From nobody Fri Sep 25 10:03:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D4A435FF6C; Sat, 19 Sep 2026 20:13:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848787; cv=none; b=rElh/8/Swar+C2kfdxhUhHkTqXyMKDJsg9ncekTimsjIa+xGv8QZ7wkHHeTtARKJwNU7PbXtIfddWAWyJMgQeCgz8P/SV3rxIgEspgP6mU8bdaTOjNf07Fh92RLG5L+Ph8NrrRHGBBiP7ySALyGk0nYoynd0oILxmWkhsfWB5lc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848787; c=relaxed/simple; bh=epsX1j++3Fko/DQtdSBpEZJ1wFg1qK5B7N/c591fAKw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i52VqHpky0noNA9pOqVYwm4Wqng999FYoyI2PrLaXdqrjV5gQ9ompdyi7uITdIVQFVTAkSOpKhPdzo2SeT2teqURUsSAaas6jFvY1IX2V/mAIipL+W27rXK7OKSQT50NLkLL3iR8PshzQ3YhcYI5+dy2fmClgl/j0CmOn+R/fXQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hGaLVJ+5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hGaLVJ+5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8680C1F00899; Sat, 19 Sep 2026 20:13:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789848786; bh=HFpLnNInghDL8JSy8qPkDWxdjU+CgZOajI/gTdrw9EE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hGaLVJ+5rVo11oAlI9Mn+fganxyRwWvjKkmAVxnOX6Ozbt8cp/aHmUF2EQAEYXmlt xL042LWWs/4avqRepWMvi3jbaxlXVX3vXkUiYPpZqJgqNfyUvkKWQDd+A4temnCHvE OxVdLBPDGZ2RzlhJzRiyk7EyK4hBfUKLgAvqEUOAeJpis331oAWayPBwIMsanO4wzs d+a2PX2jWB8iFqMUrbFbCN+lM+NlMt/pfLhNd66PfuY8c6NfKScIqPv0NrMwljGowZ 8tAA51CoollAd6EOj5E6xqVad6IfUOXtU4mfJbAHn8SvzFY6M2c2uRZsi2wdPPfS9q 50W49DaBr1jPg== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, Mat Martineau , "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.1.y 1/3] mptcp: consolidate subflow cleanup Date: Sat, 19 Sep 2026 22:12:54 +0200 Message-ID: <20260919201252.2025112-6-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919201252.2025112-5-matttbe@kernel.org> References: <20260919201252.2025112-5-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3863; i=matttbe@kernel.org; h=from:subject; bh=LKXEot37dX6aLgczeUF+iiz11GK2iDaj3fGxVDBSGmc=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWvTku0P1mtxPD1V+Hrx4WP3gu6vfFeqfMCbHxce9VO yR0uxMrO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACYyw5/hr+R2763WjD+vXblt e8/LVvCWdxfT1eOz9duaefYGrSr/eJvhv7uiRerK5nNHbnrK+u9oEekP+eh57vCx1zEvtyS82yD dywkA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit c3349a22c2002947d29a98a77bfb36d97cfbfac1 upstream. Consolidate all the cleanup actions requiring the worker in a single helper and ensure the dummy data fin creation for fallback socket is performed only when the tcp rx queue is empty. There are no functional changes intended, but this will simplify the next patch, when the tcp rx queue spooling could be delayed at release_cb time. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250218-net-next-mptcp-rx-path-refactor-v1-= 1-4a47d90d7998@kernel.org Signed-off-by: Jakub Kicinski Stable-dep-of: 2b0f561f21b2 ("mptcp: avoid unneeded actions on subflow rese= t") [ Note: also remove struct mptcp_sock *msk from subflow_state_change: it is no longer used after this modification. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/subflow.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index eed5b90bf5a0..07cdb162b709 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1159,7 +1159,12 @@ static void mptcp_subflow_discard_data(struct sock *= ssk, struct sk_buff *skb, subflow->map_valid =3D 0; } =20 -/* sched mptcp worker to remove the subflow if no more data is pending */ +static bool subflow_is_done(const struct sock *sk) +{ + return sk->sk_shutdown & RCV_SHUTDOWN || sk->sk_state =3D=3D TCP_CLOSE; +} + +/* sched mptcp worker for subflow cleanup if no more data is pending */ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct so= ck *ssk) { struct sock *sk =3D (struct sock *)msk; @@ -1169,8 +1174,18 @@ static void subflow_sched_work_if_closed(struct mptc= p_sock *msk, struct sock *ss inet_sk_state_load(sk) !=3D TCP_ESTABLISHED))) return; =20 - if (skb_queue_empty(&ssk->sk_receive_queue) && - !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) + if (!skb_queue_empty(&ssk->sk_receive_queue)) + return; + + if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) + mptcp_schedule_work(sk); + + /* when the fallback subflow closes the rx side, trigger a 'dummy' + * ingress data fin, so that the msk state will follow along + */ + if (__mptcp_check_fallback(msk) && subflow_is_done(ssk) && + msk->first =3D=3D ssk && + mptcp_update_rcv_data_fin(msk, READ_ONCE(msk->ack_seq), true)) mptcp_schedule_work(sk); } =20 @@ -1688,20 +1703,13 @@ static void __subflow_state_change(struct sock *sk) rcu_read_unlock(); } =20 -static bool subflow_is_done(const struct sock *sk) -{ - return sk->sk_shutdown & RCV_SHUTDOWN || sk->sk_state =3D=3D TCP_CLOSE; -} - static void subflow_state_change(struct sock *sk) { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(sk); struct sock *parent =3D subflow->conn; - struct mptcp_sock *msk; =20 __subflow_state_change(sk); =20 - msk =3D mptcp_sk(parent); /* as recvmsg() does not acquire the subflow socket for ssk selection * a fin packet carrying a DSS can be unnoticed if we don't trigger * the data available machinery here. @@ -1712,13 +1720,6 @@ static void subflow_state_change(struct sock *sk) subflow_error_report(sk); =20 subflow_sched_work_if_closed(mptcp_sk(parent), sk); - - /* when the fallback subflow closes the rx side, trigger a 'dummy' - * ingress data fin, so that the msk state will follow along - */ - if (__mptcp_check_fallback(msk) && subflow_is_done(sk) && msk->first =3D= =3D sk && - mptcp_update_rcv_data_fin(msk, READ_ONCE(msk->ack_seq), true)) - mptcp_schedule_work(parent); } =20 void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *list= ener_ssk) --=20 2.55.0 From nobody Fri Sep 25 10:03:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4705435FF6C; Sat, 19 Sep 2026 20:13:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848789; cv=none; b=jAxj759jB8qC0H6Ees+OtIJJyZcuuT7N82qgB7bpVCIKYVgSvPjzvVzLgu1wm4m6Ph6heyOMfjzFylsIV/YdR8QJfQfF/YWEVqShGxYGdlGnNAaq00foIXVe1p+8k369zH29o7sgsMyU1ajXNNGyju074xMc1yooyRgjKQIhAfc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848789; c=relaxed/simple; bh=1WO0zlFUIqFs0tdWGgmmVfyB4GET1GmoOqkiokHSxEk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T+IaM+qC1EgEBHLPbfhCGYT4p1Ij0lHwOi1z3DXil3Z2WhnyusBgsLNXVc2tKQ+MG/RayZu/NHim+CaVXmaEYYaCNWrVKkfLab4OUiTvjQQ3/T8sozYt422Y1yzlRyDiBAznjbKr/KCZCBBVanHDm4de8RDZwX0GOg7Ntrk8sjA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Uo5QZ/ut; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Uo5QZ/ut" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68AC21F000FF; Sat, 19 Sep 2026 20:13:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789848787; bh=xouwOPrkxaEpY908u6h7kOvFvIViEUzdFPGLnhTu4Z4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Uo5QZ/utd/AyfGw2HJJZaGPNke1/pgV0oIzf0hgBbeyjCjhmO1VKLHzDYc058CYLj EThM52aPVU8MuiADdu9rrTzgOiFvOXv5UsMDI6DzujaS/ZB9xLT+PRxkxvzU47re4D IAFwp/Q1paL0hs88PiH6TRNcq0oBa7zInG4jGOmYCRMjQcExjGtKuesyEZOE6mWCRQ g4a0T3gBoYbqDkNxj5Kk4m0nuw/KtcGWlnNLweYi5HxAX1Hc2pf4TIJytKUY6C5lgD O4yEQR91TSe74OcUawoKP04czr6zPSqSe4wxCbjEzcus1hDSSjChtM9EVAZeRhC9iN /mMEGJx+KFHQQ== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, Xinyang Ge , "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.1.y 2/3] mptcp: avoid unneeded actions on subflow reset Date: Sat, 19 Sep 2026 22:12:55 +0200 Message-ID: <20260919201252.2025112-7-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919201252.2025112-5-matttbe@kernel.org> References: <20260919201252.2025112-5-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4385; i=matttbe@kernel.org; h=from:subject; bh=XcstLkYZhMf+PhHW4AP7Sz2v6ws0XodyjpnN+Xr9kRY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWvTnRes7UNvizyP/GhWLCd37UHMyufnCB1yjKs9S1Q vTYgb0uHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABNhqmdk+KTG+VKT6wjD6f/T upn5OU/w/pMwff6CobElytTkwfFsfob/zmuYpPgPFjW2nO4+EbFba0Or+Przj3fuPX153RFlltM 6HAA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 2b0f561f21b27c40c91ea4975268a06092bd7e9c upstream. Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it. Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") Cc: stable@vger.kernel.org Reported-by: Xinyang Ge Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-1-0= cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski [ Note: conflict in protocol.c, because commit e0ca4057e0ec ("mptcp: micro-optimize __mptcp_move_skb()") is not in this version, and is part of a consequent rx path refactor. The conflict is in the context, and is easy to resolve, "done =3D true" can be moved along without consequences. Also a conflict in protocol.h, because __unused is at a different number. Decrement the one from this version and add the new flag above. The context is also a bit different with data_avail being an enum, but that's without consequences here. ] Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 6 +++--- net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 11 +++++++++++ 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 2ce20884d730..ab83cf46a8c3 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -754,13 +754,13 @@ static bool __mptcp_move_skbs_from_subflow(struct mpt= cp_sock *msk, mptcp_dss_corruption(msk, ssk); } } else { + sk_eat_skb(ssk, skb); + done =3D true; + if (unlikely(!fin)) { DEBUG_NET_WARN_ON_ONCE(1); mptcp_dss_corruption(msk, ssk); } - - sk_eat_skb(ssk, skb); - done =3D true; } =20 WRITE_ONCE(tp->copied_seq, seq); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index e835028fc4e5..1de257b86839 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -492,7 +492,8 @@ struct mptcp_subflow_context { stale : 1, /* unable to snd/rcv data, do not use for xmit */ valid_csum_seen : 1, /* at least one csum validated */ close_event_done : 1, /* has done the post-closed part */ - __unused : 9; + resetting : 1, /* subflow is resetting */ + __unused : 8; enum mptcp_data_avail data_avail; bool pm_listener; /* a listener managed by the kernel PM? */ u32 remote_nonce; diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 07cdb162b709..cc62681d6ea8 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -379,6 +379,10 @@ void mptcp_subflow_reset(struct sock *ssk) /* must hold: tcp_done() could drop last reference on parent */ sock_hold(sk); =20 + subflow->resetting =3D 1; + + /* No need to delay the actual close for to-be discarded data. */ + __skb_queue_purge(&ssk->sk_receive_queue); tcp_send_active_reset(ssk, GFP_ATOMIC); tcp_done(ssk); if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags)) @@ -1710,6 +1714,13 @@ static void subflow_state_change(struct sock *sk) =20 __subflow_state_change(sk); =20 + /* Rx queue processing is unneeded, error reporting will take place at + * __mptcp_close_ssk() time and subflow reset can't happen in case of + * fallback: subflow_sched_work_if_closed() would be a no-op. + */ + if (subflow->resetting) + return; + /* as recvmsg() does not acquire the subflow socket for ssk selection * a fin packet carrying a DSS can be unnoticed if we don't trigger * the data available machinery here. --=20 2.55.0 From nobody Fri Sep 25 10:03:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07A0A1E7C18; Sat, 19 Sep 2026 20:13:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848791; cv=none; b=h5vDbQ9d1XXpXSGK6vL0Cc9NKu+mXxJrmJf2ZHkcKoQjm8zJmfok1wXqWp/ijZaaF6nOe1OvdT9j0dM/6sJS0NoXCaDENiye8if/Qw99SzL4IbkEhOsHgZlZctFVn3ejcMNp/P1N5BULADfBhhnPxJbpE+1SRYsEs0qqmEoGAf8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789848791; c=relaxed/simple; bh=dwhocoWCq7rJOiLDrwA64Y6T/zGO94j072keG0FzDLM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RXmvYhpKA7PCsDJg9j+NtgBkZTakjoVrkgiv2SP/DjsjNhCPhIf9CuwiC+g3VS+ETKWolrNfRWJo3zEI74AMs54zapPKgLwHsAVv3siBpxPU3+Y1RPNehpF6gHoZayWt99FieLfZEofZkRXW1uhPCCygB2D9sfeBS3y3X3MYE7Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dGSmk6Fi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dGSmk6Fi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A0711F00893; Sat, 19 Sep 2026 20:13:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789848789; bh=VGv5bcygaPAIYafDfFrgO8tRS847RoBkPdxQSzJbqEM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dGSmk6Fib+CKh9hvVJMuflpifkMl0u7f7UXLTNN8MJDKAaiCMcpxom9LmIqDHWsvJ LihUGL0uF78KYkTsemKY9rIJsY8eTdExqEJzGeIAyNWBIEJ87GJr9x0+uGRH0AymQL QztpCcvYMOjdATw55Jpw6gv3q7nH36FPuvOKb8eGgkWRHLSiOcUNidqZzwZlCsd4ep wkyxU2mU9hH5o+UEUoO2ts6JjDwIK5tHYdic9dF4u6XeqEs7402FycYGcM41g9+v// QvIR2UFma5HHujlSlnyCck/uK7tTo+W8BKC3JUTYflK4PuzF27N8DIsvGmDMgsEs/v dmQ9EwUcFzRZw== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni , sashal@kernel.org, Shardul Bankar , Xinyang Ge , "Matthieu Baerts (NGI0)" , Jakub Kicinski Subject: [PATCH 6.1.y 3/3] mptcp: close race between scheduler and state change Date: Sat, 19 Sep 2026 22:12:56 +0200 Message-ID: <20260919201252.2025112-8-matttbe@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919201252.2025112-5-matttbe@kernel.org> References: <20260919201252.2025112-5-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1643; i=matttbe@kernel.org; h=from:subject; bh=YCaJS/uVeKh2uLBYtsClOmVMEQ7iEBR2miH8Bkb8vGg=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLWvTm5fae/hR7DxOVbtx8u5EvTa9rwIuJMRYhbQy3jV EdOzr35HaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABMxKWf47/3F4ULyAlcBI04N ERGuKX93PLFx81V8+N5bJ/5u8/VCLUaGfWv4K64W+Mx2tdoU7n30S1nXj/lpjF+0vJUfcP99b/y SDwA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 42064de57fb83231fcc89663a94885f228a1ee53 upstream. The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario. Fixes: c886d70286bf ("mptcp: do not queue data on closed subflows") Cc: stable@vger.kernel.org Reported-by: Shardul Bankar Reported-by: Xinyang Ge Closes: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricso= ftware.com Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-2-0= cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index ab83cf46a8c3..ca78add7670d 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1636,7 +1636,9 @@ static struct sock *mptcp_subflow_get_send(struct mpt= cp_sock *msk) =20 static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info= *info) { - tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal); + if (info->mss_now) + tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, + info->size_goal); release_sock(ssk); } =20 --=20 2.55.0