From nobody Mon Mar 2 06:38:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F3282FD1B5 for ; Thu, 19 Feb 2026 19:01:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771527685; cv=none; b=pOTQxdBckZe71H7a9bdmuM1NkUGlpDnI7vndZAqxAC7vy7htGynHE20kZBsEIFjSu+KMzefJNq17X0SfUD/P7qps32x8RY8Du2XRcEkrhR5DN8e7fIlyaVaREnfBmbloh5CPcKQYmEE5S9+5EsXpyrtN+ZcXFlQrU2BOidW47t0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771527685; c=relaxed/simple; bh=hXkpzOAsI8ahswmWVSOhZgo29h15Cs4ZnmIuuBhdf0E=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=W/Fgd9u+Eq+FWS8xKUFw7MLj0JsamNTC6UMSRD625fUvcWkwqblXTn/0VjS6iYbz6noZENQVZbb47EzjbMM7HnyITVk3BE6wZdBFfSluLPaMXugcRhQyt0VJ7C+6iH9g8HceneJ6oWVwXLpGAaygc9TPBlbu72I0yCPqY57BCuU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Q0PfcPva; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Q0PfcPva" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93895C116D0; Thu, 19 Feb 2026 19:01:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1771527685; bh=hXkpzOAsI8ahswmWVSOhZgo29h15Cs4ZnmIuuBhdf0E=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=Q0PfcPvaU8T48KvGiIrwYu9DXxLW7iGg1cKC9ZCUvUoWmL3oEF7FGrLvuIeiLQvPY SUE+Bdn/6ZPfNgrOZALXCvrZaW+FteiuAME28FD+R7CJjiD3WYeCLMp9PnFPjwUVjU 5hvjd9Z0bol8EXTgEe6yHaM24oCradxaPFIcPOzSB39msjsNaeA8aUNxUFVuAQBVI5 eLWCl3ZM6yW1mQuaS/xNbKKV5KrIFHKWc220Kpk0S2bwUEsLVXv/zuRSWuKe+HoTc9 /fnInaV6ely9+mBLSKfZovWP/mS7I3GGiFlzEDP5xT9dS2wDHwngBJ9mv3XngOOX2Y ejby9O6OZC7lA== From: "Matthieu Baerts (NGI0)" Date: Thu, 19 Feb 2026 20:01:15 +0100 Subject: [PATCH mptcp-net 1/2] mptcp: pm: avoid sending RM_ADDR over same subflow Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260219-mptcp-issue-612-v1-1-839e20d96fe7@kernel.org> References: <20260219-mptcp-issue-612-v1-0-839e20d96fe7@kernel.org> In-Reply-To: <20260219-mptcp-issue-612-v1-0-839e20d96fe7@kernel.org> To: MPTCP Upstream Cc: "Matthieu Baerts (NGI0)" X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=3330; i=matttbe@kernel.org; h=from:subject:message-id; bh=hXkpzOAsI8ahswmWVSOhZgo29h15Cs4ZnmIuuBhdf0E=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDKnxzHdCt7/YMcMqeVftXkkznrK6he1tp6+cFfx0XP71 +0l/e0XO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACZy/BIjw0zn+dLX7k43Z3qU JLTg0bKpfg3NgvK9B0+tE86XzOTaqcfwP+7juskHN0ev2Lm12P6dmE/+Lub0CZJ+r2/oRWa1tGy JYAAA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 RM_ADDR are sent over an active subflow, the first one in the subflows list. There is then a high chance the initial subflow is picked. With the in-kernel PM, when an endpoint is removed, a RM_ADDR is sent, then linked subflows are closed. This is done for each active MPTCP connection. MPTCP endpoints are likely removed because the attached network is no longer available or usable. In this case, it is better to avoid sending this RM_ADDR over the subflow that is going to be removed, but prefer sending it over another active and non stale subflow, if any. This modification avoids situations where the other end is not notified when a subflow is no longer usable: typically when the endpoint linked to the initial subflow is removed, especially on the server side. Fixes: 8dd5efb1f91b ("mptcp: send ack for rm_addr") Reported-by: Frank Lorenz Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/612 Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm.c | 52 +++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 11 deletions(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 8206b0fd2377..ef76fbc40915 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -212,9 +212,24 @@ void mptcp_pm_send_ack(struct mptcp_sock *msk, spin_lock_bh(&msk->pm.lock); } =20 -void mptcp_pm_addr_send_ack(struct mptcp_sock *msk) +static bool subflow_in_rlist(const struct mptcp_subflow_context *subflow, + const struct mptcp_rm_list *rlist) { - struct mptcp_subflow_context *subflow, *alt =3D NULL; + u8 i, id =3D subflow_get_local_id(subflow); + + for (i =3D 0; i < rlist->nr; i++) { + if (rlist->ids[i] =3D=3D id) + return true; + } + + return false; +} + +static void +mptcp_pm_addr_send_ack_avoid_list(struct mptcp_sock *msk, + const struct mptcp_rm_list *rlist) +{ + struct mptcp_subflow_context *subflow, *stale =3D NULL, *same_id =3D NULL; =20 msk_owned_by_me(msk); lockdep_assert_held(&msk->pm.lock); @@ -225,18 +240,33 @@ void mptcp_pm_addr_send_ack(struct mptcp_sock *msk) =20 mptcp_for_each_subflow(msk, subflow) { if (__mptcp_subflow_active(subflow)) { - if (!subflow->stale) { - mptcp_pm_send_ack(msk, subflow, false, false); - return; + if (unlikely(subflow->stale)) { + if (!stale) + stale =3D subflow; + } else if (unlikely(rlist && + subflow_in_rlist(subflow, rlist))) { + if (!same_id) + same_id =3D subflow; + } else { + goto send_ack; } - - if (!alt) - alt =3D subflow; } } =20 - if (alt) - mptcp_pm_send_ack(msk, alt, false, false); + if (same_id) + subflow =3D same_id; + else if (stale) + subflow =3D stale; + else + return; + +send_ack: + mptcp_pm_send_ack(msk, subflow, false, false); +} + +void mptcp_pm_addr_send_ack(struct mptcp_sock *msk) +{ + mptcp_pm_addr_send_ack_avoid_list(msk, NULL); } =20 int mptcp_pm_mp_prio_send_ack(struct mptcp_sock *msk, @@ -470,7 +500,7 @@ int mptcp_pm_remove_addr(struct mptcp_sock *msk, const = struct mptcp_rm_list *rm_ msk->pm.rm_list_tx =3D *rm_list; rm_addr |=3D BIT(MPTCP_RM_ADDR_SIGNAL); WRITE_ONCE(msk->pm.addr_signal, rm_addr); - mptcp_pm_addr_send_ack(msk); + mptcp_pm_addr_send_ack_avoid_list(msk, rm_list); return 0; } =20 --=20 2.51.0 From nobody Mon Mar 2 06:38:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52FC62D7384 for ; Thu, 19 Feb 2026 19:01:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771527686; cv=none; b=C4zkDxvOERVpf8KqenBN0gJxfqCrIN6b8M/dM6SHsXkm90sqKRwNn5yLHlKd2ASmsPVchhx91O7lG+vVuHrIkUsew4H2PN4iNOB98hJy2DqgzSXZDmpOnmO8Fye1FCpw7rQVJE1b3pbs9cq4CdiL7xabJm19n+vHUoVSeOh6ybI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771527686; c=relaxed/simple; bh=FDOE6Hzy0xI0KWSNeDlizYstzi2H3iZs2LW/KL+5SDI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=bgqq0t2QOVtZMglZg4JLQrCOuktBihQCHkkW8FCl70cM2nKyUuwLez9rKo4GS2QI6LPZS4jTyMHeJw8YZBo+5pbKNIwI5Xpul+8nis77aQv+PigZlhQn02OnU85dVfd/sC7GV5/cvIcQOW9Zb794/ZwJd+kwCTTkV7q3BmiVy+o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iw1LFgFz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iw1LFgFz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6941CC19424; Thu, 19 Feb 2026 19:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1771527685; bh=FDOE6Hzy0xI0KWSNeDlizYstzi2H3iZs2LW/KL+5SDI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=iw1LFgFzQ493Q0bVty6B3I1oS5N32dAbT6nMk9pdWgugX72+qPRH900loFbhrXGHt vaima6f/giLp4NeXmcUukT3OaZg/u57wbZsTsxgFzj33a037w5l6MeAWYCfEz6VZDV bHKgGes7t9kSWLPnTX+/kgZx8ngViS9CBit9NWEHAdH190+c2Bz939r4tybPyksaJR qpo3ngtFCoR4QMJFOyCRgSE8aWjNm0mR89uTycZpJnQ/ggelsuUun5YzzMwmYjfTwj 3LtUyBVd+zQRuMVb7GoiLUdgJgO88NbnuNjAorCkwXjwmuB8amFkJOZGHZaBXM45tm KEIDA20Rn+2JQ== From: "Matthieu Baerts (NGI0)" Date: Thu, 19 Feb 2026 20:01:16 +0100 Subject: [PATCH mptcp-net 2/2] mptcp: pm: avoid sending RM_ADDR over same subflow Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260219-mptcp-issue-612-v1-2-839e20d96fe7@kernel.org> References: <20260219-mptcp-issue-612-v1-0-839e20d96fe7@kernel.org> In-Reply-To: <20260219-mptcp-issue-612-v1-0-839e20d96fe7@kernel.org> To: MPTCP Upstream Cc: "Matthieu Baerts (NGI0)" X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=3669; i=matttbe@kernel.org; h=from:subject:message-id; bh=FDOE6Hzy0xI0KWSNeDlizYstzi2H3iZs2LW/KL+5SDI=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDKnxzFLLW6YIbuw/w2zrcmm/Vam12JXarQ1NyhG5YTfn 1LjW2TYUcrCIMbFICumyCLdFpk/83kVb4mXnwXMHFYmkCEMXJwCMJF5Kgz/g1+smC7REmV0ZbFc 3ZrOt8vd/jjtku1b5GDPaaLOEfYnguF/oaKt/dTcDXkfFD5decXYOX3W+kk/LDzUalffWCWl1je NDQA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 RM_ADDR are sent over an active subflow, the first one in the subflows list. There is then a high chance the initial subflow is picked. With the in-kernel PM, when an endpoint is removed, a RM_ADDR is sent, then linked subflows are closed. This is done for each active MPTCP connection. MPTCP endpoints are likely removed because the attached network is no longer available or usable. In this case, it is better to avoid sending this RM_ADDR over the subflow that is going to be removed, but prefer sending it over another active and non stale subflow, if any. This modification avoids situations where the other end is not notified when a subflow is no longer usable: typically when the endpoint linked to the initial subflow is removed, especially on the server side. Fixes: 8dd5efb1f91b ("mptcp: send ack for rm_addr") Reported-by: Frank Lorenz Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/612 Signed-off-by: Matthieu Baerts (NGI0) --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 36 +++++++++++++++++++++= ++++ 1 file changed, 36 insertions(+) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index dc1f200aaa81..058ad5a13d24 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -104,6 +104,24 @@ CBPF_MPTCP_SUBOPTION_ADD_ADDR=3D"14, 6 0 0 65535, 6 0 0 0" =20 +# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR subo= ption +# generated using "nfbpf_compile '(ip[32] & 0xf0) =3D=3D 0xc0 && ip[53] = =3D=3D 0x0c && +# (ip[66] & 0xf0) =3D=3D 0x40'" +CBPF_MPTCP_SUBOPTION_RM_ADDR=3D"13, + 48 0 0 0, + 84 0 0 240, + 21 0 9 64, + 48 0 0 32, + 84 0 0 240, + 21 0 6 192, + 48 0 0 53, + 21 0 4 12, + 48 0 0 66, + 84 0 0 240, + 21 0 1 64, + 6 0 0 65535, + 6 0 0 0" + init_partial() { capout=3D$(mktemp) @@ -4217,6 +4235,14 @@ endpoint_tests() chk_subflow_nr "after no reject" 3 chk_mptcp_info subflows 2 subflows 2 =20 + # To make sure RM_ADDR are sent over a different subflow, but + # allow the rest to quickly and cleanly close the subflow + local ipt=3D1 + ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \ + -p tcp -m tcp --tcp-option 30 \ + -m bpf --bytecode \ + "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ + -j DROP || ipt=3D0 local i for i in $(seq 3); do pm_nl_del_endpoint $ns2 1 10.0.1.2 @@ -4229,6 +4255,7 @@ endpoint_tests() chk_subflow_nr "after re-add id 0 ($i)" 3 chk_mptcp_info subflows 3 subflows 3 done + [ ${ipt} =3D 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1 =20 mptcp_lib_kill_group_wait $tests_pid =20 @@ -4288,11 +4315,20 @@ endpoint_tests() chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 =20 + # To make sure RM_ADDR are sent over a different subflow, but + # allow the rest to quickly and cleanly close the subflow + local ipt=3D1 + ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \ + -p tcp -m tcp --tcp-option 30 \ + -m bpf --bytecode \ + "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ + -j DROP || ipt=3D0 pm_nl_del_endpoint $ns1 42 10.0.1.1 sleep 0.5 chk_subflow_nr "after delete ID 0" 2 chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 + [ ${ipt} =3D 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1 =20 pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal wait_mpj 4 --=20 2.51.0