From nobody Thu Apr 2 05:48:25 2026 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E40DD3806D7 for ; Mon, 30 Mar 2026 05:33:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848797; cv=none; b=IOJhMjd0xlKclZ9ZrbvBjw7TyXG8ZpT2prEQIzLw150LPKD2JPkZg/tNVg0Om4XsogjUCQzlb0nWWnx8lysDLsyMhIkdPPMVGLqVFrJm4EDSyN+KPzafhPFuw/KHZa09MRRhOYIntna1WK9oMKsACTjthOsaSRwWUCf0mfTIqFA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848797; c=relaxed/simple; bh=D1p9ABFY2Bp3ekTQhrnix3Fk7TtmLhY0xoeYxkF47hA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Nm5BpXjvk9MAC57NRVX8iKHddh7k2OkVSEOY8+U0lZSPn8KOEcg+jrimPa4DJ9HjeBbzZ32aSw+JcZFV70+1NnAOcpwVaqyGIxJfi351sKa+RnQRYUNIlSI/NV7x0/gREqIo47orHlIjQ0LdJ/qdYub3bIkSI47MO4jKO+J5Lak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=JfIVYMyR; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="JfIVYMyR" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774848794; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fvwM2WkWq/UqnTMdox9Y/0Mccu/T1hYlK86I4gLhZXo=; b=JfIVYMyRYcd+HgVcHlc5KHAMcePxaHXOvtW0eMFU2Qqvmt2Bfdrr6xte7CbVS9VRi8EChl 0nwoDJWcP1Nj7WIEKYEZi760rIuOQMuCV72Qi3gvFGQWwpy/6t2rVAuHp5WiPpXYbEf6P+ pyQgERTMONL7qNRiQXM/zVoPt5fF/0E= From: Gang Yan To: mptcp@lists.linux.dev Cc: pabeni@redhat.com, Gang Yan , Geliang Tang Subject: [PATCH mptcp-net v4 1/5] mptcp: replace backlog_list with backlog_queue Date: Mon, 30 Mar 2026 13:32:56 +0800 Message-ID: <20260330053300.15717-2-gang.yan@linux.dev> In-Reply-To: <20260330053300.15717-1-gang.yan@linux.dev> References: <20260330053300.15717-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Gang Yan This patch replaces the original list-based backlog_list with a red-black tree (RB-tree) based backlog_queue for MPTCP. Add key helper functions: - mptcp_queue_backlog: Insert skb into backlog_queue in order of map_seq via RB-tree - mptcp_backlog_queue_to_list: Convert RB-tree based backlog_queue to list_head - mptcp_backlog_list_to_queue: Convert list_head back to RB-tree based backlog_queue Adapt existing backlog operation logic: - Update mptcp_can_spool_backlog to splice RB-tree backlog to list via new helper - Adjust mptcp_backlog_spooled to restore list skbs back to RB-tree backlog_queue - Modify mptcp_close_ssk and mptcp_recv_skb to check RB-tree emptiness instead of list - Update mptcp_backlog_purge to use RB-tree to list conversion for backlog cleanup Furthermore, this patch also initialize the msk->backlog_unaccounted in '__mptcp_init_sock'. Suggested-by: Paolo Abeni Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan --- net/mptcp/protocol.c | 72 +++++++++++++++++++++++++++++++++++++------- net/mptcp/protocol.h | 2 +- 2 files changed, 62 insertions(+), 12 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 46fedfa05a54..03eaa92badd5 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -653,6 +653,33 @@ static void mptcp_dss_corruption(struct mptcp_sock *ms= k, struct sock *ssk) } } =20 +static int mptcp_queue_backlog(struct mptcp_sock *msk, struct sk_buff *skb) +{ + u64 seq =3D MPTCP_SKB_CB(skb)->map_seq; + struct rb_node **p, *parent =3D NULL; + + p =3D &msk->backlog_queue.rb_node; + if (RB_EMPTY_ROOT(&msk->backlog_queue)) + goto insert; + + while (*p) { + struct sk_buff *s; + + parent =3D *p; + s =3D rb_to_skb(parent); + + if (before64(seq, MPTCP_SKB_CB(s)->map_seq)) + p =3D &parent->rb_left; + else + p =3D &parent->rb_right; + } + +insert: + rb_link_node(&skb->rbnode, parent, p); + rb_insert_color(&skb->rbnode, &msk->backlog_queue); + return 0; +} + static void __mptcp_add_backlog(struct sock *sk, struct mptcp_subflow_context *subflow, struct sk_buff *skb) @@ -669,8 +696,8 @@ static void __mptcp_add_backlog(struct sock *sk, } =20 /* Try to coalesce with the last skb in our backlog */ - if (!list_empty(&msk->backlog_list)) - tail =3D list_last_entry(&msk->backlog_list, struct sk_buff, list); + if (!RB_EMPTY_ROOT(&msk->backlog_queue)) + tail =3D skb_rb_last(&msk->backlog_queue); =20 if (tail && MPTCP_SKB_CB(skb)->map_seq =3D=3D MPTCP_SKB_CB(tail)->end_seq= && ssk =3D=3D tail->sk && @@ -681,7 +708,7 @@ static void __mptcp_add_backlog(struct sock *sk, goto account; } =20 - list_add_tail(&skb->list, &msk->backlog_list); + mptcp_queue_backlog(msk, skb); mptcp_subflow_lend_fwdmem(subflow, skb); delta =3D skb->truesize; =20 @@ -2199,6 +2226,29 @@ static bool __mptcp_move_skbs(struct sock *sk, struc= t list_head *skbs, u32 *delt return moved; } =20 +static void mptcp_backlog_queue_to_list(struct mptcp_sock *msk, + struct list_head *list) +{ + struct sk_buff *skb; + + while ((skb =3D skb_rb_first(&msk->backlog_queue)) !=3D NULL) { + rb_erase(&skb->rbnode, &msk->backlog_queue); + RB_CLEAR_NODE(&skb->rbnode); + list_add_tail(&skb->list, list); + } +} + +static void mptcp_backlog_list_to_queue(struct mptcp_sock *msk, + struct list_head *list) +{ + struct sk_buff *skb, *tmp; + + list_for_each_entry_safe(skb, tmp, list, list) { + list_del(&skb->list); + mptcp_queue_backlog(msk, skb); + } +} + static bool mptcp_can_spool_backlog(struct sock *sk, struct list_head *skb= s) { struct mptcp_sock *msk =3D mptcp_sk(sk); @@ -2210,12 +2260,12 @@ static bool mptcp_can_spool_backlog(struct sock *sk= , struct list_head *skbs) mem_cgroup_from_sk(sk)); =20 /* Don't spool the backlog if the rcvbuf is full. */ - if (list_empty(&msk->backlog_list) || + if (RB_EMPTY_ROOT(&msk->backlog_queue) || sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) return false; =20 INIT_LIST_HEAD(skbs); - list_splice_init(&msk->backlog_list, skbs); + mptcp_backlog_queue_to_list(msk, skbs); return true; } =20 @@ -2225,7 +2275,7 @@ static void mptcp_backlog_spooled(struct sock *sk, u3= 2 moved, struct mptcp_sock *msk =3D mptcp_sk(sk); =20 WRITE_ONCE(msk->backlog_len, msk->backlog_len - moved); - list_splice(skbs, &msk->backlog_list); + mptcp_backlog_list_to_queue(msk, skbs); } =20 static bool mptcp_move_skbs(struct sock *sk) @@ -2311,7 +2361,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, =20 copied +=3D bytes_read; =20 - if (!list_empty(&msk->backlog_list) && mptcp_move_skbs(sk)) + if (!RB_EMPTY_ROOT(&msk->backlog_queue) && mptcp_move_skbs(sk)) continue; =20 /* only the MPTCP socket status is relevant here. The exit @@ -2640,7 +2690,7 @@ void mptcp_close_ssk(struct sock *sk, struct sock *ss= k, /* Remove any reference from the backlog to this ssk; backlog skbs consume * space in the msk receive queue, no need to touch sk->sk_rmem_alloc */ - list_for_each_entry(skb, &msk->backlog_list, list) { + skb_rbtree_walk(skb, &msk->backlog_queue) { if (skb->sk !=3D ssk) continue; =20 @@ -2896,7 +2946,7 @@ static void mptcp_backlog_purge(struct sock *sk) LIST_HEAD(backlog); =20 mptcp_data_lock(sk); - list_splice_init(&msk->backlog_list, &backlog); + mptcp_backlog_queue_to_list(msk, &backlog); msk->backlog_len =3D 0; mptcp_data_unlock(sk); =20 @@ -2999,7 +3049,7 @@ static void __mptcp_init_sock(struct sock *sk) INIT_LIST_HEAD(&msk->conn_list); INIT_LIST_HEAD(&msk->join_list); INIT_LIST_HEAD(&msk->rtx_queue); - INIT_LIST_HEAD(&msk->backlog_list); + msk->backlog_queue =3D RB_ROOT; INIT_WORK(&msk->work, mptcp_worker); msk->out_of_order_queue =3D RB_ROOT; msk->first_pending =3D NULL; @@ -4335,7 +4385,7 @@ static struct sk_buff *mptcp_recv_skb(struct sock *sk= , u32 *off) struct sk_buff *skb; u32 offset; =20 - if (!list_empty(&msk->backlog_list)) + if (!RB_EMPTY_ROOT(&msk->backlog_queue)) mptcp_move_skbs(sk); =20 while ((skb =3D skb_peek(&sk->sk_receive_queue)) !=3D NULL) { diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index f5d4d7d030f2..f0eaba2c61fa 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -372,7 +372,7 @@ struct mptcp_sock { * allow_join */ =20 - struct list_head backlog_list; /* protected by the data lock */ + struct rb_root backlog_queue; /* protected by the data lock */ u32 backlog_len; u32 backlog_unaccounted; }; --=20 2.43.0 From nobody Thu Apr 2 05:48:25 2026 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2925C37F8A2 for ; Mon, 30 Mar 2026 05:33:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848800; cv=none; b=EDh7rPbyzMNu9+Zqba+cNzUXMrhc8RYQKnQ5KQwH2nIKvxoZePNPW9Ce+5N+X9x3P95WsaGwYxIG6gMJAauGL2Nn6yqWLzvvcufluHaxB2yKhNdIo+Sl/L1UvBTlz/W9SIhv/Zjdpokgr5UrS5LHkiZAJOCnz43mwRkh6aE2qoQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848800; c=relaxed/simple; bh=ys1LYOCxjkmlSm/3bTmNwB+Od2iFUJqldBEHdfCjAvA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UycSwdFfIcG2oIi4hcPhbiyIsXLWEAOZWkWybjDxtUG4dJBXk0nFiXATe3yv2vyKrap5V39pys0fe3+oQy8hJTzb89k9ajwylpPhFQEy5QDCjEF/tauGTaQdzFuyR76WuPnovB/f4BeOESqFWiZIj4sTCR3O95v4tA4gQUCmC6E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=CNISR1mK; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="CNISR1mK" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774848797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=boc++GcyEtCsXLwFDSOaXQkpg4hTrQfawgcm43IUzP4=; b=CNISR1mKkdqZpzbgNYGmieVr10FJ+jWg4Rykc9UriXS3mNpH7S+2QCY/7wCRKAYgx1rRMM 8TBrLN20kOXojG8oE4+rxbW1IeoLDz5fErFiFggOQLa64R/d4kXm82Wftx9K4Tc19HlcHY zxmpMAkJu0DkScaWFYISX0xYJx4r9Hs= From: Gang Yan To: mptcp@lists.linux.dev Cc: pabeni@redhat.com, Gang Yan , Geliang Tang Subject: [PATCH mptcp-net v4 2/5] mptcp: fix the stall problems using backlog_queue Date: Mon, 30 Mar 2026 13:32:57 +0800 Message-ID: <20260330053300.15717-3-gang.yan@linux.dev> In-Reply-To: <20260330053300.15717-1-gang.yan@linux.dev> References: <20260330053300.15717-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Gang Yan The original condition would stop moving skbs or spooling backlog even when the receive queue is empty, leading to receive stall. Modify the condition in __mptcp_move_skbs() and mptcp_can_spool_backlog() to only treat rcvbuf as full when: sk_rmem_alloc_get(sk) > sk->sk_rcvbuf && !skb_queue_empty(&sk->sk_receive= _queue) This ensures the backlog can still be moved to the receive queue when the queue is empty, avoiding stall problems. Fixes: 6228efe0cc01 ("mptcp: leverage the backlog for RX packet processing") Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan --- net/mptcp/protocol.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 03eaa92badd5..01d04cbea53d 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2197,6 +2197,12 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock= *msk, int copied) msk->rcvq_space.time =3D mstamp; } =20 +static bool mptcp_can_dequeue_from_backlog(struct sock *sk) +{ + return sk_rmem_alloc_get(sk) <=3D sk->sk_rcvbuf || + skb_queue_empty(&sk->sk_receive_queue); +} + static bool __mptcp_move_skbs(struct sock *sk, struct list_head *skbs, u32= *delta) { struct sk_buff *skb =3D list_first_entry(skbs, struct sk_buff, list); @@ -2206,7 +2212,7 @@ static bool __mptcp_move_skbs(struct sock *sk, struct= list_head *skbs, u32 *delt *delta =3D 0; while (1) { /* If the msk recvbuf is full stop, don't drop */ - if (sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) + if (!mptcp_can_dequeue_from_backlog(sk)) break; =20 prefetch(skb->next); @@ -2261,7 +2267,7 @@ static bool mptcp_can_spool_backlog(struct sock *sk, = struct list_head *skbs) =20 /* Don't spool the backlog if the rcvbuf is full. */ if (RB_EMPTY_ROOT(&msk->backlog_queue) || - sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) + !mptcp_can_dequeue_from_backlog(sk)) return false; =20 INIT_LIST_HEAD(skbs); --=20 2.43.0 From nobody Thu Apr 2 05:48:25 2026 Received: from out-182.mta0.migadu.com (out-182.mta0.migadu.com [91.218.175.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8BD537F8A2 for ; Mon, 30 Mar 2026 05:33:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848803; cv=none; b=pYFtKRTBymBU2KQli4ptl36hRzuvNZ5x6Zu8jHmuGvy6OQM+EQyJ8xDjxJXm5Y29hOLRF0N8p8RUX4CfQ9mP3SKK5wCqwdsTZxXlsEwTTHdmbzxl31YCM2NqaN9jLmvnPfekGP9NkmCP8LMFpaK1HY7bnalAq9bqI6bcSfAS04w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848803; c=relaxed/simple; bh=wWn6VVNcXsmnb/vhmyM5fBbC4kzU8P3iGORRIpzzWuY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=saHiZd/brN0KlR9EYBoVrK8c+/phvi80pgfg3I9i2wOFOK6OGNNMtskt1OmzO2NsByfmjW3gaKiwR3fK0AuqnGBz/KmGe8qHOfi9z+AGTVO7G+7SWInZQpeLjq4Ia9uWGkDDZyi4z3pMEzhBQC38gkZhQTQh1yBy6P+fGSmLvLQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=gmviIzJg; arc=none smtp.client-ip=91.218.175.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="gmviIzJg" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774848800; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GLruUzx9XF0R4JXqMCokiTUQ2Dijphce5nGUyqIUaHA=; b=gmviIzJgRUvhbxUCMy1wuZlcCuo+b8iAN1jR2bA2eXIMSGqwc3yL+2Vplnwg7iPrStysHH CDnHNcQhEuKI4nxPnFHRJyG7O6jvZp4kMHXzIj7oMfV/V4yuH9PbSFIWtVwjkFmjb1NySc y2+ehefi71y0+I9RSCMSzQmW4a40HdE= From: Gang Yan To: mptcp@lists.linux.dev Cc: pabeni@redhat.com, Gang Yan , Geliang Tang Subject: [PATCH mptcp-net v4 3/5] mptcp: fix the stall problems with data_ready Date: Mon, 30 Mar 2026 13:32:58 +0800 Message-ID: <20260330053300.15717-4-gang.yan@linux.dev> In-Reply-To: <20260330053300.15717-1-gang.yan@linux.dev> References: <20260330053300.15717-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Gang Yan There exists a stall caused by unprocessed backlog_queue in 'move_skbs_to_msk'. This patch adds a check for backlog_queue and move skbs to receive queue when no skbs were moved from subflow but backlog_queue is not empty. Fixes: 6228efe0cc01 ("mptcp: leverage the backlog for RX packet processing") Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan --- net/mptcp/protocol.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 01d04cbea53d..16c5dcab8982 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -49,6 +49,11 @@ static struct percpu_counter mptcp_sockets_allocated ___= _cacheline_aligned_in_sm =20 static void __mptcp_destroy_sock(struct sock *sk); static void mptcp_check_send_data_fin(struct sock *sk); +static bool mptcp_can_spool_backlog(struct sock *sk, struct list_head *skb= s); +static void mptcp_backlog_spooled(struct sock *sk, u32 moved, + struct list_head *skbs); +static bool __mptcp_move_skbs(struct sock *sk, struct list_head *skbs, + u32 *delta); =20 DEFINE_PER_CPU(struct mptcp_delegated_action, mptcp_delegated_actions) =3D= { .bh_lock =3D INIT_LOCAL_LOCK(bh_lock), @@ -906,6 +911,19 @@ static bool move_skbs_to_msk(struct mptcp_sock *msk, s= truct sock *ssk) return moved; } =20 +static bool move_skbs_from_backlog(struct sock *sk) +{ + struct list_head skbs; + bool enqueued =3D false; + u32 moved; + + while (mptcp_can_spool_backlog(sk, &skbs)) { + enqueued |=3D __mptcp_move_skbs(sk, &skbs, &moved); + mptcp_backlog_spooled(sk, moved, &skbs); + } + return enqueued; +} + static void mptcp_rcv_rtt_update(struct mptcp_sock *msk, struct mptcp_subflow_context *subflow) { @@ -948,7 +966,9 @@ void mptcp_data_ready(struct sock *sk, struct sock *ssk) mptcp_rcv_rtt_update(msk, subflow); if (!sock_owned_by_user(sk)) { /* Wake-up the reader only for in-sequence data */ - if (move_skbs_to_msk(msk, ssk) && mptcp_epollin_ready(sk)) + if ((move_skbs_to_msk(msk, ssk) || + move_skbs_from_backlog(sk)) && + mptcp_epollin_ready(sk)) sk->sk_data_ready(sk); } else { __mptcp_move_skbs_from_subflow(msk, ssk, false); --=20 2.43.0 From nobody Thu Apr 2 05:48:25 2026 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80DB94A35 for ; Mon, 30 Mar 2026 05:33:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848805; cv=none; b=vEU9GP/lxmPjnX1Rkj0QEg6TRcPsqPcy/j2WAGvMVgKNiFYNawljEbfP4xAeS+xz1EfET/CT4lLtCKq4FUAJmGzepi7EEKgMf2jTip6KC8hcPDh39WhRdT27Y1U0V462Bi+wRV2npBbMXmWzAiZ6MjUSEfyrjYBZd1HoiWtVVK4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848805; c=relaxed/simple; bh=kecz2SUxO9om/eqlzjoUQxhbqIDskQNGgWFJb019gPk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DAPh3pDP1xWb9jjH3l5aN6mE0yBsqxbCELc+13ZTCQ0xD4ErlI+/mUg+Vn0kaL0D1BrekvSeNQsia8CHzd2re2U2KNn67LlFxu4epmDClLEgPES9C4DcVkHCiSAWOhaU1AyWbaIhqfIlqm84IRQX5GyGuGk/kOUzFz38j+5kQAM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=oCWdQYPg; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="oCWdQYPg" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774848802; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=S8Crnlbt7mlNXR4YhfmcOS1RkyeMDKqyZxVD9PcEnHY=; b=oCWdQYPgPYB6yYE36dFU2tX0+igbm/Sykj2iv/Z75aiX3pDhntTaFOPfQkV5YT0vM3LGr8 xQ1MK40eY2ywcx6nierBq3+gUhs2MI/KXVyVIyKFG73kL11bovug02VjdhXkkOIeCfwecg JMFbqUBhLpKcWdNRN97TKRa5bCK97tA= From: Gang Yan To: mptcp@lists.linux.dev Cc: pabeni@redhat.com, Gang Yan , Geliang Tang Subject: [PATCH mptcp-net v4 4/5] mptcp: fix the dead_loack in mptcp_data_ready Date: Mon, 30 Mar 2026 13:32:59 +0800 Message-ID: <20260330053300.15717-5-gang.yan@linux.dev> In-Reply-To: <20260330053300.15717-1-gang.yan@linux.dev> References: <20260330053300.15717-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Gang Yan This patch defers mptcp_check_data_fin from __mptcp_move_skbs to avoid deadlock. When processing backlogged data in softirq context, __mptcp_move_skbs directly calls mptcp_check_data_fin, which can lead to a deadlock if the msk socket is in TCP_FIN_WAIT2 state. In that case, mptcp_check_data_fin calls mptcp_shutdown_subflows, which attempts to lock the subflow socket with lock_sock_fast() - a sleeping function that cannot be called in atomic context (softirq). The correct pattern is already used in move_skbs_to_msk: if a data fin is pending, schedule the work to be processed later in process context rather than handling it directly. Reported-by: Geliang Tang Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan --- net/mptcp/protocol.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 16c5dcab8982..872022f4796b 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2247,8 +2247,12 @@ static bool __mptcp_move_skbs(struct sock *sk, struc= t list_head *skbs, u32 *delt } =20 __mptcp_ofo_queue(msk); - if (moved) - mptcp_check_data_fin((struct sock *)msk); + if (moved) { + if (mptcp_pending_data_fin(sk, NULL)) + mptcp_schedule_work(sk); + else + mptcp_check_data_fin(sk); + } return moved; } =20 --=20 2.43.0 From nobody Thu Apr 2 05:48:25 2026 Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E8524A35 for ; Mon, 30 Mar 2026 05:33:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.185 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848809; cv=none; b=WhAfqS3pU314KPh9kFHUCoj0Rq9d0NbWPNOYOo6LPj/JkAVx+oF8o1Lx2sDaCA39SjQ6iU9u9qPPC8SiG7qAnlJO2DqmaP0P3m0rSe5ykqbAIg34QcniHSuxN77lKqeksr9MlOrCjmH7ITPIW9CvKWDCxlY7cDZnVSVfqNSY6Ms= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774848809; c=relaxed/simple; bh=1toBglHh+DM/POYRzkSe+/VV6/nJ5RL4JB2cyRv3vC0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EVCAkxddIm2wbRIh298Rr3UhVGcspwWXsf7RE2aRxZl5Eonr60lr1mIBd70QFYB3cs3ipRzIPpkgSELeC2RSxSXJiTlVe6xIP9ujpHGf5xpI1fgp78pGHh4ZlpB+xu1jKwGHJsCvhiQbVcp9TQNgaIHawX9+R50XCOFG8MCekAM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=m0HXoewX; arc=none smtp.client-ip=91.218.175.185 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="m0HXoewX" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774848805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=29I4y3aQ/S/p+FtI1ofIbXh6U0HJWVxHb0WRsS/riMw=; b=m0HXoewXR/++sOOftUd74n4MRxdKUFfVdhJKbfUeLHdmHPy0MiHpQFzHo518JOB/cDocNI NvB+Dl9cj1XWmnYzkC94Jm5/ZbYViPbteJuqDrrEYK+HF8pYpJhGwE6fdnIkQgi0OEjBn2 hMLyHFo5ff0TVIZVw0cPvihNJxvJTyA= From: Gang Yan To: mptcp@lists.linux.dev Cc: pabeni@redhat.com, Gang Yan , Geliang Tang Subject: [PATCH mptcp-net v4 5/5] selftests: mptcp: test transmission with small rcvbuf Date: Mon, 30 Mar 2026 13:33:00 +0800 Message-ID: <20260330053300.15717-6-gang.yan@linux.dev> In-Reply-To: <20260330053300.15717-1-gang.yan@linux.dev> References: <20260330053300.15717-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Gang Yan This patch adds a test for transmission with a limited receive buffer. Without the fixes in this set, this test fails with errors: # 001 4 subflows with reduced rcvbuf # net.ipv4.tcp_rmem =3D 4096 4096 4096 # Info: Test file (size 1024 KB) for client # Info: Test file (size 1024 KB) for server # copyfd_io_poll: poll timed out (events: POLLIN 1, POLLOUT 0) # copyfd_io_poll: poll timed out (events: POLLIN 0, POLLOUT 4) # [FAIL] client exit code 2, server 2 # Server ns stats (ns2-qg1Hqo) Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan --- .../testing/selftests/net/mptcp/mptcp_join.sh | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index beec41f6662a..6bf7ebedfbc8 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -4417,6 +4417,25 @@ endpoint_tests() fi } =20 +rcvbuf_tests() +{ + if reset "4 subflows with reduced rcvbuf"; then + local tcp_rmem=3D$(ip netns exec $ns2 sysctl -n net.ipv4.tcp_rmem) + ip netns exec $ns2 sysctl -w net.ipv4.tcp_rmem=3D"4096 4096 4096" + + pm_nl_set_limits $ns1 0 4 + pm_nl_set_limits $ns2 0 4 + pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow + pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow + pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow + speed=3Dfast test_linkfail=3D1024 \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 + + ip netns exec $ns2 sysctl -w net.ipv4.tcp_rmem=3D"$tcp_rmem" + fi +} + # [$1: error message] usage() { @@ -4467,6 +4486,7 @@ all_tests_sorted=3D( F@fail_tests u@userspace_tests I@endpoint_tests + R@rcvbuf_tests ) =20 all_tests_args=3D"" --=20 2.43.0