From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AC1330FF2A; Tue, 2 Jun 2026 12:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402489; cv=none; b=VHVrgLPRQDqHGsJsm+JfO0yXbznJx/l+Ss+rzWCdkjB8cEfOJKB/kJQITQNf+bB+NrmBofXHfNNC42ey0S82jG04k+Dzzhk4M+BY2hTQA7MNz2VqpPDtnxbVoAbTmDh5qHB5qhfIJ/4GIqEN7Zhr/dK3KB5BQB4yOSIBy4L/FvM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402489; c=relaxed/simple; bh=rkQBiCaZv3FLsMCB1B/qXFTAapBqRO/jjIMFsa8uZvQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Kfnz3BRzyjEQ4cTutO1XzfhEHaMi60tKYYab3Ei8jUoTga0Z30gBQ7GEQnLbvEixlRi67bRoYxb2lvOf6bbqLX4RPsQ35P44p1euOFXCkz/HUDmHvkLQwOQbUbLcN6yvqYtdjlFWJ0SKD+wNDJ5a8n+VVwkhxC3cHlhExfYD67I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Qr8oouv4; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Qr8oouv4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B74F1F00898; Tue, 2 Jun 2026 12:14:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402487; bh=8up5MYwx4EhVVjUDefYI07aSVy3uzwumnDLm7oQTWB4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Qr8oouv4dNKcKjpjri0nxbW6z1Vo8+ndyJ+hGZuPnT8k6/jo7NPKV7MoJLDUwLRm7 xQEsw8V6QKE3/AwsaHp4Lujb/duvgu2+v9tLkXm1GCYrmZKZ4zmI095C8srw7xeWDm wYIe7LZMKfSeC+nxudjqxkB2o2vZfpZvFYTgSDappsq7LphLf0BhJpfoqTvxefLO0I RM3aqAtBAkwUxlqQCBRPrlnLTQ4dAG8Xao6LKFVXVPO5Oh9t3F5HYDLZVPsy0RO+85 sr4kIErvZkc5zW0Fwsyc8Y38kakOaQNv+Tsoxydf4BXXtAETfTnkSRi+/bqiG0pcoT czf/VhfZfYxug== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:08 +1000 Subject: [PATCH net v2 01/11] mptcp: fix missing wakeups in edge scenarios Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1069; i=matttbe@kernel.org; h=from:subject:message-id; bh=8bYMyyvhQFOSZqNFT4QxJeSNWbzfPC95/VwNPuygVVk=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksQ67lkTH5XRM3T3lMPHAJFgRuZTsmQJlqO DuLz9eZ/96JAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg cxiuEADrrwdslrpmxQDqBrLmqjh/TBxh4T4YLysTxsZBUsbOODlADtJqdH2q1iLScEmt5ENBTAp a4YOR8NzjfELOkVBok3C1BU4G7cZwUbIrFmQ6h+lb7+1bz2vlW52WOmyv/4ZGfYTtAOZKLO4LCb Pm4/Vx8acKZDkYlGOR/hN4j0b3qO0fi5D+Qpl99qzLgolLZLPIqAANB/LB+7H4R3G7k5LMrFx0G 3sjmOfXTenSRwpda3xh8XXF0QKimG2vpwQbqhvIKDQqQP4VqxsXMeqpU+9Gnks5QSQowdAocZnw VvxEOPexEokxP4+rrCWZbcul/6Plu10GOgBsIQgNrOuj71ownyF6rZ7ir+MfJOI5/JE2OO4Fhal kFmD/gybb6Em/N6x7XeOh4IPe1UOF7K+wXm57ZsV1PKf6n9gRV8b4JyXFA2O3ra/dAjPHda04df I5lYv1WV60PgHgXHJNP69aDLkrd04KLDMmCB90ogRrLAHEeEbkVsyc90s/eb0qw9k2ltsaNhHLc DPO5+ZlmsrfD63K/z+gE6Jf++5kqES2ljVhNgMSkf4/WANxu7m77ggFfslOC9kMvu8yPBENT4c2 EtRd85gBdWh7y6852oHIAs/E5hMhXYbsiSpMJdPPw/z8+D1JPjJzkXYSpcNYR8txCMydU3pK8/g dqLQmRt/AZTPfuw== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The mptcp_recvmsg() can fill MPTCP socket receive queue via mptcp_move_skbs(), but currently does not try to wakeup any listener, because the same process is going to check the receive queue soon. When multiple threads are reading from the same fd, the above can cause stall. Add the missing wakeup. Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index a72a6ad6ee8b..5a20ab2789ae 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2276,6 +2276,10 @@ static bool mptcp_move_skbs(struct sock *sk) mptcp_backlog_spooled(sk, moved, &skbs); } mptcp_data_unlock(sk); + + if (enqueued && mptcp_epollin_ready(sk)) + sk->sk_data_ready(sk); + return enqueued; } =20 --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 700C63DB33F; Tue, 2 Jun 2026 12:14:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402493; cv=none; b=HHRXVfhMG7xXciph7WsqlP9O1Baj35zmqAJk7cFo4LCwwuIhUstUyDiBfmvrxbNSjXuR9+qeeQagTnbl03/O3wqioavMBn7UKD/4iFhJYQEPsMZIbvWiW1SD8yRdTdgw8WOUyCb2dV3P5yJiCcWKlfPWGdV4d4dDp4hc2CG4Nog= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402493; c=relaxed/simple; bh=89uQ3n/0Qw3xj0GP3YUOWBjrjD9h2PL6dSpP8OMpD5k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uEzMqs242vMCkBw2zfMArRiuHWiscFuJS/Dw57q0yvFDDp8FeIZuELK1+wdbXHOKkFrS/K67zR1QfsIsJHG5UkSUuSXgTg3MKjACk8N15WmSy9CVI3uugWpeRhwQxSdkgIcYzdxSumYL8eDvV5I9op9YXNyisRyrwh2PRVr/l94= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oJeELQpp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oJeELQpp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05D9B1F00893; Tue, 2 Jun 2026 12:14:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402492; bh=aaWaJPX46vtcjlCbR7WSB0JgKZ/Rcr2pe1adTWLv85w=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=oJeELQppnutOMNTdRqYVqhfrW8sfW1oXbzCE2/13wksfckDVIdoZRlBcI4Uq1YN7W mhbwtjCujEOnFTPLEhwDtVdPuwPCX5Gth1K59nY0Uy9wa2o+ji6+Sp3fyvmxDroF5J pOfGzPYE55kUJLbt/j9FSxc746/1VDDmrsxqgMrRKIUfz8QOkgKaFY3cH+3UEOli8X UUhJd/ejFWBJrNf8OSFqoGOO/QdY++PrHa8vWwwjIUv5QCh+yzHowH3LHUc2hsZhjF h1wsax266yyrwhUcokAG8ewgmsHgyVIlOk5vGabONVmrE0Gs98q0CvlfjZOThoKUpo ibhbS9ZcwT3Wg== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:09 +1000 Subject: [PATCH net v2 02/11] mptcp: fix retransmission loop when csum is enabled Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-2-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1206; i=matttbe@kernel.org; h=from:subject:message-id; bh=vBnH00lmV7eZlsPI2IZN0MrG2/KQqq2hWo2tFLKydHs=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksW1ZYzRxnUnLX88enh/v3Kd94bl7FioKSV WZm4ElBPgeJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c9KAD/4mCT+QjdBm9zxk+dsvJGn5JpJAuIzpXTxOsO0UfgQYvdNcedKMF0/zZLFKUraxv0esOTE fx5yvdhxP87xIbNcbEf6wLvDXVRLJ5uYId28V+wRa5qi9wjZ58zowFdCDew892ky1jYubVRiBrw xN0EUhgLvPDL5a9A8+E3w+QVIzd3dvocz6o4equkvM+0mompUda9S/wKzhqeHraGbMg7p+tVNuH QOWMpXP9RsLlhLAzbHmAqeGUK1tT4fP0uvidWSzqSTmzdmlVy2+8zJSOOTehmKnD2v9qi6L/Mjo tIh/KULGJT3zq+7gWDnp89U5ufVObWQeP5ccjHJzfVBFpZMvs50Af8UIXYuqQFjH3fxSGpkWXe+ wfTs00tsOb8Cv5RzowPGbZYK6mYNoJ1K8htVfnDqZ0LDD2XfCptz6CLjB9gRZI5J8E6Wu3Wqkkg 303eKzTMQCjKP2i9+IXPHrJUfxAr7Gn5xRDamdNK8PiV5dIZs+RMnfWbUjCgusKXp9breSPJ+bx V4unNstRUsII6SOF6xUEteoMI/cJTIS91QymXZeh3Qa2C636O8NrnFO61QykqPGAeHoCfzzGBOi ++Od/liQ3JyEu8gXh9kFRD319XPU0gBiOXj+U520fvp03gvyq8iMrVmW3uI6co1TmVqGMwl/juC KiIxB3LzFBFI7ug== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Sashiko noted that retransmission with csum enabled can actually transmit new data, but currently the relevant code does not update accordingly snd_nxt. The may cause incoming ack drop and an endless retransmission loop. Address the issue incrementing snd_nxt as needed. Fixes: 4e14867d5e91 ("mptcp: tune re-injections for csum enabled mode") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 5a20ab2789ae..7fac5fac2097 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2869,6 +2869,10 @@ static void __mptcp_retrans(struct sock *sk) msk->bytes_retrans +=3D len; dfrag->already_sent =3D max(dfrag->already_sent, len); =20 + /* With csum enabled retransmission can send new data. */ + if (after64(dfrag->already_sent + dfrag->data_seq, msk->snd_nxt)) + WRITE_ONCE(msk->snd_nxt, dfrag->already_sent + dfrag->data_seq); + reset_timer: mptcp_check_and_set_pending(sk); =20 --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3BFF3D75CD; Tue, 2 Jun 2026 12:14:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402497; cv=none; b=VMl9E27wyzR5WyVCCeMUqGuYiYH/VTVe4esK6b5ObrhTnxfctHrVF3cFRN1yeFNT328NBZQQIIc5BGqc8mN7gGFbAVGgH/OENmxKc3K3aXhGWKbVIiBU3QtMC1zHOE/QRSjrakRbM1ujUMeaMTgX54UjYL1YDBNMnn1dABaFN28= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402497; c=relaxed/simple; bh=jBgzogHroSyH3RGwTgEBFf2pIGnpDvwm5wRjXJySUWA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=CWMRTzew8P7L/gSIN8TzJ/n9S6AajQ8/bNWb3naIv6khlQ9UZO1RNi8qg40/Ci0sYQfJd3LpSO3gJho1HtnduPRSEtnBlF5rCPnlfQQWUqv4QtfT+uM1J+PAeyXH0dvVSngu+UxH/RTEUjb3vH+tAWJgOXDr+I7zck0gCbG98GI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bNWLhE14; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bNWLhE14" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCDA61F0089A; Tue, 2 Jun 2026 12:14:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402496; bh=PeIzH2RQMo2+yCD0FPitqljkg8IzJphIovhYUeiSSIA=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=bNWLhE147UyzR/IIjrn1kd+y8zjjWwl2YE+71Kx5Vhi9MV7NLwGK0d7LXcHx1mhcs 69cMRMZKQnLFGvB4mEW7K+PNeLX5uPovCfU+wgCZnv22v9iqwJYgbhg9YRmiOtC/Nm JHo6zxSfZH99wO8Bxbi/MzZwtOFMdhrnvsywp506AotK39XDvg/yEfZ/o6chsvO1TE ZwnbEnxIfJdcMhOOjOn7XWDpIeRUH9rpvAoNxW/UnvkXaE8ffZyoTxx9ujGRsIEJA0 zYXAfj+yscpjS3DH7PSdeVDC/4vN0MN1uNwgQLvVz1U+B0KcAp5KIMCUfBO6n+5ZdF 2j+2lWGL6nw9Q== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:10 +1000 Subject: [PATCH net v2 03/11] mptcp: close TOCTOU race while computing rcv_wnd Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-3-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=3838; i=matttbe@kernel.org; h=from:subject:message-id; bh=2Fsu/GUr9y27OlxB9B+kvW2hHPd+B+X0zyN/HUKfhN4=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsks5sJKGW2eZlMU2xV5T/SPDA/c60LO6Me8o bfVzbFpTtuJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg czHMD/oDGBXCqu0tpdkGP7aleZq5C2SLkw7SwS2vcgjrGs1o6NY7X0lK0PLdggjBeCHyyu2fAzR T/PAVWePFIN5huWbYkmafQ9C2sQCyyMbx9SPxy0bpzmfE6Quwd7CeHbG855LENimXZaTB2wTwed Tna1UuRlH4AeGyTF55CQ4+hoEhHwww44nqNKDrOaD34lf8Aiz4as7D/7dRuLzaiJrhKPI4g9sPo XigetEqZph3c5Dnog1NW/l11U+Par8A/ZLEHjovcc1q5f+OB4L8Ysunl63zNKw2bvks9u/KhG0F 12PsMGGvVJYTbTCER5qKQ8RWIEJjuKZAjBiyKo/1ctMWueZgdi3IJBLROLfyGaz0mAz+HHzL+rn dN7iHgENWmVoZLplsX95gVI5mJHwYNON0t7RGalGwGzi1oBUZdX+23xkMQRhEITE9BM7qRVetPp 1RF0ISuQcXolLfCN6hmmVVpssDGbQa8fc6tptoqRYntyVckIQaRp7Kkai5Ylu8GpQmz0wEDkp6x N5d+T+qwmSq5LRthsf7Tspu3AK9aWQwf5FnqF4Tbliz9Uh/abuw+PJduczDoW/0/ZwxUgeOlfBB trXNtIySlJq3EY00E4YhlT4GU5kqSwAAvAo45Ud3rIcZD3nI9d2mkhmDtfXj0j/4c11eJn0ucTN nrO2QjC2bcp7NZQ== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack. Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 8a1c5698983c..2d25f319f328 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -570,7 +570,6 @@ static bool mptcp_established_options_dss(struct sock *= sk, struct sk_buff *skb, struct mptcp_ext *mpext; unsigned int ack_size; bool ret =3D false; - u64 ack_seq; =20 opts->csum_reqd =3D READ_ONCE(msk->csum_enabled); mpext =3D skb ? mptcp_get_ext(skb) : NULL; @@ -601,14 +600,11 @@ static bool mptcp_established_options_dss(struct sock= *sk, struct sk_buff *skb, return ret; } =20 - ack_seq =3D READ_ONCE(msk->ack_seq); if (READ_ONCE(msk->use_64bit_ack)) { ack_size =3D TCPOLEN_MPTCP_DSS_ACK64; - opts->ext_copy.data_ack =3D ack_seq; opts->ext_copy.ack64 =3D 1; } else { ack_size =3D TCPOLEN_MPTCP_DSS_ACK32; - opts->ext_copy.data_ack32 =3D (uint32_t)ack_seq; opts->ext_copy.ack64 =3D 0; } opts->ext_copy.use_ack =3D 1; @@ -1297,19 +1293,14 @@ bool mptcp_incoming_options(struct sock *sk, struct= sk_buff *skb) return true; } =20 -static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) +static u64 mptcp_set_rwin(struct mptcp_sock *msk, struct tcp_sock *tp, + struct tcphdr *th, u64 ack_seq) { const struct sock *ssk =3D (const struct sock *)tp; - struct mptcp_subflow_context *subflow; - u64 ack_seq, rcv_wnd_old, rcv_wnd_new; - struct mptcp_sock *msk; + u64 rcv_wnd_old, rcv_wnd_new; u32 new_win; u64 win; =20 - subflow =3D mptcp_subflow_ctx(ssk); - msk =3D mptcp_sk(subflow->conn); - - ack_seq =3D READ_ONCE(msk->ack_seq); rcv_wnd_new =3D ack_seq + tp->rcv_wnd; =20 rcv_wnd_old =3D atomic64_read(&msk->rcv_wnd_sent); @@ -1362,7 +1353,7 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struc= t tcphdr *th) =20 update_wspace: WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); - subflow->rcv_wnd_sent =3D rcv_wnd_new; + return rcv_wnd_new; } =20 static void mptcp_track_rwin(struct tcp_sock *tp) @@ -1474,13 +1465,25 @@ void mptcp_write_options(struct tcphdr *th, __be32 = *ptr, struct tcp_sock *tp, *ptr++ =3D mptcp_option(MPTCPOPT_DSS, len, 0, flags); =20 if (mpext->use_ack) { + struct mptcp_sock *msk; + u64 ack_seq; + + /* DSS option is set only by mptcp_established_options, + * the caller is __tcp_transmit_skb() and ssk is always + * not NULL. + */ + subflow =3D mptcp_subflow_ctx(ssk); + msk =3D mptcp_sk(subflow->conn); + ack_seq =3D READ_ONCE(msk->ack_seq); if (mpext->ack64) { - put_unaligned_be64(mpext->data_ack, ptr); + put_unaligned_be64(ack_seq, ptr); ptr +=3D 2; } else { - put_unaligned_be32(mpext->data_ack32, ptr); + put_unaligned_be32(ack_seq, ptr); ptr +=3D 1; } + subflow->rcv_wnd_sent =3D mptcp_set_rwin(msk, tp, th, + ack_seq); } =20 if (mpext->use_map) { @@ -1708,9 +1711,6 @@ void mptcp_write_options(struct tcphdr *th, __be32 *p= tr, struct tcp_sock *tp, i +=3D 4; } } - - if (tp) - mptcp_set_rwin(tp, th); } =20 __be32 mptcp_get_reset_option(const struct sk_buff *skb) --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C17F03E3140; Tue, 2 Jun 2026 12:15:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402501; cv=none; b=rR+5zWAevaLfLOjrRX5/c8rWXT2/gxxYzxBN2ImsbgaqR6glIOa+BdIlJI2U1j42hCCqmvUE7PSopJwwpzxbCGaXoLAwbfQiFQW0zX5XVvpB2rYNxH4vvvDbgF94/HTfo1t92hXHbj+CkMFXs3sJxGc/PCyK3T6yC2QTxAX2APw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402501; c=relaxed/simple; bh=tY/a57/TVSvpgNnIoyCRPnJyQg+HO8WVORGfo0db7mU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=RufPfu/syBCeKBICGEwneh/pFmp3V2J1GdgN2PQ1IZ7Bt+JviAtKrJlGDCFk+LNV8Yt93FvSDTJ+AKvKqaxw5OAkCML06MfiR92ICjwRzmQQoCSKtAQrnPL3QykHjBtGnKPBqzVXH7W/cgqK2wVNydvXCAn4X4OCFDGkZcwu6Lg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bN/t8e4G; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bN/t8e4G" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0ADB11F00893; Tue, 2 Jun 2026 12:14:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402500; bh=Xa5SkSOu7iCqTLmCDdQrrU6/PcTgQV+a6wr23yqLyL0=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=bN/t8e4GPN1ixO5zKW32iqbICLD5oNiKI4n11SMzdbZl/l1OTsb4yIOwwcjyHE+yR yWpVUssEaM+81IDHZdQrYVRQPMLVpq111khHEUnoetjycTr6FXFx+wETDYl+YkNqDT U65eVn1W45mooL+cb0vcRIQFnAGleywrOAugEHrrWcRA4/QMy1oNZv+XskWapYQWlD Y9KpZkc1OMFADY+RfXPkJH2JKYL9sDnHBUa3NXB71Ay2ixm68UENxTjstcln4vcfh4 VreoWKiSZmwv3ehgWbfKg+Ml4VrmCICxgao64lHY//Y31mhKkxMvtb3FKFUkjjK5aP p8c0hErig5Aqw== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:11 +1000 Subject: [PATCH net v2 04/11] mptcp: allow subflow rcv wnd to shrink Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-4-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2014; i=matttbe@kernel.org; h=from:subject:message-id; bh=ZxRWHdtL3tuj75xtqktzYg7JOxPwuV8ew2GHxY1a/ao=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksqYVJJrvGMZJqDZMaYcZK9Tvt0Ie3hjsoj pawnoIpFrOJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c5UED/9Bb3D/tC8nQpL9Rux+nrE2lxJqGwswXeBu1LKr6fmyvBcqU5XbzzsxK3RuU1h1elGrsev i8mO0ZpL9eAt8fXcuUGUtiQFdJWAraqNH5lPODFlnV1xHfAkYb/oWjEJfgNu1EBb4Cx7Of0LKCu nIB4NT6OGvP/g944Yho9Iq3vHvcu12Z5t9R2RT81FRv2CchtENx/AWFynUV4rkYnWpLQ7G2eGm8 CVeL1hxtvTq2RtRiWESQWYzfU7RConhIqeGcXE11fTg/DfdRjQuPQkff6imxEw1JKtz2kK4pin4 Ct4xR4d/duM479b6XS1kALIMD0EGL6YEgADG5igzkl77n8dRpeffNaF/6OjvNUJSBKWZZFNBzP8 pQpXXYf4xbWP/AKRLt/Z7Wo7pNnLUG0Vf1R9mjiDp3bdaStLAHAEp7AlEpdiYT/wU5IMvKZJQC0 ZydOofi9NIya7kerpsrmjI4BpjYzKbED5VlpSZdahMVzBKUWiP4t4JyY+DeWEbor62KUWmBXXxC bxYiQJjPTg+pP6k8AG2m9Er7GW7D/IvqKpQG52gYxvssHPFP8D8BS28eKxJZeuulJJf6tQmW8p3 SDlxRAGZcq076QwSKC3IGpuztUbUWVx8cdttgHxfhTH7yJEBw/WEygohBYOo7Pp8cm77FQUkBa9 o8IKnRu7wGLrd6g== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge does not move backward. That in turn causes artificial inflating of the MPTCP rcv window when the incoming data is acked at the TCP level and is OoO in the MPTCP sequence space (or lands in the backlog). As a consequence, the incoming traffic can exceed the receiver rcvbuf size even when the sender is not misbehaving. Prevent such scenario forcibly allowing the TCP subflow to shrink the TCP-level rcv wnd regardless of the current netns setting. Fixes: f3589be0c420 ("mptcp: never shrink offered window") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 2d25f319f328..51ca334678b4 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -566,6 +566,7 @@ static bool mptcp_established_options_dss(struct sock *= sk, struct sk_buff *skb, { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(sk); struct mptcp_sock *msk =3D mptcp_sk(subflow->conn); + struct tcp_sock *tp =3D tcp_sk(sk); unsigned int dss_size =3D 0; struct mptcp_ext *mpext; unsigned int ack_size; @@ -614,6 +615,12 @@ static bool mptcp_established_options_dss(struct sock = *sk, struct sk_buff *skb, if (dss_size =3D=3D 0) ack_size +=3D TCPOLEN_MPTCP_DSS_BASE; =20 + /* The caller is __tcp_transmit_skb(), and will compute the new rcv + * wnd soon: ensure that the window can shrink. + */ + if (skb) + tp->rcv_wnd =3D tp->rcv_nxt - tp->rcv_wup; + dss_size +=3D ack_size; =20 *size =3D ALIGN(dss_size, 4); --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 538473E1231; Tue, 2 Jun 2026 12:15:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402506; cv=none; b=jQe8dkSaKDz7m95FsWriSMt1whL7R4JhJhcCjTZPDmiPyLSosZnKqDmsRoQ1tN7Qj+wIsx44R12xgKuAwChv3cErTAJtaUtt5hAvHG7RfmYylyLWOMZixXVa9ONTIrS8dgMxGcPxUoYlkwbm8SjD0w7M4SezwDUHjwDtMfuY/Ys= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402506; c=relaxed/simple; bh=RbIMlTBhX+nwth2ktVhSGSSP8Wft3sWwsEfCV850KPU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GR45rrZtMNwnWjkW0uGqFxpz4uJ623/wT9xbSPjEjEZPr/6bwJB+KnnmmkWWkJrp03IIHQAZOj5IOsHaCgXJau4ZZ4pqHIKPriFm2QLPeirCroihYYPROPJCcFPXUMwoof+xTbvpqZJQuJbgsujX81+WNC+oy02k1dkZS9wLeY8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=anYL2ekO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="anYL2ekO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 518741F00899; Tue, 2 Jun 2026 12:15:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402505; bh=GszvUxBaQDM6cXw6ZUDOFBlW4uvlwqG8sNmpgHjMLvE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=anYL2ekO3xG7ATE9PPzneakr4Cets8drBTTViQwVThOpz1S2ET6jhGPkIqMDPCC/T ygkbLkRayd6MC6MTrij71BnCdtJNb9EKK4IaVH4blQbRjl7K2+JQDw3ksrxay0iKEu mo5PG6+ZaqkVLEeGWZqUHpw+d8xoAw5AVjNyWGPID59gNHLPpKlU0zWWBIuGCaeKWd Fej0aytYS/UyDIRdfv/4/faDEEdF7lj/0Dxo9jsFCwFid3xEM+16XLPwyBoK3zwLLW kJYTQ+xdL/oXcBCXMR1Ib3aHJ9AlAmJsrdVsDmPXJWym96821P4q7jrZOXyE7aShXD TmOaI4pjFihmA== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:12 +1000 Subject: [PATCH net v2 05/11] mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Tao Cui , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1923; i=matttbe@kernel.org; h=from:subject:message-id; bh=7ukesoEXWL1n6AAghVFKroS6WjmMIg9iq0MAWyf9XNo=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksbi2YDv1oHFqBSHFmhgsONSsDTaWJHJTNx kBAG9P6hZOJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg cy4kD/9zUAp6YRfI4W/e5jjRIpW3xIKDrQASL32osbKBTHCNnREUP8oHiJT5hdUMcmtET1YJIvn 8zH16xNL1EIl5V/IYC5tRrwoJd+LAAR7i8/+Sd8y+YWFtAkI0Pjq62T84Ng2ypoKkc6UxW8YP0R xqsx/Ba7lY+zedvHHTr0Jjok/cUbN0AF2qRYlEmJi9XM2NO3mU7xISSfX8P5mo8wVmnUczfCRnU btoVGufWyHPZ/+Le6giw1N4FKOkUcTUxFvRC2DHbJLfWBlYC89HsEESGPLN5cJbcjdCcqMW7NLw 8nz8fbU/pFRA/fVaXDW6KYmY3+T1D5ggImzQT+PoKl8PdfsH15UW9N5Fwrr7VefWaBZnE5Xlf/q kc0lhOFXhhfVJNhi7aO4i+OZWsjPMXyy/4+MK56QaASc8maxrWpw0raBMpZ01rLQL772jwg4Ein jvvJWDC8CdLZkW7Y9RWRX4Q1UlEO2aHUOKev9R+s4M6yON4nIVHXzC7IF5l4vURqtxsORettMxE pSNs1twMruzI88wQbToOS2rEJNemw9mKBYX1DWXN4Rd8/NOvCrCUO5974cWOxLAc5rqbN9lB7pT R1Fexfw03eDYr7Tpsf3dWOHKVheDXUlCUt3BqBgQcSwTngF/yvfYqhKozwRMbs78mwkfwLLG2FL KByQQ2C35uutTRA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Tao Cui The userspace PM increments extra_subflows after __mptcp_subflow_connect() succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to roll back the pre-increment done by the kernel PM's fill_*() helpers. Because the userspace PM hasn't incremented yet at that point, this decrement is spurious and causes extra_subflows to underflow. Fix it by aligning the userspace PM with the kernel PM: increment extra_subflows before calling __mptcp_subflow_connect(), so the existing error path in subflow.c correctly rolls it back on failure. Also simplify the error handling by taking pm.lock only when needed for cleanup. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_userspace.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c index 8cbc1920afb4..0d3a95e676f1 100644 --- a/net/mptcp/pm_userspace.c +++ b/net/mptcp/pm_userspace.c @@ -408,19 +408,21 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *s= kb, struct genl_info *info) local.flags =3D entry.flags; local.ifindex =3D entry.ifindex; =20 + spin_lock_bh(&msk->pm.lock); + msk->pm.extra_subflows++; + spin_unlock_bh(&msk->pm.lock); + lock_sock(sk); err =3D __mptcp_subflow_connect(sk, &local, &addr_r); release_sock(sk); =20 - if (err) + if (err) { GENL_SET_ERR_MSG_FMT(info, "connect error: %d", err); =20 - spin_lock_bh(&msk->pm.lock); - if (err) + spin_lock_bh(&msk->pm.lock); mptcp_userspace_pm_delete_local_addr(msk, &entry); - else - msk->pm.extra_subflows++; - spin_unlock_bh(&msk->pm.lock); + spin_unlock_bh(&msk->pm.lock); + } =20 create_err: sock_put(sk); --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F01A30FF2A; Tue, 2 Jun 2026 12:15:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402511; cv=none; b=lJ6owdxijL4Uy2NdXFMifc4fyXG/75LMVtb3OvPJf6qm/hBF3qjCfOunID600TdMPmcHoe96qrLurj4Lai6qnQQEqjJfnXUoRYVGI7I3R7VaNojkemT4qCVENwW7O2H2cCi4UbJl335ZtXd/a9Ef11HOSUxpMBroeaLzVaUzALE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402511; c=relaxed/simple; bh=McbAPzejErfT3vRXQ/3hwMvfOEHqfV+gtaE6BzKmcQE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=YxOWpZ5hyG/W5J+rnIMyAc7g3WKSM3tXA8/NyJfaV7nJ94zJtgMl3dh8qZ956LcNS5qL/IzTeI7Mf0sDap0AxOyrwm2FHsGRYcOX9dPsg/okZ2zV2/lO1HLzsXlnmoCjhzai/RawvJOKSIRYwWt5KaYXY32PDdHG+rqrlI5Jons= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VpGZOw93; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VpGZOw93" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBB4B1F00893; Tue, 2 Jun 2026 12:15:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402510; bh=4EWYupGYd5fMa1tvYvYfivxtiq5o+ETcaNhau+4S4So=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=VpGZOw93JRVUWz+Uc+iLf+ASBCVayfsIRB8g0lTD/LXBahKF6TDDz7SWBb5KkptFx Yl7ZC3JFzhUHuwRfF/j9CjvLIReCUXmD34DyGMk5kneqs48435DNSi0C/yV76x3OHJ hhqqrJtchRi0e0yJlVTt5WfioCSJsXX6NfwI2tPH/farmGmtVTvk37mlxb7c6GbZdS ckRxhKz7n4LvI9FQ1nCYVVLxb/KasfCgmKyTRtTJVqajCF31YZmDfqKSPOpkInd84R 6iwpa3vI7jQuQXou1PB6RdfL0NrFRtkWxmaYLjb9e7Kl9uL0CA6wpAy4yc9CYca2EC ISQLuLDrasfsQ== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:13 +1000 Subject: [PATCH net v2 06/11] selftests: mptcp: add test for extra_subflows underflow on userspace PM Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-6-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Tao Cui , stable@vger.kernel.org, Shuah Khan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1256; i=matttbe@kernel.org; h=from:subject:message-id; bh=cyJve84NvhmylEe8skv2EBSqKlu2Y3sUtFlAamahTeg=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksESMxxYGrewxjRznpAjA9lTQ1J++pwl+CU a+yCIS0lGuJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c/UREACGwFj2CuJuk8/U/RAnGYCYDI8xUJO99rAWa+gs32owvpDh7TpG6A+hOyhWoBtUCEeEeSc aVa8rBBBB1BZGTqgeX+NiZ6Pncsvosmt7dQSZp5M+NY67ZmrdPvuLUqb1UP4VvlIGM5GctDSgzd 88WeTbnmPeifShJsJt3iyc1/WbIJsZ85IjWRUyVXfFNNjagPiDB1aps2WVXEacjNgGAst3Xpwc7 6mTxdUrZDxiEl/qIwdhWcOQVUiMlKRGK2c7GS1oKbf/U6RauhYiVx5/wRZ/g+vF604TLoNuQNtM 5mQY6l7xpW9wO/sLu1npyDazStTIIIUhvTePm4CnlCNKRAaX2i0Ofnlc5IsghFCCVHWuf5teoXx lisy0sB4ZdRz9iMYKRrBYtcT9cr5caPxp2FpCaOi5/P+IgObEjcXZbHDf2RfClbPQ0kjh/cN3MO KvYKbcSC0pFF5oDBlER5YIFsRn4nUXwn4izz7ztWwsmtLy4jb3J/V2eAKLKkv4qyYXZGiuhELEb 5xyLOklW08PAevHLGAQoF6ELI//i9ksa+1h9rIIiXNmcBcZtAhrQtRLIdHkKB53CHOAcHralEvU xP6soGFLiW6XPVhv17h6O0d08TGU47hdmJ13BFsulhitX7WIy3NoA0MHKL6uYhrsxxaqCVD22yW GWipqbv34LqUd7A== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Tao Cui Add a test to verify that when userspace PM fails to create a subflow (e.g. using an unreachable address), the extra_subflows counter is not decremented below zero. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 5acd12021e6e..4b3f71e66609 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -4100,6 +4100,10 @@ userspace_tests() chk_rm_nr 0 1 chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 + # check counters are not affected by errors at creation time + userspace_pm_add_sf $ns2 10.0.12.2 10 2>/dev/null + chk_mptcp_info subflows 0 subflows 0 + chk_subflows_total 1 1 kill_events_pids mptcp_lib_kill_group_wait $tests_pid fi --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3EA93E639E; Tue, 2 Jun 2026 12:15:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402516; cv=none; b=kgx7RyWTuDUZTEoHRRxfIiUmnqTWRSG2wANeqCu402qhqYiVIDnBGndblcDR5o7ggi07PrOyIgvJeVoVvhjrxDyAkecnRMxyH3YUseVeHR4tDgyBma4qGMpL9Z71ZpQ3QF8smTpg9wdXquZLbLE0DLJYmIpyuvMnYGz16ShOUZc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402516; c=relaxed/simple; bh=MNwk9kiw5Gw4uouuz+RiKh+UVqshlnpxa58+xHjhdHA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=f2rvoJDA8IxdRecu3XRNj6cOgA0ZgcagaLiPLcKIJhXzZ2UHh5nOCoVbmplRq1L20eKGw+PhvpGfdsAsAq2FTDVoviLb7F5boVcZIKNS/8mHT+xdYJTScIrXrN0BOBDfvePofAbN/0eYaWAtQEeAD+FplwQA28Dl/DCq9Pe01H4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fEc5ZcBx; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fEc5ZcBx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1B6B1F00899; Tue, 2 Jun 2026 12:15:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402515; bh=SlNpdZug6zmUodf4JIGKJ0htxXImybIlq2fCzCj5nQM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fEc5ZcBx0v3HafHbGntOBW3JgkGPNdxQAdq2caYsdipmxU0O4OgyxNjqSbpFQIfHv Ugj7/NYCrRevdFfVJbL1Bl+gLlcIKW19bRelmaeKhqDojaHwUDBL3onhRsB8BbkqDF 2GlVn/IK9iRK0ssd9c5SsmngBoRl6buctHl6pZVEz+gbdRxsIhIrWq11QzoFQm3gJW UguNlLoyujakQCJFp9Cu/s5eq73QxlvLbQehPGYykFJ+/f91wX9opOv02opW86r6oT Fttq3+aHW6RhKvdBvGK72ZMqfvfU1ZITjiaUcC/5YCIWkI+9SURDmVPCoptaMNMM2k ntNIKLUxoOmpg== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:14 +1000 Subject: [PATCH net v2 07/11] mptcp: sockopt: check timestamping ret value Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-7-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Willem de Bruijn X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1470; i=matttbe@kernel.org; h=from:subject:message-id; bh=MNwk9kiw5Gw4uouuz+RiKh+UVqshlnpxa58+xHjhdHA=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsks+gEDHD+8KKy8v+m9UoX27Z7RfIR1LIIRX C4zBZ4A0mqJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c5fMEAC0OWnt7+b5c3UirNPd60AM/QpcXKzcdhMWwzixF0eUbHPORAAWGPnBgLckVAQNJgmZkfv Y9ioTPjPS+wYMFGH/btWBJA4AxArukcvEdnQsL2e/Ofxtcs0BBudTtTUjddsop3mjImldNWUUwd +xgmOYyISUFk8Ier6lOopSeUj38xJ6zYBTqQ/Yjo66E6hxPae+/KMJMC9l3I9oc0FkmwIQfbvSh 0lV7Pczo4At4Bmqa4kCQMyltXe5w2plPmCs757ZvGlJwxnAABi36tC4Dw1iNc4n8mVs/AH86QND 7rTe6y2R1qPm/v2KyzDfkhvg/ZIyxTo/D8DtZ9d6KFcNHcaEO6hAdso0isjJj4XMGa33ir5IP4g i52xwYb3hT9wpGf8XIT0EGcNVI9ZuFF5kTsDJuJtgInzEyHCqnVGhm4J9eQBisY9tyel2tOOO6a OqLsnNAjOBSSSSDxoN4ojdXLLfu6AX6Ml+5KZTq2mURsgXjenH1lzbZjdIP0WDQMlz2pofMHTwZ sbSKyrW8xJm62dX/CrpUlrjtWTZOuhbJQCGxaAmvLvVbEzGGdXYe0EYlun30YOswOXOD4c+1ot4 ydALniXkfnfIamIQIVKIGLPQby90I6c6HKw4Z2sxm89sLh3iK1BdDam22udsi+glJepxvYb3VIQ UvZkg41V6kIXK+g== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 sock_set_timestamping() can fail for different reasons. The returned value should then be checked. If sock_set_timestamping() fails for at least one subflow, the first error is now reported to the userspace, similar to what is done with other socket options. Fixes: 9061f24bf82e ("mptcp: sockopt: propagate timestamp request to subflo= ws") Cc: stable@vger.kernel.org Reported-by: Willem de Bruijn Closes: https://lore.kernel.org/willemdebruijn.kernel.178a41a53d041@gmail.c= om Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/sockopt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c index 87b5796d0135..91aa57f1d0fd 100644 --- a/net/mptcp/sockopt.c +++ b/net/mptcp/sockopt.c @@ -241,15 +241,19 @@ static int mptcp_setsockopt_sol_socket_timestamping(s= truct mptcp_sock *msk, =20 mptcp_for_each_subflow(msk, subflow) { struct sock *ssk =3D mptcp_subflow_tcp_sock(subflow); + int err; =20 lock_sock(ssk); - sock_set_timestamping(ssk, optname, timestamping); + err =3D sock_set_timestamping(ssk, optname, timestamping); release_sock(ssk); + + if (err < 0 && ret =3D=3D 0) + ret =3D err; } =20 release_sock(sk); =20 - return 0; + return ret; } =20 static int mptcp_setsockopt_sol_socket_linger(struct mptcp_sock *msk, sock= ptr_t optval, --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B3B03E2769; Tue, 2 Jun 2026 12:15:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402521; cv=none; b=uqBSZ/GGX8gBmib27O4ESOyny6yBuQgcDMwsGI7lU9GnPjrk8HyY9BTOff3T+FZi0xjcYc3HeGyMGiqcATja51klaO7DkK2oo8iS5Nj9rzrnxu7cln2E9WEUoxI9Mm1COXgNgJ8TKWO62uV6vHD0s6V3MunYrrz508wMuelEPsw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402521; c=relaxed/simple; bh=N1bc/nUu/TVx6vrRiyttrdnrCWdRHHAZglldql0RHt0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Fa0lVdi6Dd4++qiCXDAZeoQxwwL8G7c8dLI4hP7IixscHHj5L93nJCaEh5kfBN2lb3/F6eLeR+5LYuEzpDkRjg7mroYkrRumZrRCuqk3PET0N/bY4MoWap1LOjwEwOyktpNCaPJ8DTLMGURRcYnovGDNVRU4JlUd1mrLuk/cMrQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SSwIzN90; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SSwIzN90" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 147ED1F00893; Tue, 2 Jun 2026 12:15:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402520; bh=B4xB1YlIM90XgSgiiXndV0d7/6vuxA6YWpl23fcgEKU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=SSwIzN90WHVAVkOr2JHlhH8fVDX/cdEAtDa8l4hbTkk5uOvLIUA6fqkjwpn4o1eOI jy99AVK2fGCr+Daw3Glk29VrWnazBPImWWvhl47jdiSiVnDIbDZYpch8VEC76nRV/j cbVaTONBVCLcSpeCEn4J19qrL26y2l7yUL5pxmNcnGFnYOW+Kyll3cJ0VClI6Ln4GX cC5k9k+61ZwLyKtSARh8Na4X4mEEQWZOcycLFYNCGHoscX9C3nvecCHtPBr6USUB/+ sJdmfpqKZzjGvIL7Toc+nQdvyyrNaZ8lJx5KFPixQFEJ7fnmpyEMBQxMDNJoTJ0LTo DUV014MYHyp2g== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:15 +1000 Subject: [PATCH net v2 08/11] mptcp: sockopt: set sockopt on all subflows Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-8-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1237; i=matttbe@kernel.org; h=from:subject:message-id; bh=N1bc/nUu/TVx6vrRiyttrdnrCWdRHHAZglldql0RHt0=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsks2QEuzSYHMPCU8zFEmJNQCwGBHJ9OBY3JY Fm/L1NGDUWJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c9LUEADoDTAfJ4IQwvOm87BA5wseGddFN/qDZcquGnMZNsmxNtLt4wMcxEnNy+fOB8EceC4wSdh /GB9KY27DTtftU31+Vs+z0eo9CUj1tbeXK3HZs1jugt7jvddZxPEN9rMTiLkBtAHpF/NQBChD3s 2F2DAsBGdW2uv1xCNw65a8bhM+0f5jVQtkmWdrFaMF0JUeNx6h6dZNVsqkUQHH3HFD/teCTsdFP CLdFt8MHOUvBL6+IiyA29KmJL229TAsCubzl9WATYRLJUkWFpMLuymvOpuF4BCKF2Rz2p6oFG4Q iGNiB4xudGgCluPxEWI+19Dq60ZWctHu+JRESjGBgaf7i3nTFFoxcLR/BnSWD8RzkXkCS+y9cDE f1aI3Pq6fW86o21xhHWJwzwXOU0mlQgiFtdWNOEm3as78aSBO1J7GhhykcLKqqzqPap/b/37n/W iSYti2txhFtv26HYV1kJ/HPLPWCMHfTeKkpGq3519k+Klyq7xNzY8As8JxeP2vJj1pGRVsF+Slc YnE0BhBSKFiXsiutOB7jpmjD23kgoeqNGUJ94ZxTPBCiCiflc9CQDWy05OCNVJWh37CasI/tcgm W7XQeSUcqGNPi+XpeVh9gw0g1j3jed/RQIAu2g6M1+ezMJZtWUk1btNWtGjvUJ+4Sx7qfIAjGS/ Gnwknita+8qteRg== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 The mptcp_setsockopt_all_sf(), currently used only with TCP_MAXSEG, stopped when one subflow returned an error. Even if it is not wrong, this is different from the other helpers trying to set the option on all subflows, and then returning an error if at least one of them had an issue. Follow this behaviour, for a question of uniformity. Fixes: 51c5fd09e1b4 ("mptcp: add TCP_MAXSEG sockopt support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/sockopt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c index 91aa57f1d0fd..fcf6feb2a9eb 100644 --- a/net/mptcp/sockopt.c +++ b/net/mptcp/sockopt.c @@ -817,10 +817,11 @@ static int mptcp_setsockopt_all_sf(struct mptcp_sock = *msk, int level, =20 mptcp_for_each_subflow(msk, subflow) { struct sock *ssk =3D mptcp_subflow_tcp_sock(subflow); + int err; =20 - ret =3D tcp_setsockopt(ssk, level, optname, optval, optlen); - if (ret) - break; + err =3D tcp_setsockopt(ssk, level, optname, optval, optlen); + if (err < 0 && ret =3D=3D 0) + ret =3D err; } =20 if (!ret) --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B63A3E2AA1; Tue, 2 Jun 2026 12:15:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402526; cv=none; b=Hs2wTyI3NbKtnpyug6x6OeCHEHdNivuqPSyY5IIv727Vtyrq4ynIvk0RptJC9CdToO2XKehZawDQYt6Co7fWls+cNh8w9NaqXZJSBA9YzROXauB4oQhKyOEiZqerR1mV3ejhDcEkPvsMksbf91seD4pg9JluMxM+wzOZMz262IM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402526; c=relaxed/simple; bh=RT/E+puSLaZidPDXPx3TDleWNistOBZUBVAzhbx9FHw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=P0OSqIUm/93R8Cx5oGBlgF//aA7DyrjrqKsJGU1IfXuQ7zdEQBkxwNsoVuQ8rkHkYGoUkbAqvmywRs5U11Zk9GNzQIJYp1koFlnYmATb7qYYKjC6DkiUXXlNeljYXFo+bJ12dzttl6KY1HCH2mpVQ9Pjk9S/1Sh3T6ejmAwC+9I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fw+/GaxQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fw+/GaxQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A82B11F00898; Tue, 2 Jun 2026 12:15:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402525; bh=TE32s63FN7oiWP8Km/xUybIoPrIk9f292PR3zY9E4mU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fw+/GaxQtuYIpWxX3I/RDuwiT7bFVE91FglusPhnm3c0p9VT7lSs4UWjxkax8U4ho uwR4KYz4nXz3viQ4GZWeOJd2AFVSgQkzb1CMhiLsykCkQqru8gcsWOCMBcMU49japJ T0VfIEN5NvO9XNXNBvwB43QaC0Gh9Okn/xC64qgdn6rviAh2uHy0nUfybYeRdT0fOJ 57NORM7XT6ut1Ze0mdJKjxm8vFWuDhtm7p2cv8t4UcdOURGPmFIQOA+lb/eBhwWzhL LXYrQE8+iX8lHjrUHyMvDfnuPqh61xGo+tAVnpQ0GREpkAxReh0De/X4sXwJEIIL3r 8+wcVkR8wKxWA== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:16 +1000 Subject: [PATCH net v2 09/11] mptcp: check desc->count in read_sock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-9-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , Gang Yan , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1199; i=matttbe@kernel.org; h=from:subject:message-id; bh=ouh+8y0QVk20uitc41ZjPExokNTNSrOLDbO4PTnW4No=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksWaN6ilIurzO/hzZnxWVCBztHQP9abU+aP VsA0Ku3xkGJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c9NVEACJqfhJ8a8FwMXrvsNBO8w7ZFgf8zsdFqFFpgI1NRT8vP49DA6Fk80dqB+FRFsTL76HEIO TU0zXRH8FWEplaE6p0TBVeh5Shc/L/E4JzMW5mZ8vUDo83EoD2X1TzEqghf5CvB0X1ZjcOvmnVb xgohauG4Q1YNbFXRlTHvRteTN2AO9oqbhgePaT0ZbEooirgHh2ibmFcCEsS73oT35Zgiod7ShNQ ilta6ftCuBwmuST/XWn+dDA8gtx4JNq0zwDBJaKEhQnJUAc/+99INlFk+q0R+WsmyfdROhCF5gg spQF9sBHJV7DHP0EQygZAJE5oDNyOMM7M8DKc217nVDJWVx2BemiSks9AZWDH8jkk6q3lRGJoU1 tzFXMkI6B5LfVaa6+XC9aUo4nSa4H2/dRBzkbJpAeghgFGcwidRhMTyiFPy3eXMh3MTy08zEoEF slLRS0GrqQhGfcDgS8Meq2FdDjEpWazzjzY3R84u2dUxFi4Rg5igMAjv7AxiJtTVQJYQ7o91Kjb DPRfXLmCpO692BF4Zop5ckuam0rCg8zYy8c6MRV8fvt4IH7mbwW4GtDG0IoY108jZNtdys2KB9z zmZ7bFR9VILUS5Hoov5Cfsfv6v8XWtN9Evb8uTOPN3lc7kycH5E3z1lk/Hq8Qs4Wn6yJ2syrR+2 xciUqmm6fg/O5Lw== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Gang Yan __tcp_read_sock() checks desc->count after each skb is consumed and breaks the loop when it reaches 0. The MPTCP variant lacks this check. This is a functional bug, other subsystems also rely on this check: TLS strparser sets desc->count to 0 once a full TLS record is assembled and depends on this break to stop reading. Add the same desc->count check to __mptcp_read_sock(), mirroring __tcp_read_sock(). Fixes: 250d9766a984 ("mptcp: implement .read_sock") Cc: stable@vger.kernel.org Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7fac5fac2097..cb9515f505aa 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -4428,6 +4428,8 @@ static int __mptcp_read_sock(struct sock *sk, read_de= scriptor_t *desc, } =20 mptcp_eat_recv_skb(sk, skb); + if (!desc->count) + break; } =20 if (noack) --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 677B53EA953; Tue, 2 Jun 2026 12:15:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402531; cv=none; b=lZA8RUERhi9LtvSjL6BHRMNt02Ne1NDctHsKZx0fwT2e6K/XikfCXIw1Q5jwlY2wXcv+qE/meMKvYQTjx7T9B3I+Tg+nmmKGsObzf6UeE79LzxNkIH4UrDMRjFQUaJ04jAuLpiwuBnzrTr3mp2p5le1DGByempI+xCy7NvTHups= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402531; c=relaxed/simple; bh=Pb5uIQF6xrHvLFdMOfZGgfzn3MnhwBuxo1h2x2WO0y4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NOXyCUBH+UgaPks1JhsvOvSwcV8PbhOy0YD1eVLUGJNxJLK2v16eaW/Ppyh+SQyi/ARQOHPPiMXoUT0Ex3eeqoUPJpxs/3ofzv6dxEOfdy8zHEE2KgEU9NZUAquFPPlEMO3XWbcbCF9jLkzMlVB61UtimEddQIT2lC35w3gjx8c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gv4VxqSF; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gv4VxqSF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C74661F00893; Tue, 2 Jun 2026 12:15:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402530; bh=ZhxoqN3JeRUhEKx5rHCeGzKqFMlKcZtGh4H2OOvDNq8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=gv4VxqSF0z5eTwH8heCZvsFWR4toI/N68Q8EiNCHkJHth/ekm47NbiR8idX/hMR0q K2+m/cd3T2gDYcfmcX39D5mUCBx3rfZYBn7mb4YmdMo/EqE7iSfr/ZmvSyHGtwoT2Q RKuwl1obPRnkN89v3U8tM7BP1TIzU3R9uRWYa3bpQRlAnVDY4yF+0Zt5+/JkUnr/xC ErLFTP9UGKk4WNKVur7ZUcWrKqXgON6ALPjdTgSqNvktN7Vmddr3Ee8ekjwhYsXDDx fIOSFt5pjBqZGuYHWarAZisf2GqI8MLGDL9xp7lMYHS20DhNd2JIcorHFymIcPFsq1 sOTYPTyX3EbLw== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:17 +1000 Subject: [PATCH net v2 10/11] mptcp: fix uninit-value in mptcp_established_options Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-10-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4656; i=matttbe@kernel.org; h=from:subject:message-id; bh=/aohqf5DfCAEEto2DIC4coPvV+C/adCq+3P2bJc0Tmw=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsks6mN88BwgXEZDNHutPT6ZitmrbrJ6qIorU 6kxjscuNV2JAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c7+pEADtX+AYElWYrT7/DTddd3J6oDx/v8llXnP05v0EBWKqXsJor7n+9FTmm7g+AvjEUFljnKh Wm6fX0UkzBJDmsvV5HRqbHGAn2dXyiWBGZvcdfo6n212jnvTlwwI8M++15gp2H1NmBrlF6aMWcc cOHpDWrvjRn4saCskJtq12rT2UQ0p4wNi35Bpp7AkWA740X9bbsuJa2+PhWotCDAlV0Ti/2sCk6 ffcH56d8A4n93no2+bO8C8TMbaXPfXmfT/sbMxsPm9+/p25I8B3Pq69sH20GtW5FgK+/aHs7Cdu AuSv0kC7DOIvlPqdbiBYFvPxRLNchkYu0QVsrDTHk80VtpDYpag2bFe4PRVLU5FoEaR84kHhevF BzPoBz1gjsmVX0Sr3uFQB/k7kouWxD44Zi2YqcjW5c91jPpKgmD9PQlCcnDuOy5IoyRRkVpO5Ub ruvdhnWzE5c2xi9n7RIZl5Lw+J68OtGWfWrQk7HielxwsH1aS6EofIoD/L8etOu7Q8j5gps3FsD X7pfLNLrdne0xPzfouoNsQZVB5z31jDjF9X/cDtgy5xAU/iYD56anjxjWlM1ijO7EXxIXdpxB4k vXvx+9eCtwlbk1fCZfCCS/v7yQZsXQmYsBfMhOV++EBCQ4NXBTq+l5Mp9/GLntY65b9c855NHMN EZWiG6c+G8vetsw== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni syzbot reported the following uninit splat: BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 = [inline] BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/optio= ns.c:590 [inline] BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/m= ptcp/options.c:874 mptcp_write_data_fin net/mptcp/options.c:542 [inline] mptcp_established_options_dss net/mptcp/options.c:590 [inline] mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505 mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137 mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218 __mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline] __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313 mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367 inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442 __sock_release net/socket.c:722 [inline] sock_close+0xd6/0x2f0 net/socket.c:1514 __fput+0x60e/0x1010 fs/file_table.c:510 ____fput+0x25/0x30 fs/file_table.c:538 task_work_run+0x208/0x2b0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [= inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] __do_fast_syscall_32+0x2c7/0x460 arch/x86/entry/syscall_32.c:310 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Local variable opts created at: __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 The output path currently omits initializing the mptcp extension `use_map` flag in a few corner cases. Address the issue always zeroing all the extensions flags before eventually initializing the individual bits. To that extent, introduce and use a struct_group to avoid multiple bitwise operations. Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()= ") Cc: stable@vger.kernel.org Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dff020673c5e3d94d9478 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- include/net/mptcp.h | 7 +++++-- net/mptcp/options.c | 6 +++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/include/net/mptcp.h b/include/net/mptcp.h index f7263fe2a2e4..ee70f597a4de 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -27,7 +27,9 @@ struct mptcp_ext { u32 subflow_seq; u16 data_len; __sum16 csum; - u8 use_map:1, + + struct_group(flags, + u8 use_map:1, dsn64:1, data_fin:1, use_ack:1, @@ -35,9 +37,10 @@ struct mptcp_ext { mpc_map:1, frozen:1, reset_transient:1; - u8 reset_reason:4, + u8 reset_reason:4, csum_reqd:1, infinite_map:1; + ); /* end of flags group */ }; =20 #define MPTCPOPT_HMAC_LEN 20 diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 51ca334678b4..f9f587203c35 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -572,6 +572,11 @@ static bool mptcp_established_options_dss(struct sock = *sk, struct sk_buff *skb, unsigned int ack_size; bool ret =3D false; =20 + /* Zero `use_ack` and `use_map` flags with one shot. */ + BUILD_BUG_ON(sizeof_field(struct mptcp_ext, flags) !=3D sizeof(u16)); + BUILD_BUG_ON(!IS_ALIGNED(offsetof(struct mptcp_ext, flags), + sizeof(u16))); + *(u16 *)&opts->ext_copy.flags =3D 0; opts->csum_reqd =3D READ_ONCE(msk->csum_enabled); mpext =3D skb ? mptcp_get_ext(skb) : NULL; =20 @@ -595,7 +600,6 @@ static bool mptcp_established_options_dss(struct sock *= sk, struct sk_buff *skb, /* passive sockets msk will set the 'can_ack' after accept(), even * if the first subflow may have the already the remote key handy */ - opts->ext_copy.use_ack =3D 0; if (!READ_ONCE(msk->can_ack)) { *size =3D ALIGN(dss_size, 4); return ret; --=20 2.53.0 From nobody Mon Jun 8 04:27:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 992583E3D9C; Tue, 2 Jun 2026 12:15:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402535; cv=none; b=qabrrv52IFs8t+hs6ouz4s9mhWk/v9e4d8smQb7U3nOfOK/SoyhQWxnGGpup4edUWHTr8r1fZu7DYJ96GVCZ8tZQo2GGDz9RlZjhDvgXbpZBWk3ltwxxvJDI2fP38fs67m02ntb6t12F5YJrGg4Rh/eYj4EHM45KXi8FLqbFq40= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780402535; c=relaxed/simple; bh=TDSlEQAI9aZlxLDOKTT6kcPR3WyjMWlmfwcB/s6gTuY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ofjhl7k6CL6ZgrHUBmX/ugC2ef29AzBOZh7l/Fkfo+WO6IrsNTZ9N2UfWz2KPGLS91ME9ie2ILxceLPyL2CdN9os644IEyOeMXgUta5A5X+4dUYjR65RkTqP+2/ZppGxaVguwY0AZ20uVh9j93ekvMVS9xDAKLpCDT7jtuDDaXw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RWOJcseP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RWOJcseP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 972FA1F00898; Tue, 2 Jun 2026 12:15:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780402534; bh=7Ao7fz5le9HP7KQGswVTuk9qT9seYPLebT7V8Xvs21w=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=RWOJcsePeC8u1EeVDwb8O1Bsu7LbkIIsSbixSv1vIyNcucPemkZI4pIoJC4VFDWuO 69MvMD7TXrnEahO1cGnWGbx0TYvdHNougqzMy/PdScLIIRRD9bIQ8lKgzma7OQZJWf RHgs6gAmNsqvIiagMWlctUsUIRFBgaWz+CdDDyAeSHXpf/BkESpsFosEExPRn8E/8a AAY8ems3bPMHhCWu83mZpp5VOaJGw0G87bJCJiNCf0NLVcbl9KVpbw7LBq5Iyl3iUr LwnjaOWXz2yLl8YfBTUV0Dkiv5lR671cj8c8kvsfUFRAyxDZm0+7kqBP7/5AYnoxDI B363Jc5FPMRLA== From: "Matthieu Baerts (NGI0)" Date: Tue, 02 Jun 2026 22:14:18 +1000 Subject: [PATCH net v2 11/11] mptcp: add-addr: always drop other suboptions Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-11-856831229976@kernel.org> References: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> In-Reply-To: <20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Florian Westphal Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=6430; i=matttbe@kernel.org; h=from:subject:message-id; bh=TDSlEQAI9aZlxLDOKTT6kcPR3WyjMWlmfwcB/s6gTuY=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBqHsksqWDt4HC5gmD0GfGLzgPVqwPwxcuwC+gOG AynpAuj02eJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCah7JLAAKCRD2t4JPQmmg c8WpD/9/b//jt2DzgRXft7nDV/WuvXc7F9mMAzIBEbXaUmVBGfahY9Xn8R58arqAuMJErt2YYIt 7Fo2EwR0I/Jh5hEavSez3PNP1D780a1a46lMdz9RLqBDZMM9GKGTzT7jK/tpk9PvyWX8bW8mV5Q xyYhBGsnO+v4ySzCHAUvhMdon1wLeCsdSMP8bw0cI6uFZmFCcntZMIvt8LmqcjH/w40V1r18Z/h Y/iYyeFR/VtwVbMhqHklQ0gWUZnOxURVR5s4IxgoORJUMy9mpdhnjxEUTn8oa57mfXNRj71kgLx o+jgWTyEt+Xh1nJKj2PDt8Glwz2r/Ffd+FBhl+imQQTQrhRn/bVipRLJa38LCBRpzrcZ4oC49Du krJhnU34iTOMGMtDSOvWubqjbuEccAkcq0wh9mFJj1nYMqPgKC+gaaon++Zr04MIlqXXe0oTJE+ M61BK7Zd4FoRgR4YnkB7GNl5/+HNryhYnkm3+bWWXK0ZJOvWan81V59XOG5MlfKEX2r3Y5YwJjL QFRd1jk4ykgOkkXROmruDktXmd0LP+5McwqMkLDrw9sXNbNhpAa2Lgclieh4QDa/zyFHVe8D/on nDSvoAlpEh3ou6rBZX4dIwNcdrDvvWns6Hlm/1w2+pLs+YFRcRqbnaVQZOs7owZR8XVGZZDU0UF ANYgVL4tPVfCPYQ== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When an ADD_ADDR needs to be sent, it could be prepared if there is enough remaining space and even if the packet is not a pure ACK. But it would be dropped soon after. Indeed, in mptcp_pm_add_addr_signal(), there is enough space to fit a DSS of 20 octets and an ADD_ADDR echo containing an IPv4 address on 8 octets for example. In this case, the packet would be prepared, the MPTCP_ADD_ADDR_ECHO bit would be removed from pm->addr_signal, but the option would be silently dropped in mptcp_established_options_add_addr() not to override DSS info in the union from 'struct mptcp_out_options', and also because mptcp_write_options() will enforce mutually exclusion with DSS. Instead, don't even try to send an ADD_ADDR if it is not a pure ACK. Retry for each new packet until a pure-ACK is emitted. That's fine to do that, because each time an ADD_ADDR (echo) is scheduled, a pure ACK is queued. This also simplifies the code, and the skb checks can be done earlier, before the lock. Note: also, since commit 6d0060f600ad ("mptcp: Write MPTCP DSS headers to outgoing data packets"), opts->ahmac would not have been set to 0 when other suboptions were not dropped, and when sending an ADD_ADDR echo. That would have resulted in sending an ADD_ADDR using garbage info, where there was not enough space, instead of an echo one without the ADD_ADDR HMAC. Fixes: 1bff1e43a30e ("mptcp: optimize out option generation") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 30 +++++++----------------------- net/mptcp/pm.c | 15 ++++----------- net/mptcp/protocol.h | 7 +++---- 3 files changed, 14 insertions(+), 38 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index f9f587203c35..b3ea7854818f 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -665,7 +665,6 @@ static bool mptcp_established_options_add_addr(struct s= ock *sk, struct sk_buff * { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(sk); struct mptcp_sock *msk =3D mptcp_sk(subflow->conn); - bool drop_other_suboptions =3D false; unsigned int opt_size =3D *size; struct mptcp_addr_info addr; bool echo; @@ -676,36 +675,20 @@ static bool mptcp_established_options_add_addr(struct= sock *sk, struct sk_buff * */ if (!mptcp_pm_should_add_signal(msk) || (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) || - !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &addr, - &echo, &drop_other_suboptions)) + !skb || !skb_is_tcp_pure_ack(skb) || + !mptcp_pm_add_addr_signal(msk, opt_size, remaining, &addr, &echo)) return false; =20 - /* - * Later on, mptcp_write_options() will enforce mutually exclusion with - * DSS, bail out if such option is set and we can't drop it. - */ - if (drop_other_suboptions) - remaining +=3D opt_size; - else if (opts->suboptions & OPTION_MPTCP_DSS) - return false; + remaining +=3D opt_size; =20 len =3D mptcp_add_addr_len(addr.family, echo, !!addr.port); if (remaining < len) return false; =20 *size =3D len; - if (drop_other_suboptions) { - pr_debug("drop other suboptions\n"); - opts->suboptions =3D 0; - - /* note that e.g. DSS could have written into the memory - * aliased by ahmac, we must reset the field here - * to avoid appending the hmac even for ADD_ADDR echo - * options - */ - opts->ahmac =3D 0; - *size -=3D opt_size; - } + pr_debug("drop other suboptions\n"); + opts->suboptions =3D 0; + *size -=3D opt_size; opts->addr =3D addr; opts->suboptions |=3D OPTION_MPTCP_ADD_ADDR; if (!echo) { @@ -715,6 +698,7 @@ static bool mptcp_established_options_add_addr(struct s= ock *sk, struct sk_buff * &opts->addr); } else { MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADDTX); + opts->ahmac =3D 0; } pr_debug("addr_id=3D%d, ahmac=3D%llu, echo=3D%d, port=3D%d\n", opts->addr.id, opts->ahmac, echo, ntohs(opts->addr.port)); diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 3e770c7407e1..470501470fe5 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -887,10 +887,9 @@ void mptcp_pm_mp_fail_received(struct sock *sk, u64 fa= il_seq) } } =20 -bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff= *skb, - unsigned int opt_size, unsigned int remaining, - struct mptcp_addr_info *addr, bool *echo, - bool *drop_other_suboptions) +bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_siz= e, + unsigned int remaining, + struct mptcp_addr_info *addr, bool *echo) { bool skip_add_addr =3D false; int ret =3D false; @@ -908,10 +907,7 @@ bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, = const struct sk_buff *skb, * plain dup-ack from TCP perspective. The other MPTCP-relevant info, * if any, will be carried by the 'original' TCP ack */ - if (skb && skb_is_tcp_pure_ack(skb)) { - remaining +=3D opt_size; - *drop_other_suboptions =3D true; - } + remaining +=3D opt_size; =20 *echo =3D mptcp_pm_should_add_signal_echo(msk); if (*echo) { @@ -929,9 +925,6 @@ bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, c= onst struct sk_buff *skb, if (remaining < mptcp_add_addr_len(family, *echo, port)) { struct net *net =3D sock_net((struct sock *)msk); =20 - if (!*drop_other_suboptions) - goto out_unlock; - if (*echo) { MPTCP_INC_STATS(net, MPTCP_MIB_ECHOADDTXDROP); } else { diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index e4f5aba24da7..b93b878478d2 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -1229,10 +1229,9 @@ static inline int mptcp_rm_addr_len(const struct mpt= cp_rm_list *rm_list) return TCPOLEN_MPTCP_RM_ADDR_BASE + roundup(rm_list->nr - 1, 4) + 1; } =20 -bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff= *skb, - unsigned int opt_size, unsigned int remaining, - struct mptcp_addr_info *addr, bool *echo, - bool *drop_other_suboptions); +bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_siz= e, + unsigned int remaining, + struct mptcp_addr_info *addr, bool *echo); bool mptcp_pm_rm_addr_signal(struct mptcp_sock *msk, unsigned int remainin= g, struct mptcp_rm_list *rm_list); int mptcp_pm_get_local_id(struct mptcp_sock *msk, struct sock_common *skc); --=20 2.53.0