From nobody Sat Sep 26 12:28:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4061147044A for ; Tue, 18 Aug 2026 17:55:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075743; cv=none; b=TF/v3YRkZzkMc4uZrSxpAA1bT0G6RnVvIqW2o9EgrWf6iQJQCEzGF6R/vll+LN4w1eB3qx2xJAbb9bhw284cJrdrTaebyxeR1p6uo3tKueCPJ/bmYffKGcczSvSgUeawkQHsnU9m77zf+UKRYbB0aAJiAB+cyWE8hXtC4+bO8Yg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075743; c=relaxed/simple; bh=jFVWyC23oRSPwjt5CH4mJx4/5+6S7fiTDq5lmc6pUoQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=k9VZ3WOqjbfApJsAUYhNM4OVteP0cOrGGamPnM6QVuOqi/RW2gt1jQF66TQn1rVvoNeeFHmFipGYVqwPCYpuDk6LwcePi+gcHTaGG2gHwQDGRQwQ/ATCrNsYWPhFJdJbtCGgH1HzmIDkbwf6rwhcGed4+gKWy1CvBPEjVI0x98Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GxUbna84; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GxUbna84" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69B0C1F00A3A; Tue, 18 Aug 2026 17:55:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787075741; bh=GqbZpwn/1Jgx+RxeQVocy/9tRDSihrFf9oZt9UaXogM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=GxUbna84G/1VK61l2xflSfBeuFLtBgCDtnYW1CqJaND3DzHKR8qcnxrWc9QeR0fgI /4wUv5rvzoGMTkClWHK6QxEf9uw6f0i3G0OF/YrZh3HRjhyyxUoV2oVqoA131uKtdD zL/4ytV6LrkT1ZspIh6pL2Me++ZfEvZfh5EfEgl6kWGl70mb6XItvgVESZ0VyVP1lP gaKO2GHvUvSX780dT0xcP3cAc6B8GI/i5Ep9kT8e6Q0iC2x+g7pmwx+1ifKJ2G6Jzm FNcyETOTCDBoA5W3pYsbVXZ7cdpii7Iv4kevSP4DBNBywEwgFFrzmNXYbl1yFS+Pdu 9rm35pnIdqPmA== From: "Matthieu Baerts (NGI0)" Date: Tue, 18 Aug 2026 19:55:25 +0200 Subject: [PATCH mptcp-net 1/3] mptcp: syncookies: remember the request backup flag Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260818-mptcp-cook-reqb-v1-1-052dea9a7f20@kernel.org> References: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> In-Reply-To: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> To: MPTCP Linux Cc: "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1741; i=matttbe@kernel.org; h=from:subject:message-id; bh=jFVWyC23oRSPwjt5CH4mJx4/5+6S7fiTDq5lmc6pUoQ=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJa5sw6fmbOGYOcBIuGtDlq8guXPjuZNKfjnLLhjy3ve jbOVWFV7ShlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZhI1WZGhv/K/Cm/dtgwGrUz J3see3Hr7JMj2nqcWfce7udR2iNRwsbwT9dfX+WST03MoRU/Uj8WKG55IhSZX/Ncfqspz6IPV15 mMQAA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Instead of using an uninitialised bit when copying the info in subflow_ulp_clone(). To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both. Fixes: 9466a1ccebbe ("mptcp: enable JOIN requests even if cookies are in us= e") Signed-off-by: Matthieu Baerts (NGI0) --- Sashiko: yes, thmac is also copied in ulp_clone and not init in mptcp_token_join_cookie_init_state, see the next patch. --- net/mptcp/syncookies.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mptcp/syncookies.c b/net/mptcp/syncookies.c index b5cac5701122..9474706641c1 100644 --- a/net/mptcp/syncookies.c +++ b/net/mptcp/syncookies.c @@ -26,7 +26,8 @@ struct join_entry { u32 local_nonce; u8 join_id; u8 local_id; - u8 backup; + u8 backup:1, + request_bkup:1; u8 valid; }; =20 @@ -63,6 +64,7 @@ static void mptcp_join_store_state(struct join_entry *ent= ry, entry->remote_nonce =3D subflow_req->remote_nonce; entry->local_nonce =3D subflow_req->local_nonce; entry->backup =3D subflow_req->backup; + entry->request_bkup =3D subflow_req->request_bkup; entry->join_id =3D subflow_req->remote_id; entry->local_id =3D subflow_req->local_id; entry->valid =3D 1; @@ -117,6 +119,7 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_su= bflow_request_sock *subfl subflow_req->remote_nonce =3D e->remote_nonce; subflow_req->local_nonce =3D e->local_nonce; subflow_req->backup =3D e->backup; + subflow_req->request_bkup =3D e->request_bkup; subflow_req->remote_id =3D e->join_id; subflow_req->local_id =3D e->local_id; subflow_req->token =3D e->token; --=20 2.53.0 From nobody Sat Sep 26 12:28:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4E56440A19 for ; Tue, 18 Aug 2026 17:55:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075743; cv=none; b=BZguBCjwTumqFSCuF4DzH0kEguo0eN5r6ZtiTdKGarGa73Ker5JkerjjREwEqFwso1ktCLmvTI/1gzXTUZGMlcb/RF81rZHcYSJfL9j0mLBpdsGy/aNRlxukpeJJLipsdf5gT6gL6NcUd43gMFaSy7d0XuQbREAF7qJ8kMh99rk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075743; c=relaxed/simple; bh=ZdV/PUgYUQ48rhd44h0OLQLKEe1C0FwAPgygZZPkS9Y=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ut+BkhjUt2wMTnYb2LQDYPgmSspt2EcgBjIbrj6Y4W1s/d5O0riSRkFpG5tdVO0l5y0QMQXZjrmFMibhOGDiOzEeYlcB3kwMxyminVTz0zelfQ32QXcSTfBmsSd3l9h1oiNmK+DXwtrgEi2Qgj1ZpF5kCqAiP522NAj3ur3EhUE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=W+hYIYar; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="W+hYIYar" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C13A1F000E9; Tue, 18 Aug 2026 17:55:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787075742; bh=2rPuI4YsIP+CfdMx79w18+wJWTYDh+dwEX6Pys3NYss=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=W+hYIYarYMHQy6lzYOavw9M5f9nX4DIHZ8TZuAy6g3kb/00QGwCg3uGCcvLiHcVVD FWIsz2WDCRAuWZKDKvCE07PsZEGAguh1LhPGSCi+7PKGwmaQGbi71TO0VQv2PMEm73 Twi0ttuDbS/S9ZlFEwcquKvpqW7ZfKru11k+jKL2sYAaFsnd25LODUYoG/KVgMVBnu O1nXF1sHRH5RSAiH8UACJQJ/6uN1nGGqCWWvSApFqjCWbKwRyTmVoYI/at7pvwpM4p P+RVfcAFnEqdhdIhlwry770NpGK8Qrehq+Z/L4rdiJ2tCSmwsL8+U7hbG7SWNCrGzs oXeTLtfqC9mbw== From: "Matthieu Baerts (NGI0)" Date: Tue, 18 Aug 2026 19:55:26 +0200 Subject: [PATCH mptcp-net 2/3] mptcp: subflow: no need to copy thmac during ulp_clone Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260818-mptcp-cook-reqb-v1-2-052dea9a7f20@kernel.org> References: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> In-Reply-To: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> To: MPTCP Linux Cc: "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1006; i=matttbe@kernel.org; h=from:subject:message-id; bh=ZdV/PUgYUQ48rhd44h0OLQLKEe1C0FwAPgygZZPkS9Y=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJa5syuF1VsWMlx2CT1xJ3HnH8a/CJkXk9I+6BbacA26 4bivqaajlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgIkcUGVk2Pt58vf+Z28d7/Ys W6TxtSLrrGjEuUUGjpap1bZzOx3PpzD8r8rrSnH/kjrNvG7ut97dH18Z/mUIU9PXWsB/ln35wdN 9HAA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 'thmac' is not used after that point. Indeed, subflow_ulp_clone() is called when the request on the passive side is over, so when the truncated HMAC is no longer needed. Note that in case of SYN cookies, thmac will not be initialised. So better to remove it to avoid a warning for reading uninitialised data. Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/subflow.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index af81ad5e699d..01db7edce18a 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -2084,7 +2084,6 @@ static void subflow_ulp_clone(const struct request_so= ck *req, new_ctx->request_bkup =3D subflow_req->request_bkup; WRITE_ONCE(new_ctx->remote_id, subflow_req->remote_id); new_ctx->token =3D subflow_req->token; - new_ctx->thmac =3D subflow_req->thmac; =20 /* the subflow req id is valid, fetched via subflow_check_req() * and subflow_token_join_request() --=20 2.53.0 From nobody Sat Sep 26 12:28:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1262D47AF65 for ; Tue, 18 Aug 2026 17:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075745; cv=none; b=pOwPzAxgVdy/tKVPOaN3Wp1qjVMPvBkulzD1H1cs59T85PjcISa9GULQODGBOaAfS/ftygC8M+NV32R9K/n+FfIkGNRdavyvHqV8bMtCYXMX+TknytLkvFyNe36nSwwmo4Fagae5877+qskJkVnn/w0PrhEb26J6OCYFaI+r3UE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787075745; c=relaxed/simple; bh=qxRROWwQ8oc0NuQDC9w0xnYA4H0C9AKTQ5OiLXrfYzA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Es+jpbqDEChuqv/2vmhpLSaLVNyky1TollFyBnHj/qjX7GFNxsG5XCqN8kxrVkviZCYO5IxgWY9rZS2nhuztLj6wR/m7klkBziQ8nQlnlSMyfjBHQuRomDvQXiXW8xe7O8bRASP1oX/1tufiH7l5xUPP31XcFiyzcHRXKv2T8TE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=honBLWvb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="honBLWvb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E90E1F00A3D; Tue, 18 Aug 2026 17:55:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787075743; bh=lzaPrvpSMllT3wMTxBSlDgZsDrvZp4pmQbvozGfdawc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=honBLWvbiF7EgZygHONr7NkpGii5qVzZpusz6eALe7ez+mkzh1BjMMunDBzU+QzE2 idmXi1WHrTS+FreBFuGV1z3dWo4ysq0PITwcRhaaUL9mz0SdTPfDI71GSSr8a3ma2Z +6Mq/lrRyLKRXs+9HY3rVW8Fe5etuUCoNHHJ+2JnV/hmLxcqsDpjxViH1OaDSmIjSp dJReAIp3sUrtOInoZXTKHjCVprEA3wlWkPnSG/Vwu8Hu1masEYtVF+LcdHBGYPiKkP oTbCJiyUrANtPsX3GLpflnu1TGEIU4Qj65TPg1+DTTShOJNeyGrSMfPygACO4QNg4N 6QlBFOXO8ZDMQ== From: "Matthieu Baerts (NGI0)" Date: Tue, 18 Aug 2026 19:55:27 +0200 Subject: [PATCH next mptcp-net 3/3] mptcp: remove thmac from subflow ctx Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260818-mptcp-cook-reqb-v1-3-052dea9a7f20@kernel.org> References: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> In-Reply-To: <20260818-mptcp-cook-reqb-v1-0-052dea9a7f20@kernel.org> To: MPTCP Linux Cc: "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2766; i=matttbe@kernel.org; h=from:subject:message-id; bh=qxRROWwQ8oc0NuQDC9w0xnYA4H0C9AKTQ5OiLXrfYzA=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJa5syRWBqWUMDWuiqFz6gsxrHu5hbbcvd7U47HK/68d 6TvdM6VjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgIkEazAyfLvBN/PVEu+OQ4v1 w+XYPO7M1d+kUtbVIxR3vVp07YlpTxkZ5lx5dEPnlfUh5zwj5gKvZNGXsfecC7cy6RfNexv73Ni FGQA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 This entry is only used in subflow_finish_connect(). Instead, use the original value from mp_opt, and pass it to subflow_thmac_valid() to do the validation with the given truncated hmac. While at it, rename the variables in subflow_thmac_valid() to avoid confusions about the received one vs the expected one. Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.h | 1 - net/mptcp/subflow.c | 18 +++++++++--------- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 7e168e450fb0..d414065d1966 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -592,7 +592,6 @@ struct mptcp_subflow_context { bool fully_established; /* path validated */ u32 lent_mem_frag; u32 remote_nonce; - u64 thmac; u32 local_nonce; u32 remote_token; union { diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 01db7edce18a..2d7ccb01d234 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -408,20 +408,21 @@ static struct dst_entry *subflow_v6_route_req(const s= truct sock *sk, #endif =20 /* validate received truncated hmac and create hmac for third ACK */ -static bool subflow_thmac_valid(struct mptcp_subflow_context *subflow) +static bool subflow_thmac_valid(struct mptcp_subflow_context *subflow, + u64 thmac) { u8 hmac[SHA256_DIGEST_SIZE]; - u64 thmac; + u64 expected_thmac; =20 subflow_generate_hmac(subflow->remote_key, subflow->local_key, subflow->remote_nonce, subflow->local_nonce, hmac); =20 - thmac =3D get_unaligned_be64(hmac); - pr_debug("subflow=3D%p, token=3D%u, thmac=3D%llu, subflow->thmac=3D%llu\n= ", - subflow, subflow->token, thmac, subflow->thmac); + expected_thmac =3D get_unaligned_be64(hmac); + pr_debug("subflow=3D%p, token=3D%u, expected_thmac=3D%llu, thmac=3D%llu\n= ", + subflow, subflow->token, expected_thmac, thmac); =20 - return thmac =3D=3D subflow->thmac; + return expected_thmac =3D=3D thmac; } =20 void mptcp_subflow_reset(struct sock *ssk) @@ -571,14 +572,13 @@ static void subflow_finish_connect(struct sock *sk, c= onst struct sk_buff *skb) } =20 subflow->backup =3D mp_opt.backup; - subflow->thmac =3D mp_opt.thmac; subflow->remote_nonce =3D mp_opt.nonce; WRITE_ONCE(subflow->remote_id, mp_opt.join_id); pr_debug("subflow=3D%p, thmac=3D%llu, remote_nonce=3D%u backup=3D%d\n", - subflow, subflow->thmac, subflow->remote_nonce, + subflow, mp_opt.thmac, subflow->remote_nonce, subflow->backup); =20 - if (!subflow_thmac_valid(subflow)) { + if (!subflow_thmac_valid(subflow, mp_opt.thmac)) { MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKMAC); subflow->reset_reason =3D MPTCP_RST_EMPTCP; goto do_reset; --=20 2.53.0