From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDF2446D09D; Mon, 24 Aug 2026 16:48:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590127; cv=none; b=Blhy4xtlBLy/YLcMb8t5zCR/LPz6u65+PLDDpeC/bpMUNEl/8ZM+VBjuk6s8gWJZx6IKV1X+xcsX0Ynh9r1sXiqrmLX15WB2LnQh5ljFPYHK3A6yVf5pp6c0lHF3+cPvDuKPnNIq+1jryzZAolZC8Gh+gN/JVd0jxA242j9YTsg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590127; c=relaxed/simple; bh=lGgTHG2ZKEPZWmH7Q6U/4MSgDPOsDPE5Cb4PbcyuAZA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JOKNovjFoSaHW7c/rTXDir2D2DJ98LeuOp8JFJjbgz7Ufheyp3sY1JQStyG7PNd2jVI0tJDarCcJLaIgVA7QB4Ad+2oO4G5bvQ2mp5Euwh44pvd0LFz3JF5w95Mfpe88STQWfpynUuE1Hr4bWQ+fIl5lxfvoh95DeVYNT9FWdiM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aOTcdwTB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aOTcdwTB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A26EC1F00A3A; Mon, 24 Aug 2026 16:48:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590125; bh=/OB3yD8YAWHEh42zk3dmZQtCDJh8aZqs6rUdBIApURs=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=aOTcdwTBm2O4d8Gh0CpHK5KlkCrjxHBAJO022aPHlJ+bwkPlPhqZSO6T2PkeOLFMp sJ8wjxCHc2bftd/LK4G7HvUyUKmvos5Q6sST/J94+aXEYWC/1mxCNC3i9dMuln68XF n1deSidvlIzaNlY2NNF8CHPBSCl9WBO+RE38uvBT5wleWMWztGD+9UaoV1lzjF8hvo IMUU+XpQdp+9DTywh2p3nF6XITZiDMop6xs6KexxS4lcE2jYc5lwu0tlKrjvX7VVpr N4+Vhmo0nAei9w4Cu8HJXtsJUN/6JRSdyiZ3TMwxD3/u55JBpIH/PxdwENJwNSImS5 x0rV/3wXZDxmA== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:21 +0200 Subject: [PATCH net 01/14] mptcp: do not reschedule the RTX timer for fallback sockets Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-1-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2484; i=matttbe@kernel.org; h=from:subject:message-id; bh=li4fJ4c7IBN9TnNAIhpMPUAd5KkV635EL4tWRzXLfIY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Su9Fey4MNhUtZHnVcLzT+/l2TZWz98Llpjp/lA/f2 cOZUL+zo5SFQYyLQVZMkUW6LTJ/5vMq3hIvPwuYOaxMIEMYuDgFYCLnwxgZzk+XWnH38rNf/r7t P4NWTk72uMFZWnxQOnVzTHNrZKXTZUaGP073XNeGzHPkS6+cdqNyxp76D9lptXrL7N9eezPX8+V RbgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni On fallback socket the retrans timer is a quite convoluted no-op, but currently nothing prevents the MPTCP core to keep rescheduling it. Additionally gate RTX timer reset to the msk not being fallen back to TCP yet. To avoid adding multiple tests in fast-path, use a new flags bit for such condition. Fixes: b51f9b80c032 ("mptcp: introduce MPTCP retransmission timer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 11 ++++++++--- net/mptcp/protocol.h | 1 + 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index b474d03620a7..23dde0b7144b 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -95,6 +95,7 @@ bool __mptcp_try_fallback(struct mptcp_sock *msk, int fb_= mib) =20 msk->allow_subflows =3D false; set_bit(MPTCP_FALLBACK_DONE, &msk->flags); + set_bit(MPTCP_RTX_DISABLED, &msk->flags); __MPTCP_INC_STATS(net, fb_mib); spin_unlock_bh(&msk->fallback_lock); return true; @@ -1084,13 +1085,14 @@ static bool mptcp_rtx_timer_pending(struct sock *sk) =20 static void mptcp_reset_rtx_timer(struct sock *sk) { + struct mptcp_sock *msk =3D mptcp_sk(sk); unsigned long tout; =20 - /* prevent rescheduling on close */ - if (unlikely(inet_sk_state_load(sk) =3D=3D TCP_CLOSE)) + /* Prevent rescheduling on close and in case of fallback. */ + if (test_bit(MPTCP_RTX_DISABLED, &msk->flags)) return; =20 - tout =3D mptcp_sk(sk)->timer_ival; + tout =3D msk->timer_ival; sk_reset_timer(sk, &sk->mptcp_retransmit_timer, jiffies + tout); } =20 @@ -3324,6 +3326,9 @@ void mptcp_set_state(struct sock *sk, int state) * transition from TCP_SYN_RECV to TCP_CLOSE_WAIT. */ break; + case TCP_CLOSE: + set_bit(MPTCP_RTX_DISABLED, &mptcp_sk(sk)->flags); + fallthrough; default: if (oldstate =3D=3D TCP_ESTABLISHED || oldstate =3D=3D TCP_CLOSE_WAIT) MPTCP_DEC_STATS(sock_net(sk), MPTCP_MIB_CURRESTAB); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 06a107d4e839..6c00a80344f9 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -116,6 +116,7 @@ #define MPTCP_WORK_RTX 1 #define MPTCP_FALLBACK_DONE 2 #define MPTCP_WORK_CLOSE_SUBFLOW 3 +#define MPTCP_RTX_DISABLED 4 =20 /* MPTCP socket release cb flags */ #define MPTCP_PUSH_PENDING 1 --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B3EF340A6F; Mon, 24 Aug 2026 16:48:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590131; cv=none; b=WOPrA3oYZPkE1QQiWPixvJv7luQlvPCO3HwUGUoBlYHLR51f0l9k3VfNhhlAcqzSkiYfg7wpj7k1zK6feq0tE6t0NnqNYjodlYgp710F1EFlx50TQzBhb3yYmpa9CdGeggQ0IkhyAhQ1I1yd4cI7iAjUEWYHuWPP2lLqsQ5hlps= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590131; c=relaxed/simple; bh=xBPNGBnE67jDLZdPm+a09DaSqatW6I+IsFPkH1rSYog=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XntI7+O7kag4Y6LkPz9PQr/gdZ4dIMLuR55iSRnwtoHg0uAKJVhO8YIiNXPDEqJGGs2sdcooCWJ7CJYMMIY6By475EvsxueG8InXOQgR9jgkbKbSdkuKAv6f8CrrgYZP3JOHC+DzlnF4uarzRkPUEt68mumyeIiEqB2nDqIhik8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hD6CH+PQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hD6CH+PQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 161EF1F000E9; Mon, 24 Aug 2026 16:48:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590128; bh=niL7XK/Zy0n//FoXtfYiEkEZnHtpBCUQQY6mZf43iUo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=hD6CH+PQpYZz9OTP3wnCavbiOS74wO2/DX3vKegvOs/PoHHyFYMR+4qMhv/hOHns+ m+Z6YZqJKKOklOjxCDFqfU8BJS7iLxAOWgdEy+A4+QKbmEM1bZgtG4HI8BrdkBA19Z kO7wkbf1FlOAzvCrz7h1b5LBZOrWhRDr0QAnFySi80STISP+ouAmk3kG9taPSvWNFS vK/4tzS6U6TnzW+do+9ddwlm8ixiAIRmSEpmJEh08cPVR0U8Acj//IJy+HjyOuvx6p w7c841yTiuCU4DpzwjkMkhJqhx3eTojPom5wYfNibArqlh0bL5zlBVbWfEDQwzybkd AUzuSnALzjl1A== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:22 +0200 Subject: [PATCH net 02/14] mptcp: subflow: no need to copy thmac during ulp_clone Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-2-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Florian Westphal X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1277; i=matttbe@kernel.org; h=from:subject:message-id; bh=xBPNGBnE67jDLZdPm+a09DaSqatW6I+IsFPkH1rSYog=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Su/tW8zTZdVeH7tz9kVRuVTxJoZa+8cvlTzbluo9K l029aZiRykLgxgXg6yYIot0W2T+zOdVvCVefhYwc1iZQIYwcHEKwEQmLWdkmHOoPepctud1NeVL 914JMVtuuun8lmGrmNZ1t7KcqY7n1zEyfElefNm1K8TCRM6xQ+fDg9/3hPf7TjS/nVPoez/h8fF zTAA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 'thmac' is not used after that point. Indeed, subflow_ulp_clone() is called when the request on the passive side is over, so when the truncated HMAC is no longer needed. Note that in case of SYN cookies, thmac will not be initialised. So better to remove it to avoid a warning from debug tools like KMSAN for reading uninitialised data. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Florian Westphal Note: Peter Krystad's email address is bouncing. --- net/mptcp/subflow.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index af81ad5e699d..01db7edce18a 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -2084,7 +2084,6 @@ static void subflow_ulp_clone(const struct request_so= ck *req, new_ctx->request_bkup =3D subflow_req->request_bkup; WRITE_ONCE(new_ctx->remote_id, subflow_req->remote_id); new_ctx->token =3D subflow_req->token; - new_ctx->thmac =3D subflow_req->thmac; =20 /* the subflow req id is valid, fetched via subflow_check_req() * and subflow_token_join_request() --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3268837702B; Mon, 24 Aug 2026 16:48:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590132; cv=none; b=m+uBqrKqtSzcK1ng4SdohU+rPvV2klbz4mdE0Jrp0uxi40/By5u6Qni3tcI1M03QKDk6PlJrGhPJHk8mhdxh/Gtl9D3Bzyrn35hnQdmgHVltU3vQ5dQRjqcXtH5fwWsYWFNkYELbleM83fvCRO+aoU32ZUBqpJFwl+sGA9MaHME= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590132; c=relaxed/simple; bh=wKN+6HtMik/nWJg73DgY3roMm91PRy1tMx2HIKB+Wxc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UTr/5JO1zkjTtJS+CDGYO/b5HYwVQS+5W6KKVHwVuM5qE5GmHrkUhyCYfI3cNC8+qzm7YyKaWB7eb8owet6dmX4RSCj48nHwETfV9Ahg8JY/KR5lWSGehF1/695L3mhoaOWj6tAZvrQznljj8PxA16MjmlCBvwtIAlvIdGu9cMI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=EJI8w3is; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="EJI8w3is" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4EEE1F00AC4; Mon, 24 Aug 2026 16:48:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590130; bh=bBBJJ3m4Mj8vD71vixgZgb7Rhng8eDoMplK1Hf1HuJU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=EJI8w3isn9ISDzsqMubCrPh4vNhVVPLccgkH8Dn6rzsMmir4PshjQufSfMKbu5Qpk vV3v+Pu+3VHiFz42JkENk1aUrpNfY6dl8YO8ado/ZPt8gLpQlaD4Bnb1c3clWaFBw2 hZvNxg4snaJPqkswjM2x457eJQXNHw3gAXBitcCcinQyNjNZ170IQvsaRukmdQWNhz kg9rPJRtixskUN88kzwUeNbbKcO4l9EjIjACkaBu3wG/KgAybRwsZNDtQBZ8G6tX9b ejM80XyYFEtMfkoz6GWkCOp/TPJQ/9V3BWxgx7RWkV/q5IsNTW3omPafkNJG35waOx LqcDwREus9kxA== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:23 +0200 Subject: [PATCH net 03/14] mptcp: syncookies: remember the request backup flag Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-3-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Florian Westphal X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1782; i=matttbe@kernel.org; h=from:subject:message-id; bh=wKN+6HtMik/nWJg73DgY3roMm91PRy1tMx2HIKB+Wxc=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Su8HztZd35QjslS3+srX0w9PsYtEdhlt2bPy//5/3 /iep/Tu6ShlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZhIzk2Gfxp3ItTfsCqLPmcN MJvSudeV9dRXVRuRpZ6Khy9fPcs1Q5uRYeUryZVWXqvT1BoV7bQ7T8csSLZ8+3HSD6Y/Ya+51nY rMQEA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Instead of using an uninitialised bit when copying the info in subflow_ulp_clone(). To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both. Fixes: 9466a1ccebbe ("mptcp: enable JOIN requests even if cookies are in us= e") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Florian Westphal Note: Peter Krystad's email address is bouncing. --- net/mptcp/syncookies.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mptcp/syncookies.c b/net/mptcp/syncookies.c index b5cac5701122..9474706641c1 100644 --- a/net/mptcp/syncookies.c +++ b/net/mptcp/syncookies.c @@ -26,7 +26,8 @@ struct join_entry { u32 local_nonce; u8 join_id; u8 local_id; - u8 backup; + u8 backup:1, + request_bkup:1; u8 valid; }; =20 @@ -63,6 +64,7 @@ static void mptcp_join_store_state(struct join_entry *ent= ry, entry->remote_nonce =3D subflow_req->remote_nonce; entry->local_nonce =3D subflow_req->local_nonce; entry->backup =3D subflow_req->backup; + entry->request_bkup =3D subflow_req->request_bkup; entry->join_id =3D subflow_req->remote_id; entry->local_id =3D subflow_req->local_id; entry->valid =3D 1; @@ -117,6 +119,7 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_su= bflow_request_sock *subfl subflow_req->remote_nonce =3D e->remote_nonce; subflow_req->local_nonce =3D e->local_nonce; subflow_req->backup =3D e->backup; + subflow_req->request_bkup =3D e->request_bkup; subflow_req->remote_id =3D e->join_id; subflow_req->local_id =3D e->local_id; subflow_req->token =3D e->token; --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 205D045A28E; Mon, 24 Aug 2026 16:48:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590143; cv=none; b=F7f+LOvSq8FNSzY5kqxSLCFQ4C70JyXNG8ZrbQ13D+csN1Js2G/ERont4jpgD7cgvpw0h7Ayv9xBnjGdQWOBQ8cmpmjbMdOUih7htgTwfuaMHzb7QjfuJ5pZeQ3phe1SZ259XbexLw5ioY86hID05/WXhyH+hPWkKJg4PFz3gto= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590143; c=relaxed/simple; bh=lVJenzjXjdfsZSScnVX8pRJkzdkpjcMIvI0kuS8t/hs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=dJm+0R/r3jc11ng61Nmg2efb1Pte98zU1OsLT9+16AFjxP/byJv6cKbOLIafHYvwdePIwN3+WgQMXRJXrFNAcyp1m9njwDt4i9rx90wgYiWRUgDthlhW7gyRvC6O6e1Fjpg3c9u+EprwszV1JRECFEadiBQ3CA3Hgc3th+H52T8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=C9gfpBt3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="C9gfpBt3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F8D51F00A3A; Mon, 24 Aug 2026 16:48:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590133; bh=MVBCOcAhhkTgizAJL291DY8sdaXrCYJIDJVdWAVd6zQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=C9gfpBt3bmxNlhDiJWi5U0NSzFLhYJr4DqwjqhKwVOzpbeLgmL8ePaAhbg/NPsv3k I08VKooImJo/Q6Bk45o4XiMQgdkPGBDFzKbaVbETo2OiG7zolZiAffNJ/ZSKYsjLK1 ybPlLZOjxA7GNOiG8CVSiRKELtwhCMwXrqaG3H9ujrA+8dxfqkMYr9RHo7QC6NGkRr U1AZZqtt2A8NH8AyVNupQoxy/LmezG6UyzdC8e8MkR83xOI83aGxUZeYGmB3AiL1uZ vi4pyk1R3+43XUj07BINCblXTxN0Dx8dT2xbiDV34m0RyhKcB/4+tZsvt2r35nOtyu 7Tsccu3MevSzQ== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:24 +0200 Subject: [PATCH net 04/14] mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-4-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Kalpan Jani , stable@vger.kernel.org, syzbot+55c2a5c871441261ed14@syzkaller.appspotmail.com, Tao Cui X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2586; i=matttbe@kernel.org; h=from:subject:message-id; bh=EYl0Mkm8u/WrEKNWPSNYFWjt9rLGKIDrZDnJvIhuJXo=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Su+v+nlm29X3Pj3Lt+QIfF/8wKK89YrwrYWxyRWrs z0vziq601HKwiDGxSArpsgi3RaZP/N5FW+Jl58FzBxWJpAhDFycAjCRmSsYGXo80wzPflh/hfvE 1tTMqz2Cr0Ot9v+Y6N6YUsBa3PXvyBNGhgU973PjVSM7llSs3rBsWc2j9CdcrnduMSwPqj9ufah Iiw0A X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Kalpan Jani The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not tear down pending announcements, unlike the non-zero id path. When the PM later reselects id 0 after adding another signal endpoint, it finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel()) in mptcp_pm_alloc_anno_list(). Root cause: asymmetry between removal paths. - Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls mptcp_pm_remove_anno_addr() to clean up. - Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely. Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove() and decrement add_addr_signaled before queuing the RM_ADDR. Subtle detail: signal endpoints are stored in anno_list with port 0, but msk_local carries the connection's local port. mptcp_pm_announced_remove() uses use_port=3Dtrue for comparison, so clear the port before the lookup. Fixes: 740d798e8767 ("mptcp: remove id 0 address") Cc: stable@vger.kernel.org Reported-by: syzbot+55c2a5c871441261ed14@syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/620 Suggested-by: Tao Cui Signed-off-by: Kalpan Jani Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm_kernel.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index 424f1a7f9248..1a7750813235 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c @@ -1137,6 +1137,8 @@ static int mptcp_nl_remove_id_zero_address(struct net= *net, while ((msk =3D mptcp_token_iter_next(net, &s_slot, &s_num)) !=3D NULL) { struct sock *sk =3D (struct sock *)msk; struct mptcp_addr_info msk_local; + struct mptcp_addr_info anno_addr; + bool announced; =20 if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk)) goto next; @@ -1146,7 +1148,13 @@ static int mptcp_nl_remove_id_zero_address(struct ne= t *net, goto next; =20 lock_sock(sk); + /* Drop a possibly pending ADD_ADDR for this address. */ + anno_addr =3D msk_local; + anno_addr.port =3D 0; + announced =3D mptcp_pm_announced_remove(msk, &anno_addr); spin_lock_bh(&msk->pm.lock); + if (announced) + msk->pm.add_addr_signaled--; mptcp_pm_remove_addr(msk, &list); mptcp_pm_rm_subflow(msk, &list); __mark_subflow_endp_available(msk, 0); --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4411446AEDD; Mon, 24 Aug 2026 16:48:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590137; cv=none; b=ryhZKc55e8DiKkkSXhmbnSbhXFDYf1L66Jv134/K3ZgJeps8snDBYe3Je/smZVQW/sHWhYUn4zzZUWVuPv5QDg/xT9Pa69V3kODpNAlIEMjIdjM+paE/+GlYeKMpewumHicY9VQ9RdvCZ3YLlnvdYUsFneNL03Rvj/VttBKANZk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590137; c=relaxed/simple; bh=z7wtoyOwpjfF7//Agdkguz3+gKqzGcxFhF/6OCf4C8w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uRVpXAojYOmZHolkR9/dOLajA8WhOuXKvp85q2hDYIaQK+eGGaGfpn0jxg2N7mGMQzWSyCds+PFSU1qIZKzC9W4qLDu+mOKHRgrWW4pW7c1a7+fjmFatmCGfcDrkcqBO4PSFdHWEmua4wDbI/qdsXLY8lNInyCivkH9C7XKB5t0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NUY0f3iZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NUY0f3iZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 262B11F00A3D; Mon, 24 Aug 2026 16:48:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590136; bh=malZ4u2amF3l75ye9yerrprmL8w3KICVfFH7XuWia5A=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=NUY0f3iZirAoE9kGSoyyIFG1IxmbkW7aaL9JiCRXUfP73GtCrICamtFwFjyaEce16 cTN3yDYD1sidlrIaLAsrCCWQp/5OW7BqV8gZdxMig0d7nkdv7UiPIAQf3Tgv/ILiSk ZgaaN89Ai/+06ZK5SH6fCfodCvWVn3HlL6uOSW8p0N5pTyIK2t7sToRlNnSzGvRxVO eRnZtKLTN9GtCvzU3lTmW4jMQxoQVKe9TgQRf773xc9rrFVQYuH2Vj4oSZoK7egZNa TmhiqZj4JQWTg5aiq7S1QhY2vHs6sV4DWVS/KqRHKNXzKAUAcODykoiZ39bDaOwsCM NTU/pG146Thmw== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:25 +0200 Subject: [PATCH net 05/14] mptcp: options: handle MPC data + csum reqd + no csum Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-5-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2240; i=matttbe@kernel.org; h=from:subject:message-id; bh=z7wtoyOwpjfF7//Agdkguz3+gKqzGcxFhF/6OCf4C8w=; b=kA0DAAoWfCLwwvNHCpcByyZiAGqMdeCjWz3yWXw7D/oy189dbZ3kwc2pLwHVBymxFxhuloEBf oh1BAAWCgAdFiEEG4ZZb5nneg10Sk44fCLwwvNHCpcFAmqMdeAACgkQfCLwwvNHCpcUsgEAgnBw FWo6aNwd0XhThIhCXjmhsD91XpJtYogIuos+2KoBAKXVk/7Orca7/Z1va12lpoKdIDj+BMRv4sq H9VCNQ/gA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Before this modification, a remote peer could send an MP_CAPABLE with data, with the checksum flag set, but without adding the actual 2 bytes of checksum. As a result, uninitialised bytes could be used for the 'csum' field. That was not a critical issue, because this 'csum' field is only used to compare with the expected one, if previously negotiated in the 3WHS. Worst case, the checksum is likely wrong, a fallback is done without a reject if the negotiation was done earlier. That's OK. Yet, better to take the expected path with this case: only look at the checksum flag for MP_CAPABLEs not carrying a data-len. Such packet can be seen as a 3rd or 4th ACK. The RFC8684 mentions [1] that the 3rd packet should have the checksum flag set. When an MPC + ACK contains data, the checksum flag is redundant with the checksum field. It is not clear what should be done for the 4th ACK, nor if the flag has to be set if the checksum field is set. Therefore, it seems fine to only look at the presence of the checksum field, not to break the interaction with stacks that were not setting both. Fixes: 208e8f66926c ("mptcp: receive checksum for MP_CAPABLE with data") Cc: stable@vger.kernel.org Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.1-23 [1] Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260803-net-mp= tcp-misc-fixes-7-2-rc6-v2-0-b8f496d71664%40kernel.org?part=3D1 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index b8318e030138..92f27b9e087a 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -93,7 +93,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, * In other words, the only way for checksums not to be used * is if both hosts in their SYNs set A=3D0." */ - if (flags & MPTCP_CAP_CHECKSUM_REQD) + if ((flags & MPTCP_CAP_CHECKSUM_REQD) && + opsize < TCPOLEN_MPTCP_MPC_ACK_DATA) mp_opt->suboptions |=3D OPTION_MPTCP_CSUMREQD; =20 mp_opt->deny_join_id0 =3D !!(flags & MPTCP_CAP_DENY_JOIN_ID0); --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B96046C847; Mon, 24 Aug 2026 16:48:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590140; cv=none; b=ireBC3r0FQEFmF6ha6XRqK69eHOwWfqRjXUh/LdN56BKH0CPjZ5WDIQ9Ubtv5LSeHpkD5tLZP4kp9HggIr9GIvJPNkKSucU419I6son14kTsyx4ZaFS97bcwErYG4EOBUc6VOCcKhHegrVjj9RSWl/0UOhwl7UT3r8toKlDCoqw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590140; c=relaxed/simple; bh=nclcvAWM+rxAFCIypV1GWTUlmTEbYqtUNG34WGkugFI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=abtA46oDK/J/1M2BiG/9bg156wxtpMbCRQTfEn9+E8DcdxT5dSlogFW9rcIpLCBs0jg6qH4RUNJXnF+J+p7axHqnCqd7+FGRonYMUFMnJ1hrYG3yO1PG86X6aD5MSCNDdR4RodG5isWobLmCEFQ+xMltl8KtPkmWjV83RSQti8s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CMYkNJdU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CMYkNJdU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D6B71F00A3E; Mon, 24 Aug 2026 16:48:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590139; bh=DsadEfKHony/UW+E+mkIQ6tS46I5w+msFRIBJzgL6A4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=CMYkNJdURsvpvYA/w5PSLua8T+O/xNjcdtXUL+D3CUxxq5naMd2N/fkTy+hrgvUhR JPscYEhvQazF0NQym2fPqP1H1AYftdINlrasi4IV+bUH0LytUMRcnJeNhPHJ09tyzB 7f+b34uGDyhQEkV+JxS2ScUlVhjZlE7J75bQxPxNCe855GxamJaeuBc/pjeoWijSY2 32y+IUsAZsnLvO3DClV4ynFLgSwlCAlgCmcfm5DZ4LQbkHv15YdNuuOn5KdywdE1hS sr/iq223X+1eTXD04aReA3dvc9AtUXmWWpjaKvvzbcPZ2n2bL4XN8beNIOV/2sdDFQ /f3gDjjXfdR1w== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:26 +0200 Subject: [PATCH net 06/14] selftests: mptcp: fix an UAF in mptcp_connect.c Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-6-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Gang Yan , stable@vger.kernel.org, Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1876; i=matttbe@kernel.org; h=from:subject:message-id; bh=VwiIPbnwYQK4JDHlSn3SFDG8QpIppPrQ9GfT9gtOoC0=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sh8u9+VecGaR3Gq3mcZrRKZfeBPLf2fByo1/FXwNT qyr0Jef0FHKwiDGxSArpsgi3RaZP/N5FW+Jl58FzBxWJpAhDFycAjCRpwsZ/kqflLM+8U9td94C I29dt20vPZRmhOjV/DcV0+t3dugSPsTI0Dtn5kbf9p4Tzx/un/16QnV3/PXv64NPHeYwWfG2aO2 3cmYA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Gang Yan At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)', the 'peer' pointer (which points into 'addr') remains. Later, the main loop uses this peer pointer for reconnection attempts. If the memory has been freed and reused, the address data could be overwritten, resulting in an invalid remote address. This patch keeps the addrinfo list allocated for the whole process lifetime so "peer" remains valid across reconnects; the memory will be released at exit() time. Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_connect.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/test= ing/selftests/net/mptcp/mptcp_connect.c index ea4cb6c1bd5e..178d98d91fea 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_connect.c +++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c @@ -381,6 +381,9 @@ static int sock_connect_mptcp(const char * const remote= addr, =20 hints.ai_family =3D pf; =20 + /* Keep the resolved address alive for the whole execution: it is + * used again when reconnecting, and will be released at exit time. + */ xgetaddrinfo(remoteaddr, port, &hints, &addr); for (a =3D addr; a; a =3D a->ai_next) { sock =3D socket(a->ai_family, a->ai_socktype, proto); @@ -421,7 +424,6 @@ static int sock_connect_mptcp(const char * const remote= addr, sock =3D -1; } =20 - freeaddrinfo(addr); if (sock !=3D -1) SOCK_TEST_TCPULP(sock, proto); return sock; --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BA8046C4AA; Mon, 24 Aug 2026 16:49:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590143; cv=none; b=UAFPuEh5Jhw0I12mr/vnIZUS24QJ0//6XfFogI+M2HWKOjE+ibbB4f7VjUYTObYoLKI7AnGc0DjResPoOfwPR0WE864qq8txs98APlqtKXst27lnraIslT2e9hwQr+enEenxZRNPHlETE/CaJfChQdMGVP6HMVs25g1MhbLflBA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590143; c=relaxed/simple; bh=+FBPAQNeCbh4Mvnw/tNWB3LSVLgglpExjCKKNXa4l3M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=h0WM3JHKxcJVCX6SJQ4sczGdWVvPmMHhxToY4/skV19NKCCTnWBr6N9dSyT77mhvbzQ8S3tfVaYM5baHNHrVmwC9AIVvXdOgjTs7SBJtaatyVU2oFu3sYM/vMRrlleQFMvZr8ZuRwZtsakSoOp2KX2sj7k1wLDAXbZizTA2o6zo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ctNuyL8p; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ctNuyL8p" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75F071F00ACA; Mon, 24 Aug 2026 16:48:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590141; bh=Ry9Eu4FQ67wro1NXnJ+dB+8O1f5fq9fWbkVH9KdHvoM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ctNuyL8pexlNoEW9NrePYa99u2hPJB+b2LRCalcemogKQKOTP2uOjHaZSjICZoSBu TK7evuoppmk10oWnavdukyqoA8nnrkSWocDqrpq5qoR6mHC3nPzIEhkTCNLpO36Zfi oV48w7anzyJDFN9IRw1MLznFsxFoLtKnyAKNu9d086Zn4LYsx8sMPQ5Wm0M6sr0TNH 0NYqfMfx59FzBJ31+4lREPUEPLy7QR8q2Mcvjk3XnNCbE2j5YEzdJE6AdNYZU4734h ODcKfFUNyo7/jye38t7j9bQVpcvby+B9a43LaHWFpWDXkzV19vlTMppg79D0pWqpip 1mSB1fvNQNTjg== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:27 +0200 Subject: [PATCH net 07/14] mptcp: pm: userspace: fix address ID overflow Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-7-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Qing Luo , stable@vger.kernel.org, Kishen Maloor X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2431; i=matttbe@kernel.org; h=from:subject:message-id; bh=veYo+tqcZdu23R8BrIYMlRY2bcPvxR2NXQ7J8ZSw5Xs=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sh+uYHa2XnXxo2Coo7pOpF2j817mDWFC6RHFmYWlY p0PEwI6SlkYxLgYZMUUWaTbIvNnPq/iLfHys4CZw8oEMoSBi1MAJiI5m5Hhr2StpqTWAdcFTXPr D9j8PfFtcdYsTYMJ73bFymwSSLD+wfBPJ2ap2taweTobNCarFQpofFuXc+XL4gtdB05adF9acUe SHwA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Qing Luo When all MPTCP address IDs (1-255) are exhausted in the userspace PM, find_next_zero_bit() returns MPTCP_PM_MAX_ADDR_ID + 1 (256). This value overflows when stored in the u8 field e->addr.id, resulting in ID 0 being stored and the entry being incorrectly added to the list. ID 0 is reserved for the initial connection in MPTCP, so this overflow can cause address conflicts. Note: the in-kernel PM already has an 'endpoints =3D=3D MPTCP_PM_MAX_ADDR_I= D' check in mptcp_pm_nl_append_new_local_addr() that returns -ERANGE before reaching find_next_zero_bit(), preventing this overflow. So this fix only addresses the userspace PM path. Check the find_next_zero_bit() result against MPTCP_PM_MAX_ADDR_ID and return -ENOSPC if all IDs are truly exhausted. Move the ID allocation check before the memory allocation so that the error path does not need to free the allocated entry. Fixes: 4638de5aefe5 ("mptcp: handle local addrs announced by userspace PMs") Cc: stable@vger.kernel.org Assisted-by: LLM:0 Signed-off-by: Qing Luo Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Kishen Maloor --- net/mptcp/pm_userspace.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c index b94fbb483bf9..fab16d953dbf 100644 --- a/net/mptcp/pm_userspace.c +++ b/net/mptcp/pm_userspace.c @@ -69,6 +69,19 @@ static int mptcp_userspace_pm_append_new_local_addr(stru= ct mptcp_sock *msk, } =20 if (!addr_match && !id_match) { + unsigned int id; + + if (!entry->addr.id && needs_id) { + id =3D find_next_zero_bit(id_bitmap, + MPTCP_PM_MAX_ADDR_ID + 1, 1); + if (id > MPTCP_PM_MAX_ADDR_ID) { + ret =3D -ENOSPC; + goto append_err; + } + } else { + id =3D entry->addr.id; + } + /* Memory for the entry is allocated from the * sock option buffer. */ @@ -78,10 +91,7 @@ static int mptcp_userspace_pm_append_new_local_addr(stru= ct mptcp_sock *msk, goto append_err; } =20 - if (!e->addr.id && needs_id) - e->addr.id =3D find_next_zero_bit(id_bitmap, - MPTCP_PM_MAX_ADDR_ID + 1, - 1); + e->addr.id =3D id; list_add_tail_rcu(&e->list, &msk->pm.userspace_pm_local_addr_list); msk->pm.local_addr_used++; ret =3D e->addr.id; --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9857377AB6; Mon, 24 Aug 2026 16:49:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590148; cv=none; b=ZCny0rdh/P17xCDBucf4QzaYJDl49sX6hvIW21EtrFMiVXx4qf1ZowpxBMv/Ez+RMMyYRI0/un3Jh02CpEu9p0YRZYfP4f4ppCrsIn4ppHArOoUEYYCjcaZ6lP0dahvgZBUck3pQn4ELCSD3ZGT4mAvp0JaaS9/VeGPeUMt+fag= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590148; c=relaxed/simple; bh=YFylSvvgBVNDRcVxg7NOMFhIOkuNvjs1mND2rsz75Co=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mvBisR92pcMv/NRFg1Zyn7XoxKMCTtZMzAi4YLrzM6tC8xdtY7xG2Ayldc/0wDZ+CTaFhRKu+VJ7rgBHd8XE8ETKZ+UjfaWiCSSzJXwRHV5SNMQ28R0p61vqH4w2wC6QiXyKIkjPAi+1HqgVxjCZJuluuoiIuePuBwlfQeqhD5A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jJ7VkAi+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jJ7VkAi+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 410D91F000E9; Mon, 24 Aug 2026 16:49:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590144; bh=x6P/eBi6yTWWHYbzFsRgX5z81fY7BIwf7GDF+vIGFhQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=jJ7VkAi+U1JJHwTtxftp9W6OBIeajIcX/nq8YZ2KitSKqZw/1rcuIC6g7UILpRA29 qnWTTQwwmuf2YpXppPvNO0t+fVzs8J9wAe4BlTZMxdlQfkwZMlZKr9VKSm7QNySwMv Rnnrkgb0ylj8yoqDTy2EYK65N4iHjjaohM1obsBtDz0ehIna7bGFo4c50a/tz/YA0i HJ/yUjnj3yoiUNfDPxWMa/2TyMTWbCdFcsgb6IM1EyD6Kiudh/TMUI0WrK9osKY6GR UCFr49c3Ot9loJ4nOp8R0IXDdPkcSw3n8U4TBQlm1cmJPGgkKJ2xXBdHPswdI3FJ4W /guq7wQtOZQ9Q== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:28 +0200 Subject: [PATCH net 08/14] mptcp: pm: reset retrans_time when ADD_ADDR entry is reused Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-8-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Kishen Maloor X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1373; i=matttbe@kernel.org; h=from:subject:message-id; bh=YFylSvvgBVNDRcVxg7NOMFhIOkuNvjs1mND2rsz75Co=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sh+xBcWnTO+19NNpXqF+b+K8yyu53h9SOFLruvnWY wHdydtsO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACYyZz4jw+4HAZ7fze/mfJGZ N8nmzOpb29ecYVF/+Dx3uoVbT+kNvauMDA/9hP8buK14q37ux9YijaIXtzYkO7dN1z759ava/jf /DzMBAA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When an ADD_ADDR entry is reused, the timer is re-armed, because the goal is to re-announce an ADD_ADDR, and eventually retransmit it if needed. In this case, the retransmission counter should be reset as well, so the re-announced address gets its retransmissions back instead of relying on what was left before, and possibly not being able to retransmit it. Fixes: 304ab97f4c7c ("mptcp: allow ADD_ADDR reissuance by userspace PMs") Cc: stable@vger.kernel.org Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260803-net-mptc= p-misc-fixes-7-2-rc6-v2-0-b8f496d71664%40kernel.org?part=3D4 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Kishen Maloor --- net/mptcp/pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 8b68868255c5..b0b71adefb8f 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -462,10 +462,10 @@ bool mptcp_pm_announced_alloc(struct mptcp_sock *msk, =20 add_entry->addr =3D *addr; add_entry->sock =3D msk; - add_entry->retrans_times =3D 0; =20 timer_setup(&add_entry->timer, mptcp_pm_add_addr_timer, 0); reset_timer: + add_entry->retrans_times =3D 0; add_entry->timer_done =3D false; timeout =3D mptcp_adjust_add_addr_timeout(msk); if (timeout) --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C8A445FFB6; Mon, 24 Aug 2026 16:49:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590148; cv=none; b=Zn6uDDuib9MZkzb+8dMNPT/+UIu31twOa3tZo00oEcuupBjySaR54e3+YksnD4i2bkNtcdps2t2yNNU6/eABuLSWwa4/Lgj8ClKDUPCy4Ic6IvOo8oT4cy2lm2bEV8aaen3cP5eyfgTDQkYOJaiI5FLJf+FNuR73W9itKX0mNnM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590148; c=relaxed/simple; bh=ZdI1IRE2SFT4YHEIrJ1kj9oUUOrOqMVgD7VtBYgrs7k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ki7PeM/XBggLKjUXkNuGEgJnSnGh9qYRCgcXMEgITIlZhIefU8qNQYXAdxu4qJn5jmKVMnsHog2nKv1abTG3+V0LWokV2o9aK060w9fyLkSlPg8k9KZQhjOrIiCl5JdgbrOS5GU3xTrOOT5x4rwEVIJJpj/TxI68JCiXuinrns4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Noe2Sp0k; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Noe2Sp0k" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D203A1F00A3A; Mon, 24 Aug 2026 16:49:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590147; bh=nxXK1daVFCLsfOaLTp9/6Q1wtfCLrNjyVmVJsnYVYoc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Noe2Sp0kL7UbbWR5qCZuLU/3x7LdInffzmabiMxJxAawthMvv82Y5bFgiyhzuShmx snS130cDkN1GyWN3zxSfD/3qPl2Dl0P5nqvac4YVLiIK/O4JPmxjGqnOZ4nw2GLzmF 2N9o4BwjHEwOe9R5gF1tZxbcaJIRt5o+PFvaqrVN0WwRYc8tLvSj9NtzO/hYNzRY/G qs7UAQRwqzPIFRxi5HWE8XKeCiX3v+FRwQVtbjHz7jWe3sjQh5obASyUbJjHRgIQjZ qsgBJYaZIXHtyi+oVxGmIZmzfAX7nhYbTMCgVgQpzZmt1kj/nqWBXa13VIWrtcD/Ty lSXmdCFeMLrXA== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:29 +0200 Subject: [PATCH net 09/14] mptcp: remove unneeded READ_ONCE() annotation Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-9-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Gang Yan X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2207; i=matttbe@kernel.org; h=from:subject:message-id; bh=KQW5aTIKF3jtFxKldgeomGqGxKZHGluA+V34pVxNM+4=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sh9XnlQRmiSxV9LOrHbe79PL5nLoqz5bnfq3UlTl7 6y5OTXBHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABN5+46RYduGXbyhPtofJ3LX H133dslvs0VSJyfIz5vl2/6Cjbu+XIuRYcbGhAgt7qQLGUc21n2ubftyQE/uiVfRmdB79afvSyi 7sAIA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The subflow->fully_established flag is always written under the subflow socket lock. Reading such value under the same lock does not require any ONCE annotation. Fixes: 581c8cbfa934 ("mptcp: annotate data-races around subflow->fully_esta= blished") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Gang Yan --- net/mptcp/options.c | 4 ++-- net/mptcp/protocol.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 92f27b9e087a..196a46e7467d 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -530,7 +530,7 @@ static bool mptcp_established_options_mp(struct sock *s= k, struct sk_buff *skb, return false; =20 /* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take = precedence */ - if (READ_ONCE(subflow->fully_established) || snd_data_fin_enable || + if (subflow->fully_established || snd_data_fin_enable || subflow->snd_isn !=3D TCP_SKB_CB(skb)->seq || sk->sk_state !=3D TCP_ESTABLISHED) return false; @@ -981,7 +981,7 @@ static bool check_fully_established(struct mptcp_sock *= msk, struct sock *ssk, /* here we can process OoO, in-window pkts, only in-sequence 4th ack * will make the subflow fully established */ - if (likely(READ_ONCE(subflow->fully_established))) { + if (likely(subflow->fully_established)) { /* on passive sockets, check for 3rd ack retransmission * note that msk is always set by subflow_syn_recv_sock() * for mp_join subflows diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 23dde0b7144b..c7c8bb3b3e00 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3881,7 +3881,7 @@ static void schedule_3rdack_retransmission(struct soc= k *ssk) struct tcp_sock *tp =3D tcp_sk(ssk); unsigned long timeout; =20 - if (READ_ONCE(mptcp_subflow_ctx(ssk)->fully_established)) + if (mptcp_subflow_ctx(ssk)->fully_established) return; =20 /* reschedule with a timeout above RTT, as we must look only for drop */ --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB52946EF65; Mon, 24 Aug 2026 16:49:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590151; cv=none; b=d/smm23ziPpFMUdjaLGGAhK5L2gx7vF493AgeoaRsiNsvkOfX2acGIhjPe/LXOZdP8E7WFMF/wqyNshSLor0KH2uQHx7KdmFWHPYtAEobuBwemS9G/p2hZQFm3tZWl/ejPbRgypRepSVmh0hGGvb0zshmydn1pRVPtYL99tRXI8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590151; c=relaxed/simple; bh=VwiADovx0M3SfhMosDIPq18c1t7jCdFuJKetSuohDbc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=fHdZ5rvqwqO5GUufw89WcprM6BldEfNZLsgvdtQLlDI3/CGzcml3kT88Xb/98qupKP/o/NTyYYjwTyNMF53pFYa0Wb1tlITtx6AENfcd5vKdl/RKFiv0QCE34iAU9pbJC6IqebUAUo4Py/ptuxRxiab9Tnypx7z8/pqUP9WMkjM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fQ2ObGqv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fQ2ObGqv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B72F1F00A3D; Mon, 24 Aug 2026 16:49:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590149; bh=OVO1Lrh+Hiat6g54B8rauSX2MJAQBUJFTOBLlbhcSpQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fQ2ObGqvjo7cZR4H0OxQnLfIQuRh+bpitZWhkdqnAnGuqB1+2Z2Ytz7nD+vPB+Bbu KsdJ3q9bAahd1LV4YCBNtUH/wVOMQzmX0GIRue7BF3WpDf+oQKpTO4uUqwW7BjkSb/ YPs6HGSgAdrSM499qYE9QmWqdjB3urBQB88twB0HZ4ZLa4kcpawVyZ12+dv7Aec+pa HSfOectSYCFxjNf36jh7AITWFaabxRvNvSKa04i2LtsmmJS+fDLcSfWBlScuv35xaK m6FaXE9RmaoYT9xLJp8Q1ezDMs81wH8kl0Tz22Le9Vbf+7OYqVXjhi/EB8oVBaGzGy SgH5OHZ4ispuw== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:30 +0200 Subject: [PATCH net 10/14] selftests: mptcp: lib: dump nstat for the right test Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-10-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1903; i=matttbe@kernel.org; h=from:subject:message-id; bh=VwiADovx0M3SfhMosDIPq18c1t7jCdFuJKetSuohDbc=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sh87nl7XHu1Q23Sk4meEY9cNT52rXvqH+ycqnBfcv C1z62fxjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgInYTGRkeLq09pFQz/Lvtn9P X3wz49jXTfwKZTf5z8bk18dWyEqbhjMyTAkM4uz+XRA2l+XzLD3lAI/+2vW6y51OX0/v+397l/t mXgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 In case of errors, mptcp_lib_pr_nstat is called to dump the nstat counters, but for some tests, it was dumping the counters for all subtests, not just the current one. That's an issue for tests that don't recreate the netns for each subtest, e.g. mptcp_connect.sh. In this case, 'nstat -a' will look at the absolute counters since the creation of the netns, making debugging harder. Instead, it should dump the counters for the current test, by using the history recorded in /tmp/.nstat if available, and not using '-a' which was dumping the absolute values instead of calculating increments. While at it, rename the previous 'hist' variable to 'cache' as it was used to look at the cache, not the nstat history. Fixes: 658e53141780 ("selftests: mptcp: join: dump stats from history") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index 5ef6033775c8..da1da414c30f 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -108,12 +108,14 @@ mptcp_lib_pr_info() { =20 mptcp_lib_pr_nstat() { local ns=3D"${1}" - local hist=3D"/tmp/${ns}.out" + local cache=3D"/tmp/${ns}.out" + local hist=3D"/tmp/${ns}.nstat" =20 - if [ -f "${hist}" ]; then - awk '$2 !=3D 0 { print " "$0 }' "${hist}" + if [ -f "${cache}" ]; then + awk '$2 !=3D 0 { print " "$0 }' "${cache}" else - ip netns exec "${ns}" nstat -as | grep Tcp + NSTAT_HISTORY=3D"${hist}" ip netns exec "${ns}" nstat -s | + grep Tcp fi } =20 --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 992C346F4A3; Mon, 24 Aug 2026 16:49:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590153; cv=none; b=NcuT/2/cI1TTZ9x43Cm+7ZKlyYjkJYKFo1taJ197fHEKIz/z8z/ncy957IG/qp6uK4YxNcqhl8PF+xrIKZHwh3m8xySduIrtZzojqvnHN7DuRt6G5jaWUD7/t5aY3kOxb5BBLyVa/bcDXHpPF32R0vg448PSlMQdd6d0h9zJVag= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590153; c=relaxed/simple; bh=wFmWTAStTX7XmhsLRsns8ZJ1prYglytuM+Wjni22LNU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XTVPWmGX9492i4SkE0/NoJqSsi1CXavgR86ekWBeRqAGN3GWJMT4Oj0L+jSS4CST4XYWBARGyzCWZYX/zya7LHSPe2e1Ez1v4TdBGoKXG5FeUHWsZceqhhV3MlE/UG80oSrRAF1uwyEJMCWS7TeuSffQ8ZN5t5DptFKUBF05k+o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MJvaQGsE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MJvaQGsE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CC181F000E9; Mon, 24 Aug 2026 16:49:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590152; bh=dwAlsNpTCLO14qYMOvaje6gEA6ADvo64fj1m9jk6zjE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=MJvaQGsEqk5Aucv4DqzheTC0dLPIBEx4pVJOYQIkNaxD0zTNMx7tdhQbXtZxt1m/+ Ze0V7lWYFBrH8xKHR0wAkLSLnvRTlLY1ZVg1mvlTNUQRzMu7Hg6wQQwrLJE8wr68e+ BLil4q/PwoyoKXyThdaBfQ+jfcywOuzRMpFhzsPpEq97cQIGYTxvXWHaBvgyns2cqY lxVks2ljBd26M8iSNx68avsdaL0cnSpR1jm/rohLBuoeewQiqBjBlwngqkBil5RrBS rcFAHuWAq2ZpFpZCe5uEh1xoud33CGiXqg5ceCSbqLnJU1+MAPt+xu1pgYARLAgiIt TOFdCTTc7X5TA== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:31 +0200 Subject: [PATCH net 11/14] selftests: mptcp: lib: get counters for the right test Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-11-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2506; i=matttbe@kernel.org; h=from:subject:message-id; bh=wFmWTAStTX7XmhsLRsns8ZJ1prYglytuM+Wjni22LNU=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sp9Uq8emLp9ucfDO2oj5NxqWTdzxco7mIbufxky3G GTvzix+2lHKwiDGxSArpsgi3RaZP/N5FW+Jl58FzBxWJpAhDFycAjCR7v+MDD97XIQe3956xU9r K++i3S86l26eM7Hsn35DUilL7YpfMuIM/8Pa3t0vmBVdteD2wmd5C36rnuD5du/OjKLEdVKG02L Lt/ACAA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When the value for a MIB counter is required, mptcp_lib_get_counter is called. It tries to use the cache, if available. If not it falls back to calling 'nstat' directly by looking at the absolute counters. That's an issue for tests that don't recreate the netns for each subtest. In this case, 'nstat -a' will look at the counters for the netns. Instead, it should look at the increment for the current test, by using the history recorded in /tmp/.nstat, if available, and not using '-a' which was dumping the absolute values. While at it, rename the previous 'hist' variable to 'cache' as it was used to look at the cache, not the nstat history. Fixes: 71388a9f331d ("selftests: mptcp: lib: get counters from nstat histor= y") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index da1da414c30f..b9d14647f401 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -416,19 +416,21 @@ mptcp_lib_nstat_get() { } =20 # $1: ns, $2: MIB counter -# Get the counter from the history (mptcp_lib_nstat_{init,get}()) if avail= able. -# If not, get the counter from nstat ignoring any history. +# Get the counter from the cache (mptcp_lib_nstat_{init,get}()) if availab= le. +# If not, get the counter from nstat ignoring any cache, but using the his= tory. mptcp_lib_get_counter() { local ns=3D"${1}" local counter=3D"${2}" - local hist=3D"/tmp/${ns}.out" + local cache=3D"/tmp/${ns}.out" + local hist=3D"/tmp/${ns}.nstat" local count =20 - if [[ -s "${hist}" && "${counter}" =3D=3D *"Tcp"* ]]; then - count=3D$(awk "/^${counter} / {print \$2; exit}" "${hist}") + if [[ -s "${cache}" && "${counter}" =3D=3D *"Tcp"* ]]; then + count=3D$(awk "/^${counter} / {print \$2; exit}" "${cache}") else - count=3D$(ip netns exec "${ns}" nstat -asz "${counter}" | - awk 'NR=3D=3D1 {next} {print $2}') + count=3D$(NSTAT_HISTORY=3D"${hist}" ip netns exec "${ns}" \ + nstat -sz "${counter}" | + awk 'NR=3D=3D1 {next} {print $2}') fi if [ -z "${count}" ]; then mptcp_lib_fail_if_expected_feature "${counter} counter" --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A57CF46D0B9; Mon, 24 Aug 2026 16:49:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590156; cv=none; b=gZ0ohcy+tmJ61pGunqTyDu0/KtoZRhE0Q5R3GS4XvarZP4wbGIDMlZOIR/yzk3o72cHh3k2iTUqs8XwfD23iFY/T1iHGToqWeB3rV/HqC9cm1LKqMWhMoZX7VBgZz4lDjcBqora9uOoTEZFnSnlxCS+SdOj2I0TiXFzPIr9WeJc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590156; c=relaxed/simple; bh=7jSWUUVFWTP7oYJmRxO7xcqs4guR/7YUJnwFZN8z43c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=pidAKWW3x3P/gZe7WBoRIkd8xI9yux9l2DsKrRgOUCEhKZ9Pp8KR/rsD/g5qcNQRWFcIGsZ2og8adhbecHMyGK3JzHDf9JmlHPTXsTbkyaT//9pyNey0kbUc3RjTWLw906p0LQsIH3zkujEuOUtCaDLMcWcjfE0OSvTsDqHcmEU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ETsfbYWi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ETsfbYWi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E328A1F00A3A; Mon, 24 Aug 2026 16:49:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590155; bh=MzzsoE+CXryRRKd5J5xh+BgTBt7W3d3SdYarcORfHtY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ETsfbYWiLe32/Vol+ba+uGc2udDeTxzeBBm/QJ8EHrPoiN1uyz50CQmVJnLbe2bLn ppe7kgxU8pFvnniScO6sWCvRI8IVE+WFMwEJKiNg59bkcKz2yk7CFO2ppLQWWqJ9uh MT8y6uL1zoV3yWL15jOlaxrpduWkBf6egbskBcGt/E5dGLDLmWke7Lsv7JMukKLfvg IA0/0bf3qPjwUA3opHla+fi6dCLNcR5rNBaiAyu5dkqYQKJQ21ZG9BqgU2OfxBIxBL dfhRHU8ca3NuDRi/kPTs5IpQojqlnuIASTKyWsOpLU0qJEHM5vsayuASLX59v5n0/o LI10iurzuhMew== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:32 +0200 Subject: [PATCH net 12/14] mptcp: options: fix uninit-value in mptcp_write_data_fin Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-12-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org, Kuniyuki Iwashima , Keita Morisaki , Jakub Sitnicki X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1873; i=matttbe@kernel.org; h=from:subject:message-id; bh=7jSWUUVFWTP7oYJmRxO7xcqs4guR/7YUJnwFZN8z43c=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sp9a3zXfvvH3itu6ydWcR9Zv4p0/zXnD5dVNz5ZGi Gl570hQ6ShlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZiIiyXDfw+WzqNB8gskZWV+ ix1b5v9nmXsrw6Of4rfbHu+OCjk5+Q3DP0UrxVXV804q93PP6GufmOv/QS25u/bOjNZJQbvebdq vzwsA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequence space [1], it is then required to add a DSS mapping with specific values. If the checksum has been negotiated, it also needs to be computed, and included in the outgoing packet, and thus the initial csum data needs to be reset to 0 as well. This is no longer the case since commit cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()"), because the whole ext_copy structure is no longer zeroed by default. This seems to be the only case where use_map is changed and set afterwards, so initialising the csum field only in this case, along with other fields for this specific case. Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()= ") Cc: stable@vger.kernel.org Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1] Link: https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-= v1-0-1905a818f6cb%40kernel.org?part=3D2 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- Cc: Kuniyuki Iwashima Cc: Keita Morisaki Cc: Jakub Sitnicki --- net/mptcp/options.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 196a46e7467d..ce0de02f5a3a 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -612,6 +612,7 @@ static void mptcp_write_data_fin(struct mptcp_subflow_c= ontext *subflow, ext->data_seq =3D data_fin_tx_seq; ext->subflow_seq =3D 0; ext->data_len =3D 1; + ext->csum =3D 0; } else if (ext->data_seq + ext->data_len =3D=3D data_fin_tx_seq) { /* If there's an existing DSS mapping and it is the * final mapping, DATA_FIN consumes 1 additional byte of --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2EABE470E9C; Mon, 24 Aug 2026 16:49:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590159; cv=none; b=ihGA93gF/WuQlO/JfIUspDXMSSbh3mZKFl0LE5+P567noLyA1zHYbdMqilQkAKWBCAQtIUggT+ipo3aBHbk7X096srVUTRYCi5Y/WKu7l22T1/ObbcUBGUfKmZHybqbl9CgL1dr04MCJ+q55DxNzneRM2PJTt1ENw1p3uzS24MI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590159; c=relaxed/simple; bh=Ey6sLV9Oon8XTxBtjs39uN0/nRoJMd00sb+ykNkZUis=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=fgzU0lOe1k+YYV9MdyJHTrXiWKtbrBAsf/9hKYYvW3gy4cLjrhF9tFWyjg95/wo2iXHbR4PNmCDCIvUz1PGbYgnmj2+8gbRngQV0wTJ1rd1pmYtdFMYpZFuR57dI32+3sfm0J4rwnDOEcscT/Is+P7iRhIvDFOchuuxwJZE9gcI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TVsPWuIZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TVsPWuIZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C99CB1F00A3D; Mon, 24 Aug 2026 16:49:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590157; bh=GXP9GWldKytA5St615ekAHxdGTk4m0L4kGPQQnuyG4s=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=TVsPWuIZcT64oStpXiP6GsSOixrTbUlpAqeJCbUe90sE7RvIKUQV+Ma9SdF/5m51k Tk9NW/eSVAOIM0aOtJkgTm2EBPPuBNxJ9AfLsysos9BpLVO9OU0x+RBYOq5uoeYCi5 vGrfdnEE8sP9L7Rej6jHloM1a7s+TL6UlyeU9xnaaLSwEPllfxqjsyUccJ25wEouWI 1MBQKzKIjAjfOXUPpBIzLgFQr8+z8hdjgQ+NOFM0N7FsSIF2BS8siTU6xZsMHx3Mbb LjCUEclS0xb639rIxrtTEKibmhAHm4NQQJNDRQrl4xezT3yfMLZPuxdwG+n1CKOPDa 9I5RaKEOw/ErQ== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:33 +0200 Subject: [PATCH net 13/14] mptcp: being below memory limit is a likely() condition Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-13-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1095; i=matttbe@kernel.org; h=from:subject:message-id; bh=wv0O0DPEH/JcczeA1KIApUH8RIwBeS7ndEXCzeQDfGc=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sp+Jb9+zbZGCkGLNE9+ZFV7/2OqiTTcJFcws+9p7+ Y/zA97ZHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABPJ9mdk+HnVhpHl/Xend3MO aKoxa9dqVlyW2cXF/mrZJLEVX3o7njAyLD45d08379vQmuvvPK9ur06dG2bmPoWdf+Zeg0tb2y7 /5QUA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni The current compiler hint annotation is wrong, due to inverted logic in the previous revision of the relevant code. Fixes: e468d371180d ("mptcp: implemented OoO queue pruning") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index c7c8bb3b3e00..be59ffa4bd31 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -289,8 +289,8 @@ static void mptcp_prune_ofo_queue(struct sock *sk, */ static bool mptcp_can_ingest(const struct sock *sk) { - return unlikely(sk_rmem_alloc_get(sk) <=3D READ_ONCE(sk->sk_rcvbuf)) || - __mptcp_check_fallback(mptcp_sk(sk)); + return likely(sk_rmem_alloc_get(sk) <=3D READ_ONCE(sk->sk_rcvbuf)) || + __mptcp_check_fallback(mptcp_sk(sk)); } =20 static bool mptcp_try_rmem_schedule(struct sock *sk, const struct sk_buff = *skb) --=20 2.53.0 From nobody Sat Sep 26 12:30:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5C1947126D; Mon, 24 Aug 2026 16:49:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590161; cv=none; b=J6EFyWCMD1+MTRqab1B+vld1wY4+XPOrBBxLTeyWgIOlnlhEFvwqthioZFCUB93ja/zwLfxLZa89hX/QV2j5h/Z/bdv6+hQKMjMyx/IVg8K8QS5ykK6/w2caLA7TmNlbQnIgyo7iLEfOpppSNvLi4CgsZE0oyz7UYxxhuFrDhYA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590161; c=relaxed/simple; bh=m62Sm5zsSGQmKpn0Ji7keLrY8G/l7KNlTM+gNCjrpIU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kqd3DzF4RZ5x6LgYuPcwUq28k9xWD5zZbOlOwvHb8xaTmuRh7Iw5AR2eQSZNqEhUCEdvPGjg4+EpQtYa8JNglPswm3o072kc2inhJJgjWepe3IDSkdJurZZD5E0LuWmObdtD7sFgZ4tY32aVmPH8nnJP2zlWZ6obwQE+K1ZEhmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TO9v0YBg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TO9v0YBg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3CCF61F000E9; Mon, 24 Aug 2026 16:49:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787590160; bh=2CY9/h6bPYd37mUpBWNnX4vDgsBq4zadcxpSS7We6yk=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=TO9v0YBgPF30FEM0lHL/DLQXLw20GMgTk6Wns4R32ijxJmLOG1hSOKQAHV6Wia+R1 ID1aEc3LuC4bm1c8sgFLWaeQ6SGjA4nXmlbsKuT6JbtvXGEslJu0ppK1B12qim3KBt PrB2shhBd4mUkuhMmyM5TN7lTb17tHTZPg50Q2g8/Qov1sHKSxBx1iVtBWMuGT4RFs pNdjCF/bJk/Zv6a6f5Ohngo2lVlTBswV47LSSLLXPwLsjUO+YFJQna7ImN0YPE3csm VUGIFU72iGmolyc6c5ny2M+yJlmBp2Dc2zp/Eu9iSuFgRPQnJ9M4U1k10xAxOvgGkX 2jwhW5bT+XrGQ== From: "Matthieu Baerts (NGI0)" Date: Mon, 24 Aug 2026 18:48:34 +0200 Subject: [PATCH net 14/14] mptcp: avoid pruning for OoW data Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-14-a92309d121ca@kernel.org> References: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> In-Reply-To: <20260824-net-mptcp-misc-fixes-7-3-rc1-v1-0-a92309d121ca@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , stable@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1473; i=matttbe@kernel.org; h=from:subject:message-id; bh=vn/+T+fXbkpwPKwvL+UwDd6h1lgOJiFXr8yi5+YYNd0=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLJ6Sp/xuv6pnTuh1OSZ6ZM5jxaaHFW4cP/VrGvHogP/b d+xc8794x2lLAxiXAyyYoos0m2R+TOfV/GWePlZwMxhZQIZwsDFKQATsZRg+GfArPZG2Er+WoTv exYJ4YY9L/ivL8zcd+T0ze9r+3nWaKgz/BXgLa+//eXy8ejlnYwL7q5c5rN39vzGCE7TIwbbE1y O5jACAA== X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Paolo Abeni Pruning is expansive and destructive, do it only when we expect to accept the skb triggering the cleanup. Fixes: e468d371180d ("mptcp: implemented OoO queue pruning") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index be59ffa4bd31..b26a8d560612 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -313,12 +313,6 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *ms= k, struct sk_buff *skb) u64 seq, end_seq, max_seq; struct sk_buff *skb1; =20 - if (!mptcp_try_rmem_schedule(sk, skb)) { - MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED); - mptcp_drop(sk, skb); - return; - } - seq =3D MPTCP_SKB_CB(skb)->map_seq; end_seq =3D MPTCP_SKB_CB(skb)->end_seq; max_seq =3D atomic64_read(&msk->rcv_wnd_sent); @@ -335,6 +329,12 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *ms= k, struct sk_buff *skb) return; } =20 + if (!mptcp_try_rmem_schedule(sk, skb)) { + MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED); + mptcp_drop(sk, skb); + return; + } + p =3D &msk->out_of_order_queue.rb_node; MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_OFOQUEUE); if (RB_EMPTY_ROOT(&msk->out_of_order_queue)) { --=20 2.53.0