From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50E7425392A; Mon, 1 Jun 2026 03:10:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283436; cv=none; b=lYyVeFzUqz+rpCz2EigZzX+MOXXqtkRWIEIURJqYowhgCkwX+qEew+kWQlotHUm8IODxFAu3hDt3r92qp+ss9kYZpKPjxWUeODdQkN/4s3n4ZhOR1jG1QSfzqyahJcpZY1knKIvQ1NGPrl/DVT+7F7n+yKwqr6ss9i4FcSicxG8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283436; c=relaxed/simple; bh=rkQBiCaZv3FLsMCB1B/qXFTAapBqRO/jjIMFsa8uZvQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=vDrusjgbALcqF5wmQxJP3AGeCfNzxpslceJjDGpyiPZCXqoCkbo+66TJ2BH1WAvl4NskgjQrdQDQhsz4I4yHaNb8jgHb/rVEZTDzOPPI1PTR7T/pMr65Ux5KgDWmWJo1eNmwuYD/Omgw4F2eXUB88gZPOvmv2jKxV/ZOUcde3zI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=j90Ru5of; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="j90Ru5of" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDD781F00898; Mon, 1 Jun 2026 03:10:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283434; bh=8up5MYwx4EhVVjUDefYI07aSVy3uzwumnDLm7oQTWB4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=j90Ru5ofFQR6tfLeXt3M9QYttFUSXJDFzKu4LWxYyZolJuPboyLpZMpjpTrpkPpMx NJDK18w6ZD68e5M1exaRHRdsgPBItBfdLsW1GoXtQo2KZq8LtzDsxj3Y47tKriKf2g sDvWYY3T2LSREytYVeMJRdBWAXZnQfOgDkZmOAlzDYxHP2hcAqDF8Z5pHeMRBp6/GE 4KlkAc0UciW4dewva14nwI5HnkPhGO6lcND2vyIDsBFSCS6guxJ9xlRxrEFC8XamXZ k09DQZbBt7uD08jTi/lIFlTMG0pUMymps/6hbiYvcCWPTHti7LdUI3JwPYqapSMpdL gP2nZX84NRupQ== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:09:57 +1000 Subject: [PATCH net 01/10] mptcp: fix missing wakeups in edge scenarios Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-1-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1069; i=matttbe@kernel.org; h=from:subject:message-id; bh=8bYMyyvhQFOSZqNFT4QxJeSNWbzfPC95/VwNPuygVVk=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeZgFodtIontn8IIYicd3TfOUSdbzXDubYs PfRbYalSpGJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg cy3ND/9DCCfRlf36Ay6eG+KHTojqRx8sQ23aUnz4q7wAxn1KUzCH+hxcq7fmb6TBtfYK4GUc2PH 53B4D8AM5y6gNzLVOFLrfg2nQ0qlmvRhwhLbxKgum+KyqlfmX0dRRbrg/zaSVW43zw/kgipaTVK 3418YYJc4dMgNaiscoQi85kW7Kw9O+O2J4ZHvkwW2uMVTF5Wb7yZ3l2Ji41lcaFD4xyz15gOSPc AFAEmu3BG5tkqbV6YNVhie8EI4KgDGtWnlFodL791qVkZ6KIU9g25/wDyVoIyTmi0QtOZR1fH4Q FkTXy+XtbjVS/hd6b+VNadn8AmooDZEcxi0ncofhk+o9mbCM2H4besACQuixpiwF5p0dOi6q4s4 8XqC/ojf+7DH+EMl+p3/Sc1FYpLl0y8QlNRf5oXRqQ1MIsjIr7QO1CmE2lDgk7l3mQGypLXBGa6 eR2Uf2b1J7ZLTBVIpPsKQtavh/B+qUf8UNLzEgmTFnI2pPUFmGJKdSZxIHPDiAnad2NrbsW270d 4BfCTDsyZTQbnOIYuEioIxZFEd2hZdmUwO5T6sub3l3sE59Ne1J+iQsIBwJXgqIRhLrWHlaCseA JhcVGJbDtdDC2wl4K2eLmpwcT9Sxs3nOvMaV4LrnyYdD94OC1bUOPXFlEOtKjJKmtt6PdXPIOIN KFm0RfAtiET9+SA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The mptcp_recvmsg() can fill MPTCP socket receive queue via mptcp_move_skbs(), but currently does not try to wakeup any listener, because the same process is going to check the receive queue soon. When multiple threads are reading from the same fd, the above can cause stall. Add the missing wakeup. Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index a72a6ad6ee8b..5a20ab2789ae 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2276,6 +2276,10 @@ static bool mptcp_move_skbs(struct sock *sk) mptcp_backlog_spooled(sk, moved, &skbs); } mptcp_data_unlock(sk); + + if (enqueued && mptcp_epollin_ready(sk)) + sk->sk_data_ready(sk); + return enqueued; } =20 --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEF0421257E; Mon, 1 Jun 2026 03:10:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283440; cv=none; b=Wtpn0v31YQtvo/iaBpUofFjksTSdphciPsQcFxiwdt1sFus7bUidapXl7w2aJiAlgrmcG/3180OJKSDQKh4/pfH2yvS6kiPziTELppBdnFHHWalxoPTBAUAp9MyBGBXp1TIzZnCvCBKlXL7w2rJBpbqCTrUDCRekqHUWCOb7tdU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283440; c=relaxed/simple; bh=89uQ3n/0Qw3xj0GP3YUOWBjrjD9h2PL6dSpP8OMpD5k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Y+CH4VaYZDm2UgRlY4/1zHp8ZsOVpiNhuBcrtvXKNe/lB5+0m1fWPSM41h5KNVZ62pQPXQg54DqMl+3h/B1gZLit+aznQx0/YPiDJewZt2YZr1SlbA3wnQEC/0FfNsSvAhM5rcy8YHqDcFXBkauDmr9naFCR9IW2WfvZDvdDpBw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kD7xk7zk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kD7xk7zk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D3251F00893; Mon, 1 Jun 2026 03:10:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283439; bh=aaWaJPX46vtcjlCbR7WSB0JgKZ/Rcr2pe1adTWLv85w=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=kD7xk7zkK4B5B4Wxj3E92b7dALSjrYMBI2va+o5Sa7KOR7Sj2WNXPpTp/KeNLrZqE xSFnhKVyzcPKDNP/hScZ3pLoGkAtYS7xPbFtin3sCTA/6HwtkGXVO0ODhDp2g1NbxU GFgCSX1AJg/daSKvIjNrOevBjG+Z5OnKYf7BtXoHm1A7/RZqcJGBA06CYNTryDhrxm uebi488Kv350Lb54fGr3c6PHERpJTTLb8sAzdAfJLXZhKjLKSputhL4aatkTj0/V71 YTc3Rl4y+dsJUDR5wocyLpRtBqwvBNqnrvNEiTEuraSuXmdKpF386Gv3ZLNwD8KD1S g116o9vwKpdNA== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:09:58 +1000 Subject: [PATCH net 02/10] mptcp: fix retransmission loop when csum is enabled Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-2-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1206; i=matttbe@kernel.org; h=from:subject:message-id; bh=vBnH00lmV7eZlsPI2IZN0MrG2/KQqq2hWo2tFLKydHs=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeq9Ul1F3bQYDyghgYlUe+pEc54i9mnKG8+ TW8ES49UwuJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c2ZsEADSHXik29A48z3GfgJNiN/Yw+LyzUy7hwbNhr8UFSHRLQJWk+1xFMmnYV6Can+IQFc5IZ6 65Wk0mJPe8Juk+GBwuz2ryUhRYK8rEZrFoQbD04OiAES7DeQmTydikgol5JO/WnNzatFug2qHj/ CDHGixxEiE+M0a04skLtZ7Hjr3af+qSHctkE7ppQkznA3/m0u1fMO1mj+jxaikNFn/Qb0V2jnTT hBqWhn4MsCprOB2SdGuTmMGoFpJM3HR952R0hDyKqq27nKWI/feTDvILdY5Mkr/ufO9l63M6eCY yQpu+NRX9eBW6K7nT6OUeEw5FKeundsSFjf39fJu8GIt0QTAeNOJnkj6eAjC07cl0rXfSXeH/jR nTRFnzGE8XyHo41nB0bN7+fnYelT6WLJotITODRm1KLNFu/fRdfePYFhK/CFVcJgUgpCSgfczmp XlEu50layeiC5lBgNDCRYJ3RxXV4xEtpV9dBsJz6oHk07Vyf5XnDkqNNLMKWfYgVBBcO5B7h5ZY tLDBPHwd/aPupdneUjH2W56nszjrFrLX2vnq3/W8vG6w7rVHBx8OUESM66KQXEvLVjE4yvppILR Lkf2mzLVpS/vEQOrcuS0ETXqJMh/ocVZlXSfD3Rq4fIDlJa86OTHpHn8L+X/r1OR0WKXtgnGiGT Awj+9dnKjuRq9cQ== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Sashiko noted that retransmission with csum enabled can actually transmit new data, but currently the relevant code does not update accordingly snd_nxt. The may cause incoming ack drop and an endless retransmission loop. Address the issue incrementing snd_nxt as needed. Fixes: 4e14867d5e91 ("mptcp: tune re-injections for csum enabled mode") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 5a20ab2789ae..7fac5fac2097 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2869,6 +2869,10 @@ static void __mptcp_retrans(struct sock *sk) msk->bytes_retrans +=3D len; dfrag->already_sent =3D max(dfrag->already_sent, len); =20 + /* With csum enabled retransmission can send new data. */ + if (after64(dfrag->already_sent + dfrag->data_seq, msk->snd_nxt)) + WRITE_ONCE(msk->snd_nxt, dfrag->already_sent + dfrag->data_seq); + reset_timer: mptcp_check_and_set_pending(sk); =20 --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E70E624A06A; Mon, 1 Jun 2026 03:10:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283446; cv=none; b=ZmoaX02yMad74Ebd1hdaGIFy/btyBcBIXZKWzrwK7PdireUzMeuRzT7GnEoJmuG5OKhs97HjwKNDMJRqWM6tsXv0wNG8Us+bgfU05JQ2gs5pyj4cQIVG9G1sm5dlNQ0+asSNezB6ZtTc/d8yPBMZugWNNw5pZYfpsR/MpxwCVVg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283446; c=relaxed/simple; bh=LvIp5FpoLlwZVJv3H6wq05IdpHGQhpdtJrZx5LYu8Z4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=a3BuJ2mKC6XO1tCPalhw1vEmszlQcIMr6ieRSPn2rqIN8iMYlTrU43Rzji/AxpXQuZF0hqVgkZI3tgXFpAR7oygZYYA+hsTZiP7VMOG0ogRW8E6Qsy1p1ZvR9DIuOu2iDf4AAKIYDjquJ3sD5E/3rLgJbhjldTNtmsR9239TtXQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kDGwWKAI; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kDGwWKAI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38D491F00898; Mon, 1 Jun 2026 03:10:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283444; bh=fneaZWRJcf1CABw10dTQbdjAJqpoziBhtnq/NZOulcc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=kDGwWKAIEtoWDvxTeIuKj/OkmOUvDLZ2jXwi5nWf515mdrN6WnFWYL6lOqKdfWbH8 ceLMkn8ncb4MqZIowhERRh6+j66ezdqbLACZnk+TkB7lE74T+3HVcwCTbv6+XqU5uk /PlrfOonBkDsdWYYWU+cceCluKVDgRR6KWxGm5BCqLMuJQ0o2D3tZnasI++GPShivB Pvkp3Ne+nJW8LPnAsVB+05SxdvT1YyZSwagWr3Lg1RkAnyKaCR2VCJSxkdnozFmfYv gve3BbIOrJgkXgsF+/DM3DxNf+BRG9AtfIpa7jRh+RpvFtwSyMOVF8UqMCmSVTDD3a 944dY9RkSVQ8A== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:09:59 +1000 Subject: [PATCH net 03/10] mptcp: close TOCTOU race while computing rcv_wnd Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-3-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=3837; i=matttbe@kernel.org; h=from:subject:message-id; bh=jd0W6OwC1TLdwOI/7nVrZyQnci0vCW9EbOM1xsUajvE=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeF0td0braSmVEzSl25B3GB836j21bVXHSr UFKFKsUp2GJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg cx5NEACLgrpMg5U+JrA2ifodSGtSWC40A9mXJmvJsfC98JcAjTIKAouddpHEuHBTNkFv9xjVJp3 ymXeZIshX0/bFmydmIDDS0ciYWYPwf5NC1ogArcnAFp9CNW3wMvivC3wX4fD88YldvOG0YKh26q oKwa2SqwkD9Vhf6xAtCHCLHA79iHhA8Vp0EMAGwUnH7Hiq5x/Ol15neBQvsLbx0h9WYPLdzN0WS 17fgdg1yGs9UimQRdIvTV7SgGE0I8RmEUeNdntXrrXF/5vZXVxaPCpTUw74kgdKxK9zoKunexB2 13L2HiJN+4YpAw/lXzWsG8mAeTbnUF7Iy1BE9+5z9H6g6TVhxnKfFlsyewOmV/tmfxdjJUGYW0r fEqA7MJ98iS7s3u/AbNE8xK3t0P9YTHZAskJNHoWz3V0rZ9zHJT+6422sqI5/kyCsI3OXqUEqzx eAKhSlAZPdRLXF6g+VzSv/isAI7XlNaEPZAOTpbsY9gZ78OGqzT0gud9gRChBottowc5i5CprYd u264oKV+wGUgnCAEUWr/rC1Ro0aubqV5jBhUEMDYTBsTTOkku8+99X4fhGk5BCduHP8QeUgml/L xSkW19ERrkvLNhS4BkgcCLzz7PEjaah/tBLHarin9pU7L/fnw/QhXdTVbef4qLcXoHfQrZiKOKL xGdJEitcBSPn/GA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack. Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 8a1c5698983c..5c228344e83f 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -570,7 +570,6 @@ static bool mptcp_established_options_dss(struct sock *= sk, struct sk_buff *skb, struct mptcp_ext *mpext; unsigned int ack_size; bool ret =3D false; - u64 ack_seq; =20 opts->csum_reqd =3D READ_ONCE(msk->csum_enabled); mpext =3D skb ? mptcp_get_ext(skb) : NULL; @@ -601,14 +600,11 @@ static bool mptcp_established_options_dss(struct sock= *sk, struct sk_buff *skb, return ret; } =20 - ack_seq =3D READ_ONCE(msk->ack_seq); if (READ_ONCE(msk->use_64bit_ack)) { ack_size =3D TCPOLEN_MPTCP_DSS_ACK64; - opts->ext_copy.data_ack =3D ack_seq; opts->ext_copy.ack64 =3D 1; } else { ack_size =3D TCPOLEN_MPTCP_DSS_ACK32; - opts->ext_copy.data_ack32 =3D (uint32_t)ack_seq; opts->ext_copy.ack64 =3D 0; } opts->ext_copy.use_ack =3D 1; @@ -1297,19 +1293,14 @@ bool mptcp_incoming_options(struct sock *sk, struct= sk_buff *skb) return true; } =20 -static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) +static u64 mptcp_set_rwin(struct mptcp_sock *msk, struct tcp_sock *tp, + struct tcphdr *th, u64 ack_seq) { const struct sock *ssk =3D (const struct sock *)tp; - struct mptcp_subflow_context *subflow; - u64 ack_seq, rcv_wnd_old, rcv_wnd_new; - struct mptcp_sock *msk; + u64 rcv_wnd_old, rcv_wnd_new; u32 new_win; u64 win; =20 - subflow =3D mptcp_subflow_ctx(ssk); - msk =3D mptcp_sk(subflow->conn); - - ack_seq =3D READ_ONCE(msk->ack_seq); rcv_wnd_new =3D ack_seq + tp->rcv_wnd; =20 rcv_wnd_old =3D atomic64_read(&msk->rcv_wnd_sent); @@ -1362,7 +1353,7 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struc= t tcphdr *th) =20 update_wspace: WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); - subflow->rcv_wnd_sent =3D rcv_wnd_new; + return rcv_wnd_new; } =20 static void mptcp_track_rwin(struct tcp_sock *tp) @@ -1474,13 +1465,25 @@ void mptcp_write_options(struct tcphdr *th, __be32 = *ptr, struct tcp_sock *tp, *ptr++ =3D mptcp_option(MPTCPOPT_DSS, len, 0, flags); =20 if (mpext->use_ack) { + struct mptcp_sock *msk; + u64 ack_seq; + + /* DSS option is set only by mptcp_established_option, + * the caller is __tcp_transmit_skb() and ssk is always + * not NULL. + */ + subflow =3D mptcp_subflow_ctx(ssk); + msk =3D mptcp_sk(subflow->conn); + ack_seq =3D READ_ONCE(msk->ack_seq); if (mpext->ack64) { - put_unaligned_be64(mpext->data_ack, ptr); + put_unaligned_be64(ack_seq, ptr); ptr +=3D 2; } else { - put_unaligned_be32(mpext->data_ack32, ptr); + put_unaligned_be32(ack_seq, ptr); ptr +=3D 1; } + subflow->rcv_wnd_sent =3D mptcp_set_rwin(msk, tp, th, + ack_seq); } =20 if (mpext->use_map) { @@ -1708,9 +1711,6 @@ void mptcp_write_options(struct tcphdr *th, __be32 *p= tr, struct tcp_sock *tp, i +=3D 4; } } - - if (tp) - mptcp_set_rwin(tp, th); } =20 __be32 mptcp_get_reset_option(const struct sk_buff *skb) --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DBC525A359; Mon, 1 Jun 2026 03:10:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283451; cv=none; b=ZCcoT0EMflBtqYQtxKotY73NAO6t4/Rqt7yH/6wDuHKZGZfHlzFehopqqQEA8srqUYcHhobrqJs2NUrzjtXzceYDuqVBL+CFxPo+2PiD+ZaWCiuXZyrse1k8D7Z60InYhdgOkTwrPwb1pSRjNMFNoQ/V2hg+nO97rB0jQw+9cdU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283451; c=relaxed/simple; bh=WU4mnJJidC8kx5P5EykZbiDwDBze9pofk03KcfcUqAw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qfiLu9zGYazBfe+RkFwbLFKHlkr5hGaJHV89rzbH1bd3Zsn8v/6KO5AtSyUtw3UO6iVR07Z18IjeCrMQX+GwA3I8a9kgYkS8bqDQuwSxHd2gCkYUTfrF5dHI5N7RMWEOOozclqJhpKlaadzK4iqYEUz0uTy1LuTmY7pX0gJDhrY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OLt1Jwj5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OLt1Jwj5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C53A1F00893; Mon, 1 Jun 2026 03:10:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283449; bh=YWzk4iwyj8yswO5of1zVWiveGCHoYg3J0Uz2q9B4axM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OLt1Jwj5sraVsfZ0P/BeVfSRE43cnFgybJBeYHJYVqt4G8mVqbf4DYzRohNY7RqUj 0MHfBwKV+9kcWk00+ygmeAUdlkouVmu6i+ixy5D/HLVzTuI5ht5k3utWBaJZuwR4J1 GDkoXi8AfoSBRNTP7bkGHX/Q/R03HXCc3FMVaP6MvTUqcTGdocbgu45wkjypxPzcN0 nvfeffRLDZd4pzJ5GuxwPusoT+UNTezzkPAoLHmmOd878MAuQhzbhUvuH3nVmT+j4d SVqUfK+GqUSGROd/0notNiVooG4ovu2kW4UDXbbcLOJZq6F5l2d4vILa6oVpDbd2zh GewACIpw6PoQA== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:00 +1000 Subject: [PATCH net 04/10] mptcp: allow subflow rcv wnd to shrink Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-4-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2014; i=matttbe@kernel.org; h=from:subject:message-id; bh=xSUkA5awwabkeoOO2Z+2O7VW9WQAdaet1Zc/wMjFy4k=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPge66MHbxdL/cpv//lR6JnE94nIvP4gCuVCL ceKw8x0iCCJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c/hsEADauF2av4TeDvZXGrYhyOXt3zCLLk4W0JIP/z/obS+TZqUvR2YDZSeC2ESoE6uITeNR2Cr BCkyZ2Tmp6TTVpSD1J+8smGIw4m7dLxouL4/nWPLpAZ0WaYHBclvIrET+4RkKoqDXXq9RbnVBXx xy7KS48+zCD0Xh20m1LT3k27jJG4DNg3ZR7nOj2Fa1mXOxRUXZ5eBDNR7nf3C/9MK26o01kTHgk a2WUZRXVyL77iy2uEXapR4//ykUCxrYIynQH8GCG0qrNkTd0Ntehfsqi1fePcOuYGpW98+dlpw0 d9ffGGuDUXdVqWqdFsn/4ly17k46CQsvksWbdXEFcBS7wWf6Y6WxpPcuwq+uStaaRkZVgtUkjOm SGcSVHURqt1O8BHc91h2vSzep+GZGijvc+TAuhy+7a3UNJLAWmIr1c/geSpAzCMRmXWCxAKQOW2 nooeyFjtRb6kMjpdDb1BgFz+WIcWFW3WzjGgxxVGXor4DbYKS7JAhS+/EHm3hAUZZfoxJEQsDre 7+JTPLBBVjl8HsL2njnZYFjHCQ3oBi+gT6582A1gCZUyPx+Nbs8NrKBKXBnuJdq3MqEEb1w2IBL f6k+Ak5N6D6oOpihApEMX6AUYQX6/aB3ndKBnYcKeASXim9sd9Z4qp1UVP9KH3w1TtMUUpEx7uh kmNmMc6WD89Lplw== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge does not move backward. That in turn causes artificial inflating of the MPTCP rcv window when the incoming data is acked at the TCP level and is OoO in the MPTCP sequence space (or lands in the backlog). As a consequence, the incoming traffic can exceed the receiver rcvbuf size even when the sender is not misbehaving. Prevent such scenario forcibly allowing the TCP subflow to shrink the TCP-level rcv wnd regardless of the current netns setting. Fixes: f3589be0c420 ("mptcp: never shrink offered window") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 5c228344e83f..12cbd98c7111 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -566,6 +566,7 @@ static bool mptcp_established_options_dss(struct sock *= sk, struct sk_buff *skb, { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(sk); struct mptcp_sock *msk =3D mptcp_sk(subflow->conn); + struct tcp_sock *tp =3D tcp_sk(sk); unsigned int dss_size =3D 0; struct mptcp_ext *mpext; unsigned int ack_size; @@ -614,6 +615,12 @@ static bool mptcp_established_options_dss(struct sock = *sk, struct sk_buff *skb, if (dss_size =3D=3D 0) ack_size +=3D TCPOLEN_MPTCP_DSS_BASE; =20 + /* The caller is __tcp_transmit_skb(), and will compute the new rcv + * wnd soon: ensure that the window can shrink. + */ + if (skb) + tp->rcv_wnd =3D tp->rcv_nxt - tp->rcv_wup; + dss_size +=3D ack_size; =20 *size =3D ALIGN(dss_size, 4); --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85CCE21257E; Mon, 1 Jun 2026 03:10:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283456; cv=none; b=DHXevpIgSZpX8hVmMmCDGkmMwArt6fSYMTAmdB5JvYjkLJZil0jTX1u+SIQfjyna6WkBONnYdGY6MxJuq8182odYlOHsjr82b6WH9HUM0RNiDMIs6z7iuFsatnbUzzUfqY+YG8C0D/OAtKL6AJFqvvrxKAE046sXqUMxwseUgHU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283456; c=relaxed/simple; bh=RbIMlTBhX+nwth2ktVhSGSSP8Wft3sWwsEfCV850KPU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=l754/SHm/XibPM9HanpqOvFMNqKEC1QlilHUTPmcn4h3rxCdox7oHGZF0KurkeKWFdVnEdA6I4zfRapYeOaL3LxIWJTePzm4XUnupWGcByNX3a5HXVBWgDV26y7/TVqqBwJ9mo+6p9bJn2sH1kYzQmENuGlC6dYfJSuHH3xiOtw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=joDMrWWY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="joDMrWWY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 513341F00898; Mon, 1 Jun 2026 03:10:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283455; bh=GszvUxBaQDM6cXw6ZUDOFBlW4uvlwqG8sNmpgHjMLvE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=joDMrWWYGKQX8mpyBOrXDgS8L5WkLxwaMK2ABpvygehNsvQy+mv+GdCGx/Sdnh7Df RmIiPbaLGN2bkQb3LwXYgd+5lhToHf0M4hXgo59mwcuIyfEDXtKN0RuDWetfqA0wxb WFjHgdeVnhxtTksx7pXYB7R6gDmW32mME888lfy46e80DMz+G+1CsfCj6zJyWNruO9 e4qyyBZ7K5vPUhR1lZ5jDywiw4zUN7zLeuL5KdmrVSy8QVQn0Ud3LleY/kleGCFOoO 5GWn8BKf2fAQI8NMCy/ei6uebw3KaF7qVx7qIt19v7P/tnZnzTHBQI6SdRuRUS+0op 5kPjSDMGi6b6g== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:01 +1000 Subject: [PATCH net 05/10] mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-5-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Tao Cui , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1923; i=matttbe@kernel.org; h=from:subject:message-id; bh=7ukesoEXWL1n6AAghVFKroS6WjmMIg9iq0MAWyf9XNo=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeUdPWrOC90oSk/b3RuEYzhSI9SXUiGMytg fMmoe6ND7qJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c91bEACmOi21fbl7qM0ww2YK74tekfYZbboBoN7Jhkw1rOfLXCprcV90Mm6jAtxYUaCjhfAnM5W MXA6ZC1/mCteXi451PaU6yHDnWAsDX65GOFpFNL4sa6d1XvckY3Gj/XJiAiOT66uGL5MMoeYg/k +CEFeEPqeXZHgOFpyLNkaFJkvnK+1Wrj+sEVJHysK369Bsg4w4uv8uYln09O/LPpoLuA7or7Ot+ w26BYY4xFrw+JVGJ9T2isYup635jEB3zeIb9MK2EE7731KeYgSF+pd+5zGZzFNnYHj5J9uUfGMv W3VWhPn4kg1nta/hacWS8dnItahDte1eKCydm/G/Nr4A42cpJajj4KGCN5tiuNXfMUFNn7dwxPY 8cFlQxvcNz8MVkWMYaYnRGRs67BhxLXUS7NdjCuHb+WlPRzC7bII1pqgI/1HZFR+/H9ut4T9CSO dfi3Hqhn0+4EJ5TqMS+XWguh0FiYAE22Cu629o48Y+6+WwGlsPB/BI3XpvLH5nLveZfqoCQdOGl qEw7RvdPP/5Uxlg/OWBpAH52DyeQd+6le+uG+o08QUcCPHqVKJF78mJJ5/sK0850ymhO600irMJ gnRZ2JZqSacbr8DiGsrJ/surq5CjRGzPsa9bGJ+7X4lcR0TjTp/6xiVsuyBKO7dBFkTR5NRtL2R ELh2ojgS+tmdrbQ== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Tao Cui The userspace PM increments extra_subflows after __mptcp_subflow_connect() succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to roll back the pre-increment done by the kernel PM's fill_*() helpers. Because the userspace PM hasn't incremented yet at that point, this decrement is spurious and causes extra_subflows to underflow. Fix it by aligning the userspace PM with the kernel PM: increment extra_subflows before calling __mptcp_subflow_connect(), so the existing error path in subflow.c correctly rolls it back on failure. Also simplify the error handling by taking pm.lock only when needed for cleanup. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_userspace.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c index 8cbc1920afb4..0d3a95e676f1 100644 --- a/net/mptcp/pm_userspace.c +++ b/net/mptcp/pm_userspace.c @@ -408,19 +408,21 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *s= kb, struct genl_info *info) local.flags =3D entry.flags; local.ifindex =3D entry.ifindex; =20 + spin_lock_bh(&msk->pm.lock); + msk->pm.extra_subflows++; + spin_unlock_bh(&msk->pm.lock); + lock_sock(sk); err =3D __mptcp_subflow_connect(sk, &local, &addr_r); release_sock(sk); =20 - if (err) + if (err) { GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err); =20 - spin_lock_bh(&msk->pm.lock); - if (err) + spin_lock_bh(&msk->pm.lock); mptcp_userspace_pm_delete_local_addr(msk, &entry); - else - msk->pm.extra_subflows++; - spin_unlock_bh(&msk->pm.lock); + spin_unlock_bh(&msk->pm.lock); + } =20 create_err: sock_put(sk); --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D070264617; Mon, 1 Jun 2026 03:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283463; cv=none; b=ikqSJztZVGbvv8P3hZfTRHLZ4q1yS04T1YQeSSJ0s291A8ZzIogd5CaK+/xukRoGQJiUUZ/FmfT3nArim1ryFhCtv7LEdyZ7A7MyZfMqaGY+Tk0oPOMh0ypYZBseUzU4i+DShPTuLLHkw4FOGJaDpi800zFsGy2fccwoD8sMmiU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283463; c=relaxed/simple; bh=McbAPzejErfT3vRXQ/3hwMvfOEHqfV+gtaE6BzKmcQE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Wi9TZUhF6qKAzKEG3LgvbJt4Zzz7iM5972MmbLQwXmwJNzFKOezeUpnBRfXd6ZA/QjYpdrcnbzIA1Tx0+ikX0iG18Poh4tBFFpZzy365W2+neWZfC607w6likeYgNWp6H5s+0x80nnZRutXpjkShZw43C/qz9vR5Ayf4KtDTYXg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VHPbiZjv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VHPbiZjv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D17731F00893; Mon, 1 Jun 2026 03:10:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283460; bh=4EWYupGYd5fMa1tvYvYfivxtiq5o+ETcaNhau+4S4So=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=VHPbiZjvBi3URIbh+9yy1Ty0f5ERdJok9O/jdthqPra31SzdHCq0cp8NZJt4APYEG czsapRFgQxA1jsmWCVNieeB0gsAicomDdig4xdSLTWvvw/HdhC0sjPbbCQUDyhYoeW oIClSq+OKWX7ribSmXdprd2qqgL8z+bTXxrIz+Bjw+auvRwB2hZAtA6xzE+6TQeCsn Pfj4ze5xMEemqvrvYSKrSHBt9JR+WfUB51WSEKzg+H9cknCASEDGih5jAKVUKvKN5H FEweXYLav1JmJ9xo9n704aL75hOJRF+KlryecwTgDvQXOzfsXZVZb6ZP8Nj+XB/wJ0 4837g2pSZCskg== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:02 +1000 Subject: [PATCH net 06/10] selftests: mptcp: add test for extra_subflows underflow on userspace PM Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-6-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Tao Cui , stable@vger.kernel.org, Shuah Khan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1256; i=matttbe@kernel.org; h=from:subject:message-id; bh=cyJve84NvhmylEe8skv2EBSqKlu2Y3sUtFlAamahTeg=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeVqo4MD4RbWI77LRUvcraY7/mPtF7LoMdC S0S5gOPfq6JAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c/WIEADBsojBBx6aa+lOXi5MVUtjGRHSyaatf20rWs7D+XtxEbZ06HVU8OsoNdq3Jwb/xjooi+d Jr1YBHyRQAOlUbJhe7KQKqfl/eSMXSbYsFoct2WPrZ263rejFVVxOrjufTvDtFWFt6BLC6LoNbc +IQ0En6toato0zDqsf+Za2/ipT2lIpuzbjbNAQDiq79BDSyXVlU4LH/RNJUKDeZyCxst+M0Rw61 lA+C+PSXASc2SahUZu72ercuVm0Lj8sNb3ndKU860Tk4mj563xs7vKYFQazgIlcA+L6DNXjM8pZ iBdHPulFmpA3K/odyrD003b+LSTxsjJve5x44/BObLWTjfbP71HdgqhxY9RoSIz2tznsbQtPbBU bBQK5pA319AulbK7LTKutbIpaKwDYD/nSFBSkUgQIyI172mo58bMBdmxJCILzvlUIP5yg1G1XXa 9bCmt70AEyfwzJZBWL5rL/7ZFQAfepvy7G6x0wU3DjnPYokPOFIOF2XQWw/LYXWN6t0jX/ax3LH +bVlk7khSk1lhsjd/GhJa1a6XBVquj+lBFWKO1hCW+uGsVSeK4JK5Zlo8dA/S+wEfc6OOp7PwmX VFqXMXQQ4Gug5p6CAkzgA0kisj0c0t0He+ZhItL5VA0dIDrnagv8JOh+D3/DeixhwMM9dYUCteU 47T3a2Fr5gHgA5w== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Tao Cui Add a test to verify that when userspace PM fails to create a subflow (e.g. using an unreachable address), the extra_subflows counter is not decremented below zero. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 5acd12021e6e..4b3f71e66609 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -4100,6 +4100,10 @@ userspace_tests() chk_rm_nr 0 1 chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 + # check counters are not affected by errors at creation time + userspace_pm_add_sf $ns2 10.0.12.2 10 2>/dev/null + chk_mptcp_info subflows 0 subflows 0 + chk_subflows_total 1 1 kill_events_pids mptcp_lib_kill_group_wait $tests_pid fi --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED7F225B0AD; Mon, 1 Jun 2026 03:11:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283467; cv=none; b=XYNnwJoDQTHDtQLFdP1qTDRLZUSU6yu5j2wLUOobENQ3IZL8/jDRtsaWQThsh+xALZaPAxnKIACc2ug+Q0ll706QCgyXmXN87VXsg5DJg+xgIEnnUvz510/cj/48LA5FDKFyNmaXJzoki52GmmauTUSSKbB1sMIwv/UaNbOOqUs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283467; c=relaxed/simple; bh=MNwk9kiw5Gw4uouuz+RiKh+UVqshlnpxa58+xHjhdHA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=MMnnANl/wrQuLclRpRLnkaMK4bNM8vdQ5cU4gt6P7GhFJ8QdlsHX/9vr4uAgJVtwUDZgFr4HE+OisJqFcxNRXwk/0h+/TLrgW7T/DNBEVEhgJTtwFqFqEUIzwTfYYe55bPTXLeJhsDkYEBmqL7QYX8Eck0t1Z3xdB+sDUzYENPc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HRmgEx6m; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HRmgEx6m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A3ED1F00898; Mon, 1 Jun 2026 03:11:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283465; bh=SlNpdZug6zmUodf4JIGKJ0htxXImybIlq2fCzCj5nQM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=HRmgEx6mo5HJdMxbCYYGbe3hruJHOCiYzsm0NTtY9Rcwr/8xKnkEo1ovGsFcQBCGE 412jwPmVNPX3yw35vwsjY6zIJ0fAubnX9fzi/ZKn9A5xROtvmPwb77Z4MEnyq2zL8h FhwESQyWpZtleYQMdERSBsZ9uxO016+kjchCWAdL1wRSObsOQRV3f/c1k9kF3oQlQs EgIEv8gb0O4anMvHY7yJJU57+l1CexBS5FJIN0O+k8zdflMCUh6kx2iNa/0JBX8GmC TNCp9Pht5tTbSQcnGGuz6EfIsMhwVtbNfVLCiiN6d/foRvwaxoPuLFP1xhRNTAnUp2 f66HyprNvRU2A== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:03 +1000 Subject: [PATCH net 07/10] mptcp: sockopt: check timestamping ret value Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-7-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Willem de Bruijn X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1470; i=matttbe@kernel.org; h=from:subject:message-id; bh=MNwk9kiw5Gw4uouuz+RiKh+UVqshlnpxa58+xHjhdHA=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeBBlAQ7nJn/sXIa1+ZnFT7h7/ZVOomNl9p vdJK8YZzr2JAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c+k7D/4ufZfUHtXs+WV6sxu/X3R0mz5SXfH/ef+xL2ilno8D0fPPNXCUtNsaKaFbZMPdmQ1ZX67 j5GaLQBMqSxecArzlgA7RT60QpcIBKCkyhU/mv+QS3pOc5tsD+WFt3GASQUDvvBSG5GhLXuILu1 uaVSoknF//WRmIAUauqThF0RHn906ltDUdW5Dkt7OmrLeSbKj8oqqINQDaQZdVgGVchWfTXJ5HC A4xyYCUstX5z0kgtnzrwD6VdTdCTrkpIO28ZU0AEyAbUrPaTm9vdnkAmZ8cM87IezmA9ESd+z+D qqnTFltnZEPAIQCvl47jRuCrdvz3HP2m8324TC23HWqwrV3JhmS8RkiPSSWJuclol6SIRwMHn54 1UX5x+09zKSuAG/20XrShujw+ka6T/otrHA45hJPNlwI77BVrcrvnqSCNtOZkOnmg93FzUhEK95 Arat/R4vQaEWz+lXYKiSF85RoCsdhOZT8Gkdtn0n57ZEwMkhKpbuQ4q4lZFAN+559FbiO25l4LJ OnQzbpmrewSMUp5075R7+uQ5fhYk0SJx3FKOAPDeEAnjEbZeoZA4TpvWZSKkkYexDt35eiaUGTC rXYCHO5NcwZ9iQAJvSCyqdJqaiv9mcun9JBrXKDxfkU9lEG9N9BIRa9VQM4CdbaJCZRBn7JTDsX GeDVsTAAa2WO64g== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 sock_set_timestamping() can fail for different reasons. The returned value should then be checked. If sock_set_timestamping() fails for at least one subflow, the first error is now reported to the userspace, similar to what is done with other socket options. Fixes: 9061f24bf82e ("mptcp: sockopt: propagate timestamp request to subflo= ws") Cc: stable@vger.kernel.org Reported-by: Willem de Bruijn Closes: https://lore.kernel.org/willemdebruijn.kernel.178a41a53d041@gmail.c= om Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/sockopt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c index 87b5796d0135..91aa57f1d0fd 100644 --- a/net/mptcp/sockopt.c +++ b/net/mptcp/sockopt.c @@ -241,15 +241,19 @@ static int mptcp_setsockopt_sol_socket_timestamping(s= truct mptcp_sock *msk, =20 mptcp_for_each_subflow(msk, subflow) { struct sock *ssk =3D mptcp_subflow_tcp_sock(subflow); + int err; =20 lock_sock(ssk); - sock_set_timestamping(ssk, optname, timestamping); + err =3D sock_set_timestamping(ssk, optname, timestamping); release_sock(ssk); + + if (err < 0 && ret =3D=3D 0) + ret =3D err; } =20 release_sock(sk); =20 - return 0; + return ret; } =20 static int mptcp_setsockopt_sol_socket_linger(struct mptcp_sock *msk, sock= ptr_t optval, --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA19E2737E0; Mon, 1 Jun 2026 03:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283471; cv=none; b=L4EgHQQqkeUeVy2i2sYfJ+hlyoY5NpE4N1tcfiZlS91pE5k3S22bsIID7M0i0SIdPTraHxiB5cww9/Fj8C+/bGpCFcU38wyqCvZ46/hb4rPuPaqS3rMXowIILhxQ+NshkllQyUYrgBJX0hkr5nx4Xp1aZbcfmGVtuD76JgzBD4o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283471; c=relaxed/simple; bh=N1bc/nUu/TVx6vrRiyttrdnrCWdRHHAZglldql0RHt0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=FJRGA/X6VwTeYg3l/8TxpXDCobOqtnzyGQ2FlOhKfqUgUrhjLrYv/O7MQAaTtDgWD1coVAoU+hMzkk+Lha6PRPP7uWMnAHU+Ne0WdqXaVMFdph9XH3eu8hfwHcQZti4OEhtdugVgv968i9icyM+0XrQBLfjYCTw4SXKA1C/nD5Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XT8M8KYP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XT8M8KYP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DF511F00893; Mon, 1 Jun 2026 03:11:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283470; bh=B4xB1YlIM90XgSgiiXndV0d7/6vuxA6YWpl23fcgEKU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=XT8M8KYPSA5dZeFZB2GCNBlFtgCX43f+ft0DI9OOMgXKHGqvXb60phmvWofEdCpm9 9pdh7hG/ThYqRVCiNaqa7Fqj0Gs1G25xF54eFqLEQw4WF/Us1zrFxyjmcsuUVNUM5F +L1GJrO++gg9oFqpuKgWGX7MZruoMuvtNd7xz1Zav44ADsQk771IOx+ngU6n4yf6Et 9iDdRZ1m0gp104AMtQy2OAJyvvpJiAokJA1UpzA5P8GlucDVxb5e/b5OxQdvGeWisx fA4Fs+AnV+VGqWF+hsm3rsl7A8Fht90tLRajQ1YcCJ1BPQWFJBOALDxWRk5t32e/hn xU7QBPiZ4BuyA== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:04 +1000 Subject: [PATCH net 08/10] mptcp: sockopt: set sockopt on all subflows Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-8-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1237; i=matttbe@kernel.org; h=from:subject:message-id; bh=N1bc/nUu/TVx6vrRiyttrdnrCWdRHHAZglldql0RHt0=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgeEPpqKTvjGzOf8cNr1mQoA1WSdlrRvGwbp 79pX5ZafSuJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HgAKCRD2t4JPQmmg c6CyD/oD2ZNPsQJKezZeB/3041Z52oUPR1IDEzXcEt8pZHKbaukirkYGSX2X9LtjamkZNDm3RQ2 0CSEsE018YCTzC5KPEnvAXp6MzjXWlnetCSJ+7C6uEACK7po3Dpz88Y2IEfzUh/ufgt82+SMEAO IpaaKcED9PMz9SWNowMqSg6glB5WMhN4akM994ZNgmWaMHPLs654bKs+X5WXpUebl9ZqbKY2tC0 1igKeF7DP6wm96LTizS2SJvK1jTQL+TlPApkQ8kQX/OC8QKGBv17i2yiCDbbbPVbt/Bmp6keCSM eGKeFz/87fvQURWJA/DNYtL6p+gAjgi12sk8Q/diBBLjGM7BIDt1dzAYFVSFVsIyuvMlsKhV3yb N3T2ABV2tA3RyOVk/4frtmq8EzZcpyrZ27tVqlvpD3TXFT7R2vf+NsJ6ZgmoZSWfYsCDbW63M4p gX7P/NR9tL7nTql5w7FI5iA/XUzuV6nVHQ8r7AxxPP4vNIyKunGm/7XZVIACTmRHgq3dq7aMlgt 1EGHy1OUhuZgMm2EZPy6+wOOLQly/YmzQbqLUZ0Lk1kLxkKj/QBWoYd/5+ZD2gFLVgphKG8V4D7 2vvY9WjMnbUZVpa1esgsmaX0jPMozJTeUnV5EFmJui92cV8Kw4tZrTfBttp3tsJ96+9v3XTEr7m w6zT6lKeiYhvKpQ== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 The mptcp_setsockopt_all_sf(), currently used only with TCP_MAXSEG, stopped when one subflow returned an error. Even if it is not wrong, this is different from the other helpers trying to set the option on all subflows, and then returning an error if at least one of them had an issue. Follow this behaviour, for a question of uniformity. Fixes: 51c5fd09e1b4 ("mptcp: add TCP_MAXSEG sockopt support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/sockopt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c index 91aa57f1d0fd..fcf6feb2a9eb 100644 --- a/net/mptcp/sockopt.c +++ b/net/mptcp/sockopt.c @@ -817,10 +817,11 @@ static int mptcp_setsockopt_all_sf(struct mptcp_sock = *msk, int level, =20 mptcp_for_each_subflow(msk, subflow) { struct sock *ssk =3D mptcp_subflow_tcp_sock(subflow); + int err; =20 - ret =3D tcp_setsockopt(ssk, level, optname, optval, optlen); - if (ret) - break; + err =3D tcp_setsockopt(ssk, level, optname, optval, optlen); + if (err < 0 && ret =3D=3D 0) + ret =3D err; } =20 if (!ret) --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 703FB24A06A; Mon, 1 Jun 2026 03:11:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283478; cv=none; b=R7GsGNvdRMo9sgtBofZJg2kQS0vmvCRNPxDpjll2T61dAYFJOqpqOoI6uL9YJlBn7oC1h9HBrINfuxdYuMkQt0Hy9JtR8EaUsZyt7MoAaPSoXPBy9qu6Y2b7o2NOSsNoC+9IpgU1dHtJUEdm0vPMWlk7lhF6OmFBxV0sYOxEW4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283478; c=relaxed/simple; bh=GLfWQd2TsQbqct9PeWcRmweoXhBgKsmkaFdxXHjiZJ4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XOMdelDC7O+Dgq73nbYADPXYzfX5TLrCHYDr3ahOyl6dtB6GgH3zARJtLb4Da/f8WkdkwWSt2bwNmMLd0DMvtXbyEy05rzTly1fDluiC8jPo+0oHCXFzTY98XLl7H6Dm1ea79JXjeY6bmpki2orjy1o/mZ2gETxDH+LHwAXJWMg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=G6ynj0Uh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="G6ynj0Uh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A5EB1F00898; Mon, 1 Jun 2026 03:11:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283477; bh=Ff1yPSPiJtJfD68kpyDRuircorhinc0kjjCW+BQhjP4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=G6ynj0UhTzgdKfDqIdpjebGQo69vfYElzlnMIVBgveFtMDBcwZoIiG8NMgFBziFnP WGbpHOf+XRljtHEO7g/xufQ73WvWqt/rodAUtmB2lqk88Q+z0aHUfm5N4pblmDlvbO KVxeeu6thkQPfAoTUFgong+Bx5GjUOwhILmr/++PYE9UqyNI9i+j4ho8IKDNvNShHy kk5E8D4fkqvP5CPC5C7ZgCFNIRYqfA4biVEZiOkrr9nXkAEKBFSbGFn0mTyzsaccCy ayavaQmC8ZMiYXf4m46jjcG9dCT8kByrLNG4oQtiBXhl7qM4HkM/dCvKVSFy28aSV0 8veYJogawRcsA== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:05 +1000 Subject: [PATCH net 09/10] mptcp: pm: avoid sleeping while holding rcu_read_lock Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-9-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , Hannes Reinecke , linux-rt-devel@lists.linux.dev X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2332; i=matttbe@kernel.org; h=from:subject:message-id; bh=GLfWQd2TsQbqct9PeWcRmweoXhBgKsmkaFdxXHjiZJ4=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgf8MYNWxvDl7gSug1wQ7Kaz3jmOSNsfBYXe ALCqAN7N4mJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HwAKCRD2t4JPQmmg c2/7D/47YihB1wam2Kedc6BDJ8zDyMcet3jUTJr6jlS90sLBM1g23lR/IF83v2EJQ8iYxXP4sbU yjnhxnaIB5SEdYtQXpdw5pjs5iZojPm+N28iSQRXwadEfaalsfaLlfqScS7r/4//sASQ7EEbZoE jE/EpD4KFjDo8+LHLjxyxG+Dhs7UXIa4ksX/jLdCfyvG/tH43agdcdW77acfl/oAsQ7hQCJnc9c HX9tzlp2RkjA51JBA7zwgitLA4MAtrAMJpZ4o4dAFDCr9unF0mvs+utACO7cDF7hMM1EAI0CSe4 UDhGzmMmzvF3eGUbS6iKQJPDBV3LwcEb+Zgf7aj5IN3Zw3njG6PcpMjvADd6V3NSz0I5LwC1RM7 E0GUgwDijq7z+cKumhUuxH8kxgYvg4sjDJ4Yx2upkgxdi/QsVdWyKgCVk14LkLAJrXL7zsmogm3 gO7mUbfGFhmVtfujHnduH4J5urV8ceYuEtJn7+gcT4mjz955e0QolJq9+Sx3zY1F4F0mbfe30xi RfP2LoPyk72PtmIz9Cnzs7tDRyb1+TyrFzC+tKsndTFVDLPfL3OGQs0m9gTVLKFUqB7uYJuoBwO s+mJ486T1a6b3sYHXcTYzAkQOe0cFRNiHlpB1y6em2YVxP5ikClKPHUuaL4nC2gy5TbYTYgDWo3 RWKIWkJphaeUnbA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 sk_stop_timer_sync() calls del_timer_sync(), which spin-waits for the timer callback to complete on non-RT kernels. But on PREEMPT_RT, it can sleep. Sleeping inside an RCU read-side critical section might trigger a lockdep splat. Instead, keep a reference to the timer, under rcu_read_lock, and call sk_stop_timer*() without the RCU lock. While at it, apply the reversed Xmas order when declaring variables. Fixes: 426358d9be7c ("mptcp: fix a race in mptcp_pm_del_add_timer()") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- To: Sebastian Andrzej Siewior To: Clark Williams To: Steven Rostedt To: Hannes Reinecke Cc: linux-rt-devel@lists.linux.dev --- net/mptcp/pm.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 3e770c7407e1..1e0866159972 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -401,9 +401,9 @@ struct mptcp_pm_add_entry * mptcp_pm_del_add_timer(struct mptcp_sock *msk, const struct mptcp_addr_info *addr, bool check_id) { - struct mptcp_pm_add_entry *entry; struct sock *sk =3D (struct sock *)msk; - bool stop_timer =3D false; + struct mptcp_pm_add_entry *entry; + struct timer_list *timer =3D NULL; =20 rcu_read_lock(); =20 @@ -411,7 +411,7 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk, entry =3D mptcp_lookup_anno_list_by_saddr(msk, addr); if (entry && (!check_id || entry->addr.id =3D=3D addr->id)) { entry->retrans_times =3D ADD_ADDR_RETRANS_MAX; - stop_timer =3D true; + timer =3D &entry->add_timer; } if (!check_id && entry) list_del(&entry->list); @@ -420,14 +420,14 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk, /* Note: entry might have been removed by another thread. * We hold rcu_read_lock() to ensure it is not freed under us. */ - if (stop_timer) { - if (check_id) - sk_stop_timer(sk, &entry->add_timer); - else - sk_stop_timer_sync(sk, &entry->add_timer); - } + if (timer && check_id) + sk_stop_timer(sk, timer); =20 rcu_read_unlock(); + + if (timer && !check_id) + sk_stop_timer_sync(sk, timer); + return entry; } =20 --=20 2.53.0 From nobody Mon Jun 8 07:29:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 882CB24A06A; Mon, 1 Jun 2026 03:11:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283483; cv=none; b=P6d53FJfsXzeboE6cDyhUaPZjMzvdZE+9JZobgVd076tRzoc+EXteTqJM+9ozapyVKcIEihRIOoN2SgY/JIxJ6ll9LaZt+zuG9/yeyTszGoTQjTNfeY/piqtB970QrRq3CMTM2xj0Q0+CqWB2W8NOD9nRtNxXrkWLGiMW57+pv4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780283483; c=relaxed/simple; bh=RT/E+puSLaZidPDXPx3TDleWNistOBZUBVAzhbx9FHw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=sH0rwjveHFwpvb0eCq22i2pQHCTMT0uvrXNIx0pZzTzUPlxFRzfM3ZOX3dpvxZ5RmQfi8FRrlvfRy/rjqUUzIh7prUIwfHyxgCIVc245bQ4zBjpB6bNVneTBXDPD/E9EPMWvRJ4OjD68bfdvaxeoVTneKqXHyFjBGGKH+vByxCA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=D7+YuXA8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="D7+YuXA8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BACF21F00893; Mon, 1 Jun 2026 03:11:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780283482; bh=TE32s63FN7oiWP8Km/xUybIoPrIk9f292PR3zY9E4mU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=D7+YuXA8/hANe0DEyFcvVWJ4I1LUJ+VsGacyuy4Gg6aF7u0B2434LWnlieWx6Z0On 4A7xUOVqrTNH8vlYGZbfeKPId1vR98jVaLCaE6I5y9wnZ1PF+MWhAKu47iidaKMWA3 vuJOzdG1vcMFT2iIaq3Yv+DboU5N6GJ7KEqnifPiwBUXkLeV5P+2HjDFmDkymEHf5N VSGSGPMHwnDZvVFrBDTK44r/Sg/nlThYA9PJGJzNpfOM69cxKh47k50t0mIhmDnWqF hg4KDHUP0jzRrclwlEFjghJkYJsiuNOInU9hoJjEAHuGe+5J+Roi7kWvNbXIMkvDE5 17I3FAaMvYiuw== From: "Matthieu Baerts (NGI0)" Date: Mon, 01 Jun 2026 13:10:06 +1000 Subject: [PATCH net 10/10] mptcp: check desc->count in read_sock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-10-a5ae7791754b@kernel.org> References: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> In-Reply-To: <20260601-net-mptcp-misc-fixes-7-1-rc7-v1-0-a5ae7791754b@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Gang Yan , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1199; i=matttbe@kernel.org; h=from:subject:message-id; bh=ouh+8y0QVk20uitc41ZjPExokNTNSrOLDbO4PTnW4No=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHPgfPWYM9vCBC658ItD/tsv5LQUz+/8nLaps8 Z6VvIX3bz6JAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCahz4HwAKCRD2t4JPQmmg c/T2D/9NKT/NKw81WzfQsMRXmA1ESwXdsFG3H/6mCVv4zqskxlBEkJLebZQOGopVl8adzJ3Pk8w +kjBEUh/Q+eLkKapvvr7lC/LeM6Wet34dIhx7HMuyYn2JVDqUWBETfwiB5WiU3uAor1qo6dJf// d5bf71N/LG0m3FvcamVvPJoYZMxxOVaqdWhwAlGICdvw0eLkeUjdOe8kijaFAvTsfnn96T0pFV8 4hTTCvVvVZiSDqE9HiSuPkdWgSoO8Y4OsjE563Jx71q/Qmu2/V6R3ouxS3BQ8oxo4sHfX61PIrG Lrk2NOzXU71R+Qj87RvVwUxUz1U+w5b3qDo2sVK4xgdN42Z9hnMwWnY6n2wvGMycUmlwy51WehF +fgqbeYRSKFm5p+Bel7JV6MphTOk7HbjxwTchpn8sdq7oXb9b3WoAPpEdvW3mrtvbMeaNw/MqtV TbvRDGtaQvFdRCMWG6/v3UTcxA2hqiu98uk62I1LhkFEIr/dnBmKNgZUcUy5VZtdIMTznDwga06 xqPqKr9rtTHY/czXYZLAeAYmhRFK1i5kEWFD0oGONdqnqJb9G3/YsgzBng/i95HA3mG90rUhIXH st9LD6bv7OHIdoNP17U6HIyeyEexsqmGZTja7Si+qoHJPUCCVBAxx6LB7JBY7LyAzFwRzKnQm7J Eu9Vz0tSwFwFAjw== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Gang Yan __tcp_read_sock() checks desc->count after each skb is consumed and breaks the loop when it reaches 0. The MPTCP variant lacks this check. This is a functional bug, other subsystems also rely on this check: TLS strparser sets desc->count to 0 once a full TLS record is assembled and depends on this break to stop reading. Add the same desc->count check to __mptcp_read_sock(), mirroring __tcp_read_sock(). Fixes: 250d9766a984 ("mptcp: implement .read_sock") Cc: stable@vger.kernel.org Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7fac5fac2097..cb9515f505aa 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -4428,6 +4428,8 @@ static int __mptcp_read_sock(struct sock *sk, read_de= scriptor_t *desc, } =20 mptcp_eat_recv_skb(sk, skb); + if (!desc->count) + break; } =20 if (noack) --=20 2.53.0