhI0QxK+SdsHp2lN7Cl9AElg255tpG716UgPBKkm+Yd12MiooRadwkKNylX4FtIf7SGiAH1NCa04BmCLJTyJ5U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YQJH0qsQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YQJH0qsQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 345F9C4CEFF; Tue, 28 Oct 2025 08:17:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761639436; bh=6WX9H7zmpRjzBOI6W8cx5XIfmf0YPXzBr0NE/lefUIw=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=YQJH0qsQL5fRwGUltP4F8V72aXhYxQQ9gVvL/M5P4SwJrEw/wjykKQKdoOUy6/hKk r4UPaKQrPlUINvUBYUW1IKeLYtXjQ+gpEEzhVgKwdLpNg185HIgV8J5PT+VM+6wCi6 TPHjXOUztzpuMfqnluc1BX41QfcIkX3vqNkgTNUtRU+oI9GLEj2RS/BoEwN1kBHCD2 4RUI0ODQIV84Mgf3lD+P+rZQdBiED5xJbHi8tffZUcRgLCVDnHsbPJ+XgTXrcdcHC4 1SQeXnYvBevA72Jv0hnq4gfRwvZFeCsn9nAMQPJljFAQwGwM7s0+q2dnuAyJm5nuxF 2n5jIpzo3i7gg== From: "Matthieu Baerts (NGI0)" Date: Tue, 28 Oct 2025 09:16:52 +0100 Subject: [PATCH net 1/4] mptcp: drop bogus optimization in __mptcp_check_push() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org> References: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> In-Reply-To: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal , Yonglong Li Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=3245; i=matttbe@kernel.org; h=from:subject:message-id; bh=7rTrdQHtWaPR0qGO7RKvJQSHNRBIJiHXQUd/rXv6dMg=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDIZahh2+VqeW2oZs+fW2oIDnuEtHxKc7b/oyT6Yt1jQm GXyfu8THaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABM52srIsOZheyzPlLs6v01L ls7Y32gy856JrPSrk1M/HgoNLf/DtJjhf9ak3969+X9i7k8zP2hWmPLucetqHde9Oqd0LBaHftG azQEA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data. That in turn could cause unexpected tx lock and timeout. Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses. Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 11 ++++------- net/mptcp/protocol.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 0292162a14ee..bf2c9e4f3ba9 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -998,7 +998,7 @@ static void __mptcp_clean_una(struct sock *sk) if (WARN_ON_ONCE(!msk->recovery)) break; =20 - WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); + msk->first_pending =3D mptcp_send_next(sk); } =20 dfrag_clear(sk, dfrag); @@ -1543,7 +1543,7 @@ static int __subflow_push_pending(struct sock *sk, st= ruct sock *ssk, =20 mptcp_update_post_push(msk, dfrag, ret); } - WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); + msk->first_pending =3D mptcp_send_next(sk); =20 if (msk->snd_burst <=3D 0 || !sk_stream_memory_free(ssk) || @@ -1903,7 +1903,7 @@ static int mptcp_sendmsg(struct sock *sk, struct msgh= dr *msg, size_t len) get_page(dfrag->page); list_add_tail(&dfrag->list, &msk->rtx_queue); if (!msk->first_pending) - WRITE_ONCE(msk->first_pending, dfrag); + msk->first_pending =3D dfrag; } pr_debug("msk=3D%p dfrag at seq=3D%llu len=3D%u sent=3D%u new=3D%d\n", m= sk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent, @@ -2874,7 +2874,7 @@ static void __mptcp_clear_xmit(struct sock *sk) struct mptcp_sock *msk =3D mptcp_sk(sk); struct mptcp_data_frag *dtmp, *dfrag; =20 - WRITE_ONCE(msk->first_pending, NULL); + msk->first_pending =3D NULL; list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list) dfrag_clear(sk, dfrag); } @@ -3414,9 +3414,6 @@ void __mptcp_data_acked(struct sock *sk) =20 void __mptcp_check_push(struct sock *sk, struct sock *ssk) { - if (!mptcp_send_head(sk)) - return; - if (!sock_owned_by_user(sk)) __mptcp_subflow_push_pending(sk, ssk, false); else diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 52f9cfa4ce95..379a88e14e8d 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -414,7 +414,7 @@ static inline struct mptcp_data_frag *mptcp_send_head(c= onst struct sock *sk) { const struct mptcp_sock *msk =3D mptcp_sk(sk); =20 - return READ_ONCE(msk->first_pending); + return msk->first_pending; } =20 static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk) --=20 2.51.0 From nobody Fri Oct 31 16:20:38 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4B9F2D978C; Tue, 28 Oct 2025 08:17:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639439; cv=none; b=KCYUSMiWBwApMTVBGst/Jj0DZ0w5uLhd5R57WA7DCS1pX6VNrOUly6DzhRBHGcc+X26sE3KuAhXxtAziTdckXGm6USm4yGnZ0vmWH5EoykP2GHdCpagQAV7WkEQdjZRRiE3+DtGmeDXX51/qmDv0FJ6GrxJ4+VstHBfsprnppOM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639439; c=relaxed/simple; bh=nL9dXwI9NSktkJY3wKwnlfnkUqTZJXAP53e/3H1C2qg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=FLgFHgFTFQZi08QxDWD5kYU1xE3i4svOeWgAb0z3K3Rjl+Tbi/YeZ400bFqNCiS7cBGDKHvfy0OwA7S5tGiA5Pli1wtvMGJmQagblPo8L7yxNMyMqb4EZIb0EuQRgqDunws58B/pbUcchs+uABCmfto+AoAkKxRGIg1POR3kaT0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RtrO9Klp; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RtrO9Klp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5DFAC4CEE7; Tue, 28 Oct 2025 08:17:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761639439; bh=nL9dXwI9NSktkJY3wKwnlfnkUqTZJXAP53e/3H1C2qg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=RtrO9KlpThNTCus0C+ihXV98ZlPBA8BA7asqikWWNhm/q4u5UkROR89Xnbsl4Sz29 PJD0iekAyQ2CxtrUFtGBqEF6dIC+5fM3+nNEWKscnlXXH6SplJamtcMAGcClZUlz5n FndRiu9qH4/eV4TGJynG/nIa7qQKjQb7gt3GnBo5nsYNGo+MS0eZPLNiJSPyny9v8T ouYxUEznaFNvMq8rFSuePU6NlV8wFOQjBjJ1hN/avFU+e2vW+8P2sq3ZxaiFKiIiP+ R8JZNKryJkDVnCP5neJFkhV1dzJhtUsHI4LSsXkHPDuERgmmTuruQDBPeJoJMXebRG gi/Lb0iLIVN8g== From: "Matthieu Baerts (NGI0)" Date: Tue, 28 Oct 2025 09:16:53 +0100 Subject: [PATCH net 2/4] mptcp: fix MSG_PEEK stream corruption Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251028-net-mptcp-send-timeout-v1-2-38ffff5a9ec8@kernel.org> References: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> In-Reply-To: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal , Yonglong Li Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=3693; i=matttbe@kernel.org; h=from:subject:message-id; bh=mvPa5cNaO0WufhqYUT0D9AMyoT4bWm+wn7In4tiEqRc=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDIZapiy2A2c24SijrOkbKyVmH38doK1kZ/u9YM2DduVD y6SKJXoKGVhEONikBVTZJFui8yf+byKt8TLzwJmDisTyBAGLk4BmIjhMYb/lXFLy3ZdE/+p7er4 fKH5rDtp+ff0w9Iz/xiF+73ckBC6nuGfypeeJ2vL26fZLbN2UFrnvObChBWzHURfLP4p4S5nqH2 PGwA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the receive queue and recvmsg() need to waits for more data - i.e. it's a blocking one - upon arrival of the next packet the MPTCP protocol will start again copying the oldest data present in the receive queue, corrupting the data stream. Address the issue explicitly tracking the peeked sequence number, restarting from the last peeked byte. Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index bf2c9e4f3ba9..d6d1553fbd61 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1936,22 +1936,36 @@ static int mptcp_sendmsg(struct sock *sk, struct ms= ghdr *msg, size_t len) =20 static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied); =20 -static int __mptcp_recvmsg_mskq(struct sock *sk, - struct msghdr *msg, - size_t len, int flags, +static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg, + size_t len, int flags, int copied_total, struct scm_timestamping_internal *tss, int *cmsg_flags) { struct mptcp_sock *msk =3D mptcp_sk(sk); struct sk_buff *skb, *tmp; + int total_data_len =3D 0; int copied =3D 0; =20 skb_queue_walk_safe(&sk->sk_receive_queue, skb, tmp) { - u32 offset =3D MPTCP_SKB_CB(skb)->offset; + u32 delta, offset =3D MPTCP_SKB_CB(skb)->offset; u32 data_len =3D skb->len - offset; - u32 count =3D min_t(size_t, len - copied, data_len); + u32 count; int err; =20 + if (flags & MSG_PEEK) { + /* skip already peeked skbs */ + if (total_data_len + data_len <=3D copied_total) { + total_data_len +=3D data_len; + continue; + } + + /* skip the already peeked data in the current skb */ + delta =3D copied_total - total_data_len; + offset +=3D delta; + data_len -=3D delta; + } + + count =3D min_t(size_t, len - copied, data_len); if (!(flags & MSG_TRUNC)) { err =3D skb_copy_datagram_msg(skb, offset, msg, count); if (unlikely(err < 0)) { @@ -1968,16 +1982,14 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, =20 copied +=3D count; =20 - if (count < data_len) { - if (!(flags & MSG_PEEK)) { + if (!(flags & MSG_PEEK)) { + msk->bytes_consumed +=3D count; + if (count < data_len) { MPTCP_SKB_CB(skb)->offset +=3D count; MPTCP_SKB_CB(skb)->map_seq +=3D count; - msk->bytes_consumed +=3D count; + break; } - break; - } =20 - if (!(flags & MSG_PEEK)) { /* avoid the indirect call, we know the destructor is sock_rfree */ skb->destructor =3D NULL; skb->sk =3D NULL; @@ -1985,7 +1997,6 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, sk_mem_uncharge(sk, skb->truesize); __skb_unlink(skb, &sk->sk_receive_queue); skb_attempt_defer_free(skb); - msk->bytes_consumed +=3D count; } =20 if (copied >=3D len) @@ -2183,7 +2194,8 @@ static int mptcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, while (copied < len) { int err, bytes_read; =20 - bytes_read =3D __mptcp_recvmsg_mskq(sk, msg, len - copied, flags, &tss, = &cmsg_flags); + bytes_read =3D __mptcp_recvmsg_mskq(sk, msg, len - copied, flags, + copied, &tss, &cmsg_flags); if (unlikely(bytes_read < 0)) { if (!copied) copied =3D bytes_read; --=20 2.51.0 From nobody Fri Oct 31 16:20:38 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E2962DBF76; Tue, 28 Oct 2025 08:17:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639442; cv=none; b=SBl90qWiZXKPatl9qDnJgswgWygJambZUddYNVehSqbdb4aTwx913mIIuBGzsy9Ds5G7SDGpXSeNB1/PLd/TgM2zzKWmAM4Td7ak9ii8n04CVG76M/zD4RzmMrmTuM7qc5RzyYyRA81l5woCAZoIQopUiB/3balfhFW9RIptAjY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639442; c=relaxed/simple; bh=MymROo5KMNC0/BGAYHfaUej+w8REkBWRZ3GOvJZswpo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=SgFKYUr+0HdfhuJ39vlBqPKXJXZh99t1j2AttrFw6WeKyfvh1HFpPpAlDY5a4v9ZAeS99egCOoP++ku6B5zo06vArJN6fyRTDIkpNccD8R8SWXJ01PLLcbUhnXovZUXQaEeK3SkSQ6oYuw+8BCMKWW8217QZpaHeRs9Y2i1rWSY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Dt5J+hvo; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Dt5J+hvo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3B57C4CEFF; Tue, 28 Oct 2025 08:17:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761639442; bh=MymROo5KMNC0/BGAYHfaUej+w8REkBWRZ3GOvJZswpo=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=Dt5J+hvov2+AXiFEWXlzd1XhrXpk0fkoIepJOlWRibB1vGdf/gCB2LySIVzNNKNA9 y6MREpEXOcK+0vtkqEcMpUvZp8eG0QLEO5LUhMHxvZ50kq1BFrHsr7vjnxPIxd6Pmw 43As6k/b7h2zARafAot6LaveRSL7kj07ue3vDkDY7XiUX1+mR7dgM0oTtHxDuRDBWC y19sqB9nFDq4X1yCy46i9A/5J6HYB0wx5jlcD62lo7YDyQ/dFI5jI7zXkSQ4d/4KWS IJc5v5n2sVtV+d3teT8N9z5W1q3yr2ASsNoAD6AG3EbthHCm003GUHs5Us21etGH6s 2dYtf78cbpkzg== From: "Matthieu Baerts (NGI0)" Date: Tue, 28 Oct 2025 09:16:54 +0100 Subject: [PATCH net 3/4] mptcp: restore window probe Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251028-net-mptcp-send-timeout-v1-3-38ffff5a9ec8@kernel.org> References: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> In-Reply-To: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal , Yonglong Li Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1579; i=matttbe@kernel.org; h=from:subject:message-id; bh=q1if2Zh0yPb1hHZTezlXTUXfw6KBLXDo86EIQ69syLg=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDIZaljZVq7JSbLoUYg526M4l2eJWCx348bpWWVMUU6X/ xSrtHl2lLIwiHExyIopski3RebPfF7FW+LlZwEzh5UJZAgDF6cATERQgOG/23QPIZ2vm26Knz/7 1JFfYeoUFvN9nNavHcSczlbvOFWjz/BXSj1+UtQtv+5u28YPJ9Ku8BkeuPn1Qa+N4snznCsP7nr JBQA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb. Refine the relevant check tacking in account that the above condition and that such skb can have zero length. Fixes: 72377ab2d671 ("mptcp: more conservative check for zero probes") Cc: stable@vger.kernel.org Reported-by: Geliang Tang Closes: https://lore.kernel.org/d0a814c364e744ca6b836ccd5b6e9146882e8d42.ca= mel@kernel.org Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index d6d1553fbd61..2feaf7afba49 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1290,7 +1290,12 @@ static int mptcp_sendmsg_frag(struct sock *sk, struc= t sock *ssk, if (copy =3D=3D 0) { u64 snd_una =3D READ_ONCE(msk->snd_una); =20 - if (snd_una !=3D msk->snd_nxt || tcp_write_queue_tail(ssk)) { + /* No need for zero probe if there are any data pending + * either at the msk or ssk level; skb is the current write + * queue tail and can be empty at this point. + */ + if (snd_una !=3D msk->snd_nxt || skb->len || + skb !=3D tcp_send_head(ssk)) { tcp_remove_empty_skb(ssk); return 0; } --=20 2.51.0 From nobody Fri Oct 31 16:20:38 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13BC52DEA68; Tue, 28 Oct 2025 08:17:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639445; cv=none; b=AbTYcjt+ISsXqs+10uRKOah5ple8IKxIvNVeXt8FOWNWwRvJJqggHOWJ/GpjetLL+8GRaJROyssjwJB4pLagBOpMWMaN4xoGzoPqDJ0cT7n0yASDeYB+0ZUYbOixlDwydw/vlbuRk91rNQxUQAyi4sTp1dkblxo2CzapxFKepyk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761639445; c=relaxed/simple; bh=yJ6OnFD0p0J2q2ViCKgWUNewRrcdoQHh3ztvy85qnmE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Ufe8qsRuDyKWspR5JGln+/yNCAXqfue1O6uaqJTv9T8zxSpnWIq9IhCC3hL+5H6j7yV9f7h3XPK8nfll7Cs4wdHgeYmIFVZlv9VXdZWrtFRZsMECBr4raS32k/zuM4WzDvAer09boCkXI7vvll9jooWB+hgaVYPgxVWtMyLIkMQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=vAPu/e7X; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="vAPu/e7X" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60AE9C113D0; Tue, 28 Oct 2025 08:17:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761639444; bh=yJ6OnFD0p0J2q2ViCKgWUNewRrcdoQHh3ztvy85qnmE=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=vAPu/e7XntGcsPEN/KZD9G1NbFP84vH19IgqZ27EjaQPKNcGe489i7ixPMBYO94Y2 JjrE4g7bp42tur/bO+pdMMnAic0Vu/DEFsWXaaB7hpUr7woEqibb3TGpY27Q4E5q4A C4WdEzVKScmZqTmACTS51smBVajGsTlDa3QmtQxqID00GFt5oQTYcyTSIHiNOM9gJn aGv7xy9NdFjo1WYfzMuPGvH7K/48uauiVyhNbHFYh0T/sPm50bY4LhgTr/JISg/2KX 4W3o8ZY8Vt09mTVnOGakxYrHdedxv9mW5B5PxIafk7pOM5Hzn0pGBpkcINF7clu/T7 xQvvHVWOHdwWg== From: "Matthieu Baerts (NGI0)" Date: Tue, 28 Oct 2025 09:16:55 +0100 Subject: [PATCH net 4/4] mptcp: zero window probe mib Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251028-net-mptcp-send-timeout-v1-4-38ffff5a9ec8@kernel.org> References: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> In-Reply-To: <20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal , Yonglong Li Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1908; i=matttbe@kernel.org; h=from:subject:message-id; bh=L2OKjKKGhGjF8C+8RuWZFoc4maf4q5B5EWamzyvqW0M=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDIZathyAp/Ps5/rtmDn0qMNAfae9c+fcjSJfCpaPTmr6 9iD8DfCHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABPZt52RoedoSO4jCV6jWsep y8L//o2w3Xi/VzXgrcNH+7PrOgU+LmFkuCXK47n/yc65Bcf53q23Ky0N3S6toaN80MTsVb6V0TI XfgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Explicitly account for MPTCP-level zero windows probe, to catch hopefully earlier issues alike the one addressed by the previous patch. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/mib.c | 1 + net/mptcp/mib.h | 1 + net/mptcp/protocol.c | 1 + 3 files changed, 3 insertions(+) diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c index 6003e47c770a..171643815076 100644 --- a/net/mptcp/mib.c +++ b/net/mptcp/mib.c @@ -85,6 +85,7 @@ static const struct snmp_mib mptcp_snmp_list[] =3D { SNMP_MIB_ITEM("DssFallback", MPTCP_MIB_DSSFALLBACK), SNMP_MIB_ITEM("SimultConnectFallback", MPTCP_MIB_SIMULTCONNFALLBACK), SNMP_MIB_ITEM("FallbackFailed", MPTCP_MIB_FALLBACKFAILED), + SNMP_MIB_ITEM("WinProbe", MPTCP_MIB_WINPROBE), }; =20 /* mptcp_mib_alloc - allocate percpu mib counters diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h index 309bac6fea32..a1d3e9369fbb 100644 --- a/net/mptcp/mib.h +++ b/net/mptcp/mib.h @@ -88,6 +88,7 @@ enum linux_mptcp_mib_field { MPTCP_MIB_DSSFALLBACK, /* Bad or missing DSS */ MPTCP_MIB_SIMULTCONNFALLBACK, /* Simultaneous connect */ MPTCP_MIB_FALLBACKFAILED, /* Can't fallback due to msk status */ + MPTCP_MIB_WINPROBE, /* MPTCP-level zero window probe */ __MPTCP_MIB_MAX }; =20 diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 2feaf7afba49..49fed273f4dd 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1346,6 +1346,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct= sock *ssk, mpext->dsn64); =20 if (zero_window_probe) { + MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_WINPROBE); mptcp_subflow_ctx(ssk)->rel_write_seq +=3D copy; mpext->frozen =3D 1; if (READ_ONCE(msk->csum_enabled)) --=20 2.51.0