From nobody Fri Sep 25 10:03:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A62D225403; Sat, 19 Sep 2026 19:46:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847170; cv=none; b=f46HBAzZdUT4Zoad5495YBuX0v1P8KF10JbwzjZb2i+nhO8tOueo40zNdb8zHKeKYLoTVf5vZXV3k5z5+IFDoLZYiC7zs4X0W1gFVYDXr0hx/wYyMw5rDNaaMZa8nzdG8FIop1Foe9DXkZPB5COwvNj4X8wEV0Rtaw7yLEUW0ic= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847170; c=relaxed/simple; bh=Y9JURpnyNVvXbUVCu1XwyjZTJF0tc1XGqecxqThTu0I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UTjtRn0fqWPuvXmItPoH7THbLf+FUQmYbUHVQMqabZE47hh20FeV57tFmu8yjgfeSgWIjiSOez2EEs+M3x7wHDsajeUGOQ0fmzvVCB7SueBgZLgW+4Bk8Ib77yTALlzFLk6UAefp6aI/vliw3E1iHG1pJ1peqJhTrpNY1CwWe3U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JeBDa3hw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JeBDa3hw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B16A1F00893; Sat, 19 Sep 2026 19:46:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789847168; bh=0GY1gwzUS94VFcLdtnnjrgK2welX+5DdyYBJna085wk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JeBDa3hwgySlshJKvqDzzE2zMvqhwN7s3B06pe+1NnH0k5uKP6YlwgeiegBq01cdG F4uuBrXpFY9DV/MGo2Vpz3ygM1+1aR6gxljjf7hxLLEeaJXAg7zGPZYLoS5psboccb JMdgdqSR4xlgObmtsuuh8ofx0YHhdDFdwSneLJhgHC8Ap4bMTMFOSvF/avmFu3zRXM K1j7934ftfr9Qa6gtioHA6qAXR9cd/Rf5xT1z9XCpt1/h9g44lDGVKGSno/NL3thFY 5q6T/xQX3Vi/p92ngn3IIv0XsUJyO3O4IIC5WKFrJtmOu0KTZp6aYlozaV3Ka/OYfz ix4jQYBid9TLw== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.18.y 1/4] mptcp: move the stale logic out of retrans scheduler Date: Sat, 19 Sep 2026 21:39:50 +0200 Message-ID: <20260919193948.1927666-7-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919193948.1927666-6-matttbe@kernel.org> References: <20260919193948.1927666-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6283; i=matttbe@kernel.org; h=from:subject; bh=wnFfjFdUTAGi4UZulKbVuvi6Fo+np7j4uUQ34slT0iY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWPWVPKNZi+3LkSeB+qQkLuL0i3S5W+OpdPCBop7h7b 5SV2zOOjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgInsDWdkWOA9N873zuc6ds3W xWqLX63x+rFa6UuQQNy559d/TVDwUmH4K88mvFR0882GT2Vnc5rXzV6x1/7xoRqp5byuvRZKmd9 5eQE= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 6cafe51e0f98fe60a106783d30b2f4c4b6039f4c upstream. This allow separating the stale logic invocation and the retrans scheduler, and will simplify the next patch. It's also a cleaner design as the retrans scheduler has currently too many side effects. As a possible downside, the retrans work will now traverse the subflows list additional times; that does not matter much, as this is slowpath. While at it, pick more accurate names for the involved helpers and explicitly note that the per subflow stale data is under msk socket lock protection. The scheduler and the stale logic may observe different subflow statues, as no subflow lock is acquired. This is intentional and not harmful, worst case leading to slower retransmissions. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-2-db= c1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski Stable-dep-of: 2b0f561f21b2 ("mptcp: avoid unneeded actions on subflow rese= t") Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/pm.c | 41 +++++++++++++++++++++++++++-------------- net/mptcp/protocol.c | 4 ++-- net/mptcp/protocol.h | 11 +++++++---- 3 files changed, 36 insertions(+), 20 deletions(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index 01c91edbee1e..6981fd48c63c 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -1021,7 +1021,8 @@ bool mptcp_pm_is_backup(struct mptcp_sock *msk, struc= t sock_common *skc) return mptcp_pm_nl_is_backup(msk, &skc_local); } =20 -static void mptcp_pm_subflows_chk_stale(const struct mptcp_sock *msk, stru= ct sock *ssk) +static void +mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk) { struct mptcp_subflow_context *iter, *subflow =3D mptcp_subflow_ctx(ssk); struct sock *sk =3D (struct sock *)msk; @@ -1058,22 +1059,34 @@ static void mptcp_pm_subflows_chk_stale(const struc= t mptcp_sock *msk, struct soc } } =20 -void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock = *ssk) +void mptcp_pm_chk_stale(const struct mptcp_sock *msk) { - struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(ssk); - u32 rcv_tstamp =3D READ_ONCE(tcp_sk(ssk)->rcv_tstamp); + struct mptcp_subflow_context *subflow; =20 - /* keep track of rtx periods with no progress */ - if (!subflow->stale_count) { - subflow->stale_rcv_tstamp =3D rcv_tstamp; - subflow->stale_count++; - } else if (subflow->stale_rcv_tstamp =3D=3D rcv_tstamp) { - if (subflow->stale_count < U8_MAX) + mptcp_for_each_subflow(msk, subflow) { + struct sock *ssk =3D mptcp_subflow_tcp_sock(subflow); + u32 rcv_tstamp; + + if (!__mptcp_subflow_active(subflow)) + continue; + + /* No data outstanding at TCP level? not stale */ + if (tcp_rtx_and_write_queues_empty(ssk)) + continue; + + /* keep track of rtx periods with no progress */ + rcv_tstamp =3D READ_ONCE(tcp_sk(ssk)->rcv_tstamp); + if (!subflow->stale_count) { + subflow->stale_rcv_tstamp =3D rcv_tstamp; subflow->stale_count++; - mptcp_pm_subflows_chk_stale(msk, ssk); - } else { - subflow->stale_count =3D 0; - mptcp_subflow_set_active(subflow); + } else if (subflow->stale_rcv_tstamp =3D=3D rcv_tstamp) { + if (subflow->stale_count < U8_MAX) + subflow->stale_count++; + mptcp_pm_subflow_chk_stale(msk, ssk); + } else { + subflow->stale_count =3D 0; + mptcp_subflow_set_active(subflow); + } } } =20 diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 136faedde936..a9d8f63d3b2a 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2372,7 +2372,6 @@ struct sock *mptcp_subflow_get_retrans(struct mptcp_s= ock *msk) =20 /* still data outstanding at TCP level? skip this */ if (!tcp_rtx_and_write_queues_empty(ssk)) { - mptcp_pm_subflow_chk_stale(msk, ssk); min_stale_count =3D min_t(int, min_stale_count, subflow->stale_count); continue; } @@ -2685,9 +2684,10 @@ static void __mptcp_retrans(struct sock *sk) int ret, err; u16 len =3D 0; =20 + mptcp_pm_chk_stale(msk); + mptcp_clean_una_wakeup(sk); =20 - /* first check ssk: need to kick "stale" logic */ err =3D mptcp_sched_get_retrans(msk); dfrag =3D mptcp_rtx_head(sk); if (!dfrag) { diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 08a4ac75ad46..68f7c67d5f49 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -541,12 +541,11 @@ struct mptcp_subflow_context { remote_key_valid : 1, /* received the peer key from */ disposable : 1, /* ctx can be free at ulp release time */ closing : 1, /* must not pass rx data to msk anymore */ - stale : 1, /* unable to snd/rcv data, do not use for xmit */ valid_csum_seen : 1, /* at least one csum validated */ is_mptfo : 1, /* subflow is doing TFO */ close_event_done : 1, /* has done the post-closed part */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */ - __unused : 8; + __unused : 9; bool data_avail; bool scheduled; bool pm_listener; /* a listener managed by the kernel PM? */ @@ -565,7 +564,11 @@ struct mptcp_subflow_context { u8 reset_seen:1; u8 reset_transient:1; u8 reset_reason:4; - u8 stale_count; + u8 stale_count; /* Protected by the msk socket lock */ + u8 stale; /* Protected by the msk socket lock, + * if set the subflow is unable to snd/rcv + * data, the schedule should skip it + */ =20 u32 subflow_id; =20 @@ -1054,7 +1057,7 @@ int mptcp_pm_parse_entry(struct nlattr *attr, struct = genl_info *info, bool mptcp_pm_addr_families_match(const struct sock *sk, const struct mptcp_addr_info *loc, const struct mptcp_addr_info *rem); -void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock = *ssk); +void mptcp_pm_chk_stale(const struct mptcp_sock *msk); void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ss= k, int server_side); void mptcp_pm_fully_established(struct mptcp_sock *msk, const struct sock = *ssk); bool mptcp_pm_allow_new_subflow(struct mptcp_sock *msk); --=20 2.55.0 From nobody Fri Sep 25 10:03:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC0F721E097; Sat, 19 Sep 2026 19:46:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847172; cv=none; b=KdluIKafQaXRaBQ3gY6Y9rDIanBnYjbNmH4DGM6fOC8H6WCgNLfuU8kaCBDg1IfA3526KLUaaVtgXhyhFuesErH1od8Doq1QaJMu3k2bwNMDnsXD1x2FtNOR3vfBtemPrq2TUbB1YtukOSFfz0afrCseyrbknv2ifesZnEapeEQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847172; c=relaxed/simple; bh=4nnvDODdQjHmfFhi/J35q4Ra6AqjS+EY1v/fdX73R8c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VDTRDx5IPuDizf7I8SmJ+vZ1UNESTAAWemEF5dBXtc62aMWOksIS+TM3qT7UEZmHlwGGxo9hqL4OzCdBDalBNxhUGv6KapnzD4PfiOhHvrkYLm6usdfEFKRtgNHdPQTq+R7z0nvAwGOL6el3bRCMK0QwLLSkFl8wIExnvNMTS2g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VfSwt6RJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VfSwt6RJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 383871F000FF; Sat, 19 Sep 2026 19:46:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789847170; bh=VzL2RXag44aswm6H0CNJet9Iyu0WotGU/SiDa/pmvYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VfSwt6RJyN+M4JTcmiI/VDW5JWc/hjvsZn62fBxHsLB+F3imWeeXZk6LECaO30kFb 0U/+mDtb2o23in4kIHxO1SVPO3PQdjjlIFhorCVIUCPgrsl6Tjfp4DPTVAZdkky2w5 Y0OLh5osJpl1cyC0MGNHhUZP5O5ScOhwk7+Gl9iBmYIPW67hl1pYi2MZRpYBeMTz99 wLe0ZGpD2UJ8pfRBRCcmcMnitfmhWQc1ZAJpTiVsk+pufXtHyZenfpA11Jl4PQpyxq 7zQ5WKhINIEFEik8bfxb3aU2sZ5FOrDHPkku40NNU7CHxloIPces8IwD/uvHR75XHj OvXGc4RsVnpTw== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, Xinyang Ge , "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.18.y 2/4] mptcp: avoid unneeded actions on subflow reset Date: Sat, 19 Sep 2026 21:39:51 +0200 Message-ID: <20260919193948.1927666-8-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919193948.1927666-6-matttbe@kernel.org> References: <20260919193948.1927666-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3752; i=matttbe@kernel.org; h=from:subject; bh=TwEXo4sAWu8C2MWECnaVnk45GCdRUe7jQDtgvf6QFhA=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWPeUokGPiPCn+s9nz0KnQDZ/39SXP7ussn+Jz4v7JF UIscVV3OkpZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACbi+4qR4a7jA4/yqRld06fU sLdbvZQu3HNn3450nzZe1TuxQXpB5YwMH3kzqirrzrl/uipynz1gg2btB8Oe3PnhEsdT+R3Un/J xAgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 2b0f561f21b27c40c91ea4975268a06092bd7e9c upstream. Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it. Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") Cc: stable@vger.kernel.org Reported-by: Xinyang Ge Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-1-0= cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 ++-- net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 11 +++++++++++ 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index a9d8f63d3b2a..dee5fd3787b5 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -727,12 +727,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mpt= cp_sock *msk, mptcp_dss_corruption(msk, ssk); } } else { + sk_eat_skb(ssk, skb); + if (unlikely(!fin)) { DEBUG_NET_WARN_ON_ONCE(1); mptcp_dss_corruption(msk, ssk); } - - sk_eat_skb(ssk, skb); } =20 WRITE_ONCE(tp->copied_seq, seq); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 68f7c67d5f49..dc8920a6a90c 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -545,7 +545,8 @@ struct mptcp_subflow_context { is_mptfo : 1, /* subflow is doing TFO */ close_event_done : 1, /* has done the post-closed part */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */ - __unused : 9; + resetting : 1, /* subflow is resetting */ + __unused : 8; bool data_avail; bool scheduled; bool pm_listener; /* a listener managed by the kernel PM? */ diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 96794baac3e1..1932fcf9f925 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -441,6 +441,10 @@ void mptcp_subflow_reset(struct sock *ssk) /* must hold: tcp_done() could drop last reference on parent */ sock_hold(sk); =20 + subflow->resetting =3D 1; + + /* No need to delay the actual close for to-be discarded data. */ + __skb_queue_purge(&ssk->sk_receive_queue); mptcp_send_active_reset_reason(ssk); tcp_done(ssk); if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags)) @@ -1864,6 +1868,13 @@ static void subflow_state_change(struct sock *sk) =20 __subflow_state_change(sk); =20 + /* Rx queue processing is unneeded, error reporting will take place at + * __mptcp_close_ssk() time and subflow reset can't happen in case of + * fallback: subflow_sched_work_if_closed() would be a no-op. + */ + if (subflow->resetting) + return; + /* as recvmsg() does not acquire the subflow socket for ssk selection * a fin packet carrying a DSS can be unnoticed if we don't trigger * the data available machinery here. --=20 2.55.0 From nobody Fri Sep 25 10:03:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEB41225403; Sat, 19 Sep 2026 19:46:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847174; cv=none; b=qztftEKc7FTqeluUkbt9Y/TtNVP4j4SO3b4Z/NCNucgyKiCWRw3XViyEvrcJr8U9vjTYGrFlS8CH7UwKe/sNFcrlB9+7XtgUyKA/VuAowOu0TDTh1Fl2jjQtIua8wOvHfIkskOtELKe9G7TYAm2cEsTSX47OtMpmuewZmWPCfAE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847174; c=relaxed/simple; bh=x1LTUlrEUNNtlYFqPywn8y8jNcQ2XJz905iL7tXgwBU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W8e8YLDXCBcQ4LqmzW+CZinAxsG50Rg7wZ4ZlvS0WbxwlTzHseyzMXP26YeASneqO7JB5P+TdIemluI+JlBoJgqn59WluUTSvyaqdG3lWl710hApfZ0wH5yjtW05mJFb3iYl/knZq1uxdTtiUv44ovqFnrrAbvUanWMYUl0UTB0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=X/tN42Vl; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="X/tN42Vl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A1831F00893; Sat, 19 Sep 2026 19:46:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789847172; bh=aNfRZN3+/x2Qq1gmA44EPWzscUUsHxzCk0MmsiDXm/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=X/tN42VluKXl2zhMODZEZKnmRM8NzkawsDMn0MiGFU9TAtSaaUiaXyB4hLKdpXdk0 ELcDz1LP1hlpigzN5J7iA3uxxQb6pKhvQ+TEO7wjgGRVpw8oT9W4O9RWj5zumRilxE IBsPwy6Bex3J4bmBxmbAK0goA0OhSojJLkCDlV03cbEyd7FQSF0IGiHrQrRH/pA56V UaMEPJR6mpTXCTkMagcTWkiw6jTAuiEywY2qQdzmKT45AjRcSm9uhwOPIVGk6aXdQ6 H5+myBN/ArzLsKhWZvcoGQY8QcTmhutwbm/wIHD9JdrWuwZrmjxnDuB9onUwBCq2JO 4mPNevTYEyYPQ== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, Shardul Bankar , Xinyang Ge , "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.18.y 3/4] mptcp: close race between scheduler and state change Date: Sat, 19 Sep 2026 21:39:52 +0200 Message-ID: <20260919193948.1927666-9-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919193948.1927666-6-matttbe@kernel.org> References: <20260919193948.1927666-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1636; i=matttbe@kernel.org; h=from:subject; bh=Mb9RRb/FkSAQ0Q/CdOU3ted97d6gaYbB/C+421X/jVY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWPeXac7+aZ7Pu9EKf+78Swh4mNq36WSKa9j3648Tq/ x+jplU3dpSyMIhxMciKKbJIt0Xmz3xexVvi5WcBM4eVCWQIAxenAEzk9BxGhg9ycZdEP2d4MX5R ufnP+mOw1N00nkn9W6fePqSq8qwn7xsjQ7fMi8/vHz6PqljGxPdfQqyW443r/HNVsZbXTrNfFz8 QxAMA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 42064de57fb83231fcc89663a94885f228a1ee53 upstream. The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario. Fixes: c886d70286bf ("mptcp: do not queue data on closed subflows") Cc: stable@vger.kernel.org Reported-by: Shardul Bankar Reported-by: Xinyang Ge Closes: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricso= ftware.com Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-2-0= cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index dee5fd3787b5..e600b2efd0df 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1515,7 +1515,9 @@ struct sock *mptcp_subflow_get_send(struct mptcp_sock= *msk) =20 static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info= *info) { - tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal); + if (info->mss_now) + tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, + info->size_goal); release_sock(ssk); } =20 --=20 2.55.0 From nobody Fri Sep 25 10:03:42 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1384225403; Sat, 19 Sep 2026 19:46:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847175; cv=none; b=LdyZIW1cyQo6zCNpHs65AKquaRUsK8z0j3bSn3OsXkQhEOO5V9Rt55WElYaA/iNPgYJZ7S/yp7xm0f2QyApe9XKi9dzcqvJZPL7nxzModU0/vNyNDcA512NfSDTPFQH9RLeibe+X2Rc13CnSGawr6zinq5saX67+pogKIvJjV9w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789847175; c=relaxed/simple; bh=Wq/mhJ8JL8dkThvrw/lYB/SIPWU3pvX1UqnHvFYvL/8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bWgVWrqKw1ONbAWuFbD1Be+ihp0hDdQlN12CViKLcWTE1HCyGynK21pJQlCKX0QJ+TB4LJ53/giQVhVXVhikT+UyszgjVmHWP7CM4zjcw+nDouOxMDiQIAQ/MzR5HXTBXfmlBg3nam6F5hOF+InJzRsJrW4sMpjhM3PCUo/9mRk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=inmB3m4v; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="inmB3m4v" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20A311F00898; Sat, 19 Sep 2026 19:46:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789847174; bh=GP+r0fxuSCklfuLFF2m4lYHcHX6RTsdo33U151xfeb8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=inmB3m4vmahsg9H2EWDnZ2sjWhuuqXCjGBF2SQrw8shEMLIWAstAtqoJSEMrpfbJv GjaGGcevkNWvC3eFadUylE1lepKUy+zrjhMrobe6+0d+i2+i/dR0Dg1ZA1Q8cK9YBm yiGk5g0MCA+0sdJKXZyeso7l6S9Smf2KbKN1cbv7gAJ8tSeQlgq09SSyK+J3UTswuw tArD1+vqIj9goyewxu1pnl0Gel+JBb37vqvEYzq4pCLU5SXC7qmZgJm/9jjcmoEkfK iRRxn81S+IOR5fr+NoxbpkysfDCOedorrGbVfmjb4CPnoTT1Kdy2e3H+MV8Mm5EfbE Q+fthlF9hlq9A== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.18.y 4/4] mptcp: fix bad accounting in __mptcp_subflow_push_pending() Date: Sat, 19 Sep 2026 21:39:53 +0200 Message-ID: <20260919193948.1927666-10-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919193948.1927666-6-matttbe@kernel.org> References: <20260919193948.1927666-6-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1208; i=matttbe@kernel.org; h=from:subject; bh=zBx8JjjlaRjg7GAQr1Ldif2BN6BCKriH9oQ3xfJlvH8=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWPeWOP/jPUV2pwvuTgJN6sePK8vUHPx31llhdqhTDG /FEbuOOjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgIncncPw37/QdfLBbWYdG+Mq N8TLBiudmnHBOPTtk5YvB54X89Ze7GRk+KUsUmNywPS0UOi82X+nyP1zOH9rvk1eGktcJlvz+k2 t/AA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit f3ef03357396d4b147d8e76c75fb612c2f264ffc upstream. If __subflow_push_pending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on. Fixes: 0fa1b3783a17 ("mptcp: use get_send wrapper") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-3-0= cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index e600b2efd0df..e9967d55b8ac 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1705,7 +1705,8 @@ static void __mptcp_subflow_push_pending(struct sock = *sk, struct sock *ssk, bool ret =3D __subflow_push_pending(sk, ssk, &info); if (ret <=3D 0) keep_pushing =3D false; - copied +=3D ret; + else + copied +=3D ret; } =20 mptcp_for_each_subflow(msk, subflow) { --=20 2.55.0