From nobody Thu Nov 5 07:32:45 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793316129; b=u7uNiL47kvPcaadYyJCStQQRVZ6a2noo1GvPcFgXZGyWHniR1fsFCJ9q3caLEXz+iNgl M9AXgnhv0D/wPv5YRvF1ao0v6avVbrQ63WKLjEz7sUkQrohEI9i4vfPEW324GAhQUf2Vv UzOid123jZLSTHxHq5oicJuqLdUZffk82tDV4BjK/vHOW+3xPxBuEs3OBqnH0qfhLPKQk WCu/GEVQl/2g9tX7m64bWBjN3glggOJFoOLoSaxeEqii/LihFx2Az5JUqXRVT6bs47Dsz QEw7WlDofFJmDVjjeVVozspWNgJzfOc+fchQRUEZxDWd2cvDb33wTPTrhyNqtjGYQaw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793316129; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=d9rzxjAXPfp1tdr9gzSVkzo++QkPoqY+umqoBiCBDpM=; b=b4RWEgPVmmLVZxtA8Cwfv+WTyFrvFkhpgnYW6zHj4fVSJmPiqQ9ZTIfg00dbDlPYGDA0 DWhdcb/At6nHuOCll1ulqyTL5sRzdILG0v8ZlWdpeCyZRKlfWEdSIs1V0Af0qSnVuQYpj ib97EtCfuJkOM3qVRkrGBI4yxP+WBUEYsIrCIs9+44WEujKt3bUyx2kyMgoAZBNOZJhc0 QiuhCV1j1pPqdzd0aT5xPxu0NMVi9q8eVsDFvkNZyp6RB3Zw+G1djJneh3TtijX5kzloK gMf4h7s05c5lJN4stnXxzpmHoi4XwRFjwe5ZnEhYAGwm6LdKWXZ/x+0RsAD7FDB/w7g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=i+BwGV4l; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0DC6606A31D for ; Thu, 29 Oct 2026 23:22:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=i+BwGV4l Received: by smtp.kernel.org (Postfix) with ESMTPSA id A43101F01816; Thu, 29 Oct 2026 23:22:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793316128; bh=d9rzxjAXPfp1tdr9gzSVkzo++QkPoqY+umqoBiCBDpM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=i+BwGV4lz4dDYCgQLGKjRJOd9XzUcd6htambkLQb5sh01RnP+AiURmvq9FLBS97+i dACGlmKMTzjdjIxnX1C//kAE6XiWkClHtIwMmzVfdwTinOpbOBhx2q35WAeHknOAhh ywEkBk+8N6i3mNWvpdcUS4xBDiEEGH8RIk0gfC7+/VR1WZTLhQK/amv5RMJU46rKxP LhquuZpxtgRbaV8zxjCw8TSgpnU++OfQ40FMq/nY6vF9mnd5qdGnEKgmJGOMRBnKhZ nbiZGDt5onehJCyghgvyi0nGSX/CoPVA2voK0zWbmZxPBvg9wohvzinZ0VaiRWyIXE Et9KKAe2inS5g== From: "Matthieu Baerts (NGI0)" Date: Fri, 30 Oct 2026 00:21:39 +0100 Subject: [PATCH mptcp-next v2 1/5] mptcp: no longer fully_established after a fallback X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261030-mptcp-reset-mpj-early-v2-1-90f119392263@kernel.org> References: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> In-Reply-To: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> To: MPTCP Linux Cc: Paolo Abeni , Chenguang Zhao , Gang Yan , "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1031; i=matttbe@kernel.org; h=from:subject:message-id; bh=+GAlv3nBw2U9OsHeNKBTJNjV/0upUjO60WCDq1yrLVw=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLIeX5VoUlyVEN7SOU1em9XURv7rtOwFz+4kbn12LGaH8 Y2TO3a/7yhlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZhIjQLD/7zs5Vum1Js51F3z 3JJS/VnLnKF9Prf//g32PdHOj9Q4jjL8j85tP398g2DlRLvZs9gX+T02OBJ98NjUwo8X4p8lsW5 fzQwA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When a fallback is done, the MPTCP_FALLBACK_DONE bit is set, which is protected by the fallback lock. That's good, but while at it, the msk fully established state can also be reset, to easily prevent some operations. This is just an optimisation to bail early in some situations: with the PM, or when receiving an MP_JOIN. This is not a protection that requires locks to avoid races: the fallback lock and other variables are there for that. Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 02a4f479d9d8..f11393e51757 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -94,6 +94,7 @@ bool __mptcp_try_fallback(struct mptcp_sock *msk, int fb_= mib) return false; } =20 + WRITE_ONCE(msk->fully_established, false); msk->allow_subflows =3D false; set_bit(MPTCP_FALLBACK_DONE, &msk->flags); clear_bit(MPTCP_RTX_ENABLED, &msk->flags); --=20 2.55.0 From nobody Thu Nov 5 07:32:45 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793316130; b=b9XbvXDGCQ+vFk2JOaztWIkRiMi6RkQhhq9kDcjVYaGEQX5scUo28tPNXqRrQv2c1NWj 0PMIKTUqI+XZAbNOxcL7NFQeGTrL8NmXmaNoB9UmI9yNQLDlSowmMmq4xCvOIaYLiddQs Tu9CuTqPQsGxYk9qVXe90dG1uu+ElOe6046gM2s9ITT0y4Jf63JsPlcrWaOwebIKITz9l xY2S//kxmPfcyh8dV+aQACbJrFP8w3V843gM0h64CCGjreNeQyCLju/0ReA850f4I4N4k BIKQ4kB0MI/67FDDnTEXpElGEDZXDE3NcJFehnZzs7T2C5VNO6mJKmte92c4g2y+XzQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793316130; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=Z4ZV+NSCCSurkRLvonHiaYmaxd1TesYLdbcgrrI6v7Y=; b=pqC73YG03XPz2QJUzCycFW7pGWFlSvTAaML97DGDvlAqAojTFTVE8HiN/hGycZ4Npyo4 GTI/Ex8b/JE+AA4G4+mfzhobnQUicMi7Ve+eivLaHoXj8dnqIFO3FTeEhobtxveYEBJrG leRBhymm3CpHoNLP7QD2GwBbM0dUskvUVyEJSNrL6W41skEQ8fgkYPnMmsmAmfFFyAavt 18yAfjLVUQv6mr646Yg21A4aXZjwqSJzQmqDZDTdrhnWFYNY3lyA/bmlKAkSM6uh19y1m L5OrerB6gRvKr2NbwBqtLHF89/4xP/aqzFobHyqiL/kc5e+LqMmaGCzXyOEoW7Mw8bQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jysUHtfg; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EB4D606A31A for ; Thu, 29 Oct 2026 23:22:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jysUHtfg Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8E791F01825; Thu, 29 Oct 2026 23:22:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793316129; bh=Z4ZV+NSCCSurkRLvonHiaYmaxd1TesYLdbcgrrI6v7Y=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=jysUHtfgxhuuUz7fkiP5s9/0e6v/ksnLVLftdD1+uYSV7TPJR5kw7N4vNRMf7Wcil Y+Htrup/WD7/iOZRguTqV55VYl7y9b0ZxKtEzoP+9rXojbbQUL3tqvilgc9Xpr2VOw fB8SjqMvWa91LmbzTvLhkN8RPh89fNGuxHZ5dgAZGGMiRWcKknZ4Naf2HzIYMjQLR6 IvzwWhWMcc9QFiDT1SKbtMRszo8cqYxAT0zlhlLwEg12Jgn8lKrqVR4uMT2XkajWgG iRc1dC2dMjT4oh7e88q53vXqym1GSakfftiqMOK6jpwyBY6aI8jxMdu8vsIzZ571pB nnrTdYEBpJ6QA== From: "Matthieu Baerts (NGI0)" Date: Fri, 30 Oct 2026 00:21:40 +0100 Subject: [PATCH mptcp-next v2 2/5] mptcp: reject MP_JOIN earlier X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261030-mptcp-reset-mpj-early-v2-2-90f119392263@kernel.org> References: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> In-Reply-To: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> To: MPTCP Linux Cc: Paolo Abeni , Chenguang Zhao , Gang Yan , "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=10134; i=matttbe@kernel.org; h=from:subject:message-id; bh=e5vjraxC74KG/sIahmmHMOXnEDBqdOyA3YFgg2ZwNfE=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLIeX5V07db+6fidV6roWrPn/xXX//lcSuk+t36PbfAs6 0PNXDXnO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACbSx8vI8Gp74995WdOPx8zS V2pUF3iw+NWBZdkz9p5PSWZ8XnLb/yEjw5mO4IZC1T3L9t3N4s7U4T29LDS/Zv5HFYlFASxTgn/ KMQMA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When a SYN + MP_JOIN is received, it is good to check directly if the MP_JOIN is allowed, then checking that later at the establishment of the new subflow. This avoids situations where the 3WHS is done, then the joined subflow is rejected. This changes the behaviour, and the new behaviour is tracked with the MPJoinDisallowed MIB counter. Note that in the selftests, we need to support older kernels not following this new behaviour. For that, we can check if the new counter is present: if it is, the join rejected counter should be used instead, and we should see more SYN+ACK. One exception for the SYN cookies case were the reject was already done early but MPJoinRejected was used instead. Signed-off-by: Matthieu Baerts (NGI0) --- v2: - Explain that mptcp_can_accept_new_subflow() is racy, but OK. (Paolo) - support older kernels with the previous behaviour. - no more special case for syncookie, switch to new counter. - s/MPJoinDisallow/MPJoinDisallowed/ (+ ed). (Sashiko) --- net/mptcp/mib.c | 1 + net/mptcp/mib.h | 1 + net/mptcp/subflow.c | 31 +++++++++----- tools/testing/selftests/net/mptcp/mptcp_join.sh | 55 +++++++++++++++++++--= ---- 4 files changed, 64 insertions(+), 24 deletions(-) diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c index 608cb568897c..b1710082bbca 100644 --- a/net/mptcp/mib.c +++ b/net/mptcp/mib.c @@ -34,6 +34,7 @@ static const struct snmp_mib mptcp_snmp_list[] =3D { SNMP_MIB_ITEM("MPJoinAckNoCtx", MPTCP_MIB_MPJOINACKNOCTX), SNMP_MIB_ITEM("MPJoinRejected", MPTCP_MIB_JOINREJECTED), SNMP_MIB_ITEM("MPJoinNotEstablished", MPTCP_MIB_MPJOINNOTESTABLISHED), + SNMP_MIB_ITEM("MPJoinDisallowed", MPTCP_MIB_MPJOINDISALLOWED), SNMP_MIB_ITEM("MPJoinSynTx", MPTCP_MIB_JOINSYNTX), SNMP_MIB_ITEM("MPJoinSynTxCreatSkErr", MPTCP_MIB_JOINSYNTXCREATSKERR), SNMP_MIB_ITEM("MPJoinSynTxBindErr", MPTCP_MIB_JOINSYNTXBINDERR), diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h index 1ebdb55e9534..e97ee2d952a7 100644 --- a/net/mptcp/mib.h +++ b/net/mptcp/mib.h @@ -29,6 +29,7 @@ enum linux_mptcp_mib_field { MPTCP_MIB_MPJOINACKNOCTX, /* MP_RST: no subflow context on ACK */ MPTCP_MIB_JOINREJECTED, /* The PM rejected the JOIN request */ MPTCP_MIB_MPJOINNOTESTABLISHED, /* MP_RST: JOIN on not-fully-established = msk */ + MPTCP_MIB_MPJOINDISALLOWED, /* RST JOIN early if disallowed: fallback/PM = */ MPTCP_MIB_JOINSYNTX, /* Sending a SYN + MP_JOIN */ MPTCP_MIB_JOINSYNTXCREATSKERR, /* Not able to create a socket when sendin= g a SYN + MP_JOIN */ MPTCP_MIB_JOINSYNTXBINDERR, /* Not able to bind() the address when sendin= g a SYN + MP_JOIN */ diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 78e886b20258..f9785e20e209 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -117,7 +117,8 @@ static void subflow_req_create_thmac(struct mptcp_subfl= ow_request_sock *subflow_ subflow_req->thmac =3D get_unaligned_be64(hmac); } =20 -static struct mptcp_sock *subflow_token_join_request(struct request_sock *= req) +static struct mptcp_sock *subflow_token_join_request(struct request_sock *= req, + u8 *reason) { struct mptcp_subflow_request_sock *subflow_req =3D mptcp_subflow_rsk(req); struct mptcp_sock *msk; @@ -126,12 +127,25 @@ static struct mptcp_sock *subflow_token_join_request(= struct request_sock *req) msk =3D mptcp_token_get_sock(sock_net(req_to_sk(req)), subflow_req->token= ); if (!msk) { SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN); + *reason =3D MPTCP_RST_EMPTCP; + return NULL; + } + + /* Stop it early if the subflow cannot be accepted. + * This check is inherently racy, the consistency safeguard is given by + * the fallback check at finish_join time. + */ + if (!mptcp_can_accept_new_subflow(msk)) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINDISALLOWED); + *reason =3D MPTCP_RST_EPROHIBIT; + sock_put((struct sock *)msk); return NULL; } =20 local_id =3D mptcp_pm_get_local_id(msk, (struct sock_common *)req); if (local_id < 0) { SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINNOIDFOUND); + *reason =3D MPTCP_RST_EMPTCP; sock_put((struct sock *)msk); return NULL; } @@ -252,17 +266,19 @@ static int subflow_check_req(struct request_sock *req, SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT); =20 } else if (opt_mp_join && listener->request_mptcp) { + u8 reason; + subflow_req->ssn_offset =3D TCP_SKB_CB(skb)->seq; subflow_req->mp_join =3D 1; subflow_req->backup =3D mp_opt.backup; subflow_req->remote_id =3D mp_opt.join_id; subflow_req->token =3D mp_opt.token; subflow_req->remote_nonce =3D mp_opt.nonce; - subflow_req->msk =3D subflow_token_join_request(req); + subflow_req->msk =3D subflow_token_join_request(req, &reason); =20 /* Can't fall back to TCP in this case. */ if (!subflow_req->msk) { - subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP); + subflow_add_reset_reason(skb, reason); return -EPERM; } =20 @@ -280,15 +296,8 @@ static int subflow_check_req(struct request_sock *req, =20 subflow_req_create_thmac(subflow_req); =20 - if (unlikely(req->syncookie)) { - if (!mptcp_can_accept_new_subflow(subflow_req->msk)) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINREJECTED); - subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); - return -EPERM; - } - + if (unlikely(req->syncookie)) subflow_init_req_cookie_join_save(subflow_req, skb); - } =20 pr_debug("token=3D%u, remote_nonce=3D%u msk=3D%p\n", subflow_req->token, subflow_req->remote_nonce, subflow_req->msk); diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index c3ccce96b45b..308fad861afc 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -78,6 +78,7 @@ unset join_ack_no_mpjoin unset join_ack_no_ctx unset join_not_established unset join_no_id_found +unset join_disallowed =20 unset rst_md5sig unset rst_dss @@ -1595,6 +1596,7 @@ chk_join_nr() local ack_no_ctx=3D${join_ack_no_ctx:-0} local not_established=3D${join_not_established:-0} local no_id_found=3D${join_no_id_found:-0} + local disallowed=3D${join_disallowed:-0} local rc=3D${KSFT_PASS} local count local with_cookie @@ -1617,10 +1619,21 @@ chk_join_nr() if [ -z "$count" ]; then rc=3D${KSFT_SKIP} elif [ "$count" !=3D "$syn_ack_nr" ]; then + # support old kernels without MPTcpExtMPJoinDisallowed counter: + # =3D> connections are rejected later on (MPTcpExtMPJoinRejected) + if [ "${disallowed}" -gt 0 ] && + ! mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinDisallowed" >/dev/null;= then + syn_rej=3D$((syn_rej + disallowed)) + syn_ack_nr=3D$((syn_ack_nr + disallowed)) + fi + # simult connections exceeding the limit with cookie enabled could go up= to # synack validation as the conn limit can be enforced reliably only after # the subflow creation - if [ "$with_cookie" !=3D 2 ] || [ "$count" -le "$syn_ack_nr" ] || [ "$co= unt" -gt "$syn_nr" ]; then + if [ "$count" !=3D "$syn_ack_nr" ] && { + [ "$with_cookie" !=3D 2 ] || + [ "$count" -le "$syn_ack_nr" ] || + [ "$count" -gt "$syn_nr" ]; }; then rc=3D${KSFT_FAIL} print_check "synack rx" fail_test "got $count JOIN[s] synack rx expected $syn_ack_nr" @@ -1658,9 +1671,18 @@ chk_join_nr() if [ -z "$count" ]; then : # ignore skip elif [ "$count" !=3D "$syn_rej" ]; then - rc=3D${KSFT_FAIL} - print_check "syn rejected" - fail_test "got $count JOIN[s] syn rejected expected $syn_rej" + # support old kernels without MPTcpExtMPJoinDisallowed counter: + # =3D> with syncookies, the MPJoinRejected was incremented instead + if [ "$with_cookie" =3D 2 ] && [ "${disallowed}" -gt 0 ] && + ! mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinDisallowed" >/dev/null;= then + syn_rej=3D$((syn_rej + disallowed)) + fi + + if [ "$count" !=3D "$syn_rej" ]; then + rc=3D${KSFT_FAIL} + print_check "syn rejected" + fail_test "got $count JOIN[s] syn rejected expected $syn_rej" + fi fi =20 # Per-event MPTCP_RST_EMPTCP JOIN counters; default 0, gated on @@ -1701,6 +1723,13 @@ chk_join_nr() fail_test "got $count JOIN[s] no id found expected $no_id_found" fi =20 + count=3D$(mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinDisallowed") + if [ -n "$count" ] && [ "$count" !=3D "$disallowed" ]; then + rc=3D${KSFT_FAIL} + print_check "join disallowed" + fail_test "got $count JOIN[s] disallowed expected $disallowed" + fi + print_results "join Rx" ${rc} =20 join_syn_tx=3D"${join_syn_tx:-${syn_nr}}" \ @@ -2180,8 +2209,8 @@ subflows_tests() pm_nl_set_limits $ns2 0 1 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 - join_syn_rej=3D1 \ - chk_join_nr 1 1 0 + join_disallowed=3D1 \ + chk_join_nr 1 0 0 fi =20 # subflow @@ -2210,8 +2239,8 @@ subflows_tests() pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 - join_syn_rej=3D1 \ - chk_join_nr 2 2 1 + join_disallowed=3D1 \ + chk_join_nr 2 1 1 fi =20 # single subflow, dev @@ -3546,7 +3575,7 @@ syncookies_tests() pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 - join_syn_rej=3D1 \ + join_disallowed=3D1 \ chk_join_nr 2 1 1 fi =20 @@ -4092,8 +4121,8 @@ userspace_tests() pm_nl_set_limits $ns2 1 1 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 - join_syn_rej=3D1 \ - chk_join_nr 1 1 0 + join_disallowed=3D1 \ + chk_join_nr 1 0 0 fi =20 # userspace pm type does not send join @@ -4116,8 +4145,8 @@ userspace_tests() pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow sflags=3Dbackup speed=3Dslow \ run_tests $ns1 $ns2 10.0.1.1 - join_syn_rej=3D1 \ - chk_join_nr 1 1 0 + join_disallowed=3D1 \ + chk_join_nr 1 0 0 chk_prio_nr 0 0 0 0 fi =20 --=20 2.55.0 From nobody Thu Nov 5 07:32:45 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793316132; b=QF2M0htWZbQbDt7WkoVW9oMFP1F6WyPmBe0StLUP4cD3yNuhKWikq+TIhCsD78Rz5wAn WwUMK2V7vrw5VzFTL8jPhqdzANtLrrpKXtTecSK3rXT0oPWAGcWx2ycYw9Tee60Vy2jJp isz3JC1swf5hDvyPRCkI5n5NPF9Z3fwqa+7V9lmrRciBuG4xNRoN34DBEYk0WhFqcqDoc NY3H4w5hih+tsmm4M3eP0RCXUndi3wxCgaVibfi+RCS1lrSb4WPzOGB92B9LLmWOzZga0 tbtlrCuU7yN030JPxWuqF94XUvfLn4hIqFYNP8JbuZRzKG/XRHriwNKNo5OY0bQ3kDg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793316132; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=ofd+qT7rZ+7/1JgYE+QZsiVah8zOgG1yfTI4XPBplDQ=; b=k3PfCK9M0+ZGYVx2gB+hwC7vmFDBgNJI8xE0t4AmkZHmwDy6iI1qZkOfD9ONFnp8BUqB wtOH/Doq8pd8XoHXiRrNC8kKAKhE2UemhUONmxOsiTc/sirhCkHbFNYcAxbiMcKwrtoDO 7lZydjpYu4Ndi3Ksi1RQBWlJe/74lTzAJrql6ZB00Nxsr5xKr2aqo5pbokhwQkhR4BSZu 3J9e2TXrKh7lDP+8nXqI6SOHEjhAiJKFYsjGstfLlWroXKskAfsWAchkl1LMBZ+vDAxBd ibJvJ9Mzh8rvN8jDO3YYyub9LYFJEJF9XLUD+V9USlLd7cawQiRLWdjzE0FR9bNZrEA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=YXebYZKI; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB238606A31A for ; Thu, 29 Oct 2026 23:22:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=YXebYZKI Received: by smtp.kernel.org (Postfix) with ESMTPSA id 395771F01824; Thu, 29 Oct 2026 23:22:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793316131; bh=ofd+qT7rZ+7/1JgYE+QZsiVah8zOgG1yfTI4XPBplDQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=YXebYZKI1I1kS65YSNK87B0dgrHP0u4+k8d7+ku9NLRe2Esa9NHE+TxGBpwdozE5u IsIWSMrgjDm4O04QL7cPC1YNrmUSC2CDKDQgYaJT3WqW5F+WuUg40NglKFZVGXE91V H0i2sLr/ulB5ihPDzPXG7xzVHSiS18zAwOyDpsTsf/iX0ZqB2iEm1rbboszS42q6Qk d9ACthz0QnkNxY4XYhPRicU8BFj8uza4105Hmw5zlhM5pib82OANLQ208EnIkOniE7 vTSqIRyKzO85k77LCeJNkeYreo7QXfOwA1N1o527Lw01Dqfhv/IXLtVPoRbT7I0DEu HIOr++baM1xig== From: "Matthieu Baerts (NGI0)" Date: Fri, 30 Oct 2026 00:21:41 +0100 Subject: [PATCH mptcp-next v2 3/5] mptcp: subflow: split subflow_check_req() X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261030-mptcp-reset-mpj-early-v2-3-90f119392263@kernel.org> References: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> In-Reply-To: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> To: MPTCP Linux Cc: Paolo Abeni , Chenguang Zhao , Gang Yan , "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=9132; i=matttbe@kernel.org; h=from:subject:message-id; bh=s2mwdgSBo3odqZGeX/p1TZSunrF9WB5ATJNuRblN1zY=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLIeX5V+dcP79qGytU8uh2f0a74Oqdu9XVDx50HO75Njm 385vv1m0VHKwiDGxSArpsgi3RaZP/N5FW+Jl58FzBxWJpAhDFycAjCRHkuG/yUGuXP3Xgjp/rLr Y9H2+LjVq0vPXdzHcF1umoud5ux3m28x/C/6LLuB77SE0dSuheUiro8yl/yb4y+t4WeVIPfphDu TGhcA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 subflow_check_req() is quite long, and hard to read. Plus the subflow_token_join_request helper is confusing: it also modifies subflow_req to set the local_id and request_bkup. This is a pure refactoring, to reduce subflow_check_req size, no behavioural changes intended. With one exception: it is no longer needed to call sock_put(msk) when new subflows are not accepted, or the local_id is negative, because subflow_req->msk is now set earlier, and the msk refcount will be decremented in the destructor. Signed-off-by: Matthieu Baerts (NGI0) --- v2: new. (Paolo) --- net/mptcp/subflow.c | 219 +++++++++++++++++++++++++++---------------------= ---- 1 file changed, 114 insertions(+), 105 deletions(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index f9785e20e209..be6c8ce48fcd 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -117,44 +117,6 @@ static void subflow_req_create_thmac(struct mptcp_subf= low_request_sock *subflow_ subflow_req->thmac =3D get_unaligned_be64(hmac); } =20 -static struct mptcp_sock *subflow_token_join_request(struct request_sock *= req, - u8 *reason) -{ - struct mptcp_subflow_request_sock *subflow_req =3D mptcp_subflow_rsk(req); - struct mptcp_sock *msk; - int local_id; - - msk =3D mptcp_token_get_sock(sock_net(req_to_sk(req)), subflow_req->token= ); - if (!msk) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN); - *reason =3D MPTCP_RST_EMPTCP; - return NULL; - } - - /* Stop it early if the subflow cannot be accepted. - * This check is inherently racy, the consistency safeguard is given by - * the fallback check at finish_join time. - */ - if (!mptcp_can_accept_new_subflow(msk)) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINDISALLOWED); - *reason =3D MPTCP_RST_EPROHIBIT; - sock_put((struct sock *)msk); - return NULL; - } - - local_id =3D mptcp_pm_get_local_id(msk, (struct sock_common *)req); - if (local_id < 0) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINNOIDFOUND); - *reason =3D MPTCP_RST_EMPTCP; - sock_put((struct sock *)msk); - return NULL; - } - subflow_req->local_id =3D local_id; - subflow_req->request_bkup =3D mptcp_pm_is_backup(msk, (struct sock_common= *)req); - - return msk; -} - static void subflow_init_req(struct request_sock *req, const struct sock *= sk_listener) { struct mptcp_subflow_request_sock *subflow_req =3D mptcp_subflow_rsk(req); @@ -189,6 +151,112 @@ static int subflow_reset_req_endp(struct request_sock= *req, struct sk_buff *skb) return -EPERM; } =20 +static int subflow_check_req_mp_join(struct request_sock *req, + const struct sock *sk_listener, + struct sk_buff *skb, + struct mptcp_options_received *mp_opt) +{ + struct mptcp_subflow_request_sock *subflow_req =3D mptcp_subflow_rsk(req); + int local_id; + + subflow_req->ssn_offset =3D TCP_SKB_CB(skb)->seq; + subflow_req->mp_join =3D 1; + subflow_req->backup =3D mp_opt->backup; + subflow_req->remote_id =3D mp_opt->join_id; + subflow_req->token =3D mp_opt->token; + subflow_req->remote_nonce =3D mp_opt->nonce; + /* The msk refcount will be decremented in subflow_req_destructor */ + subflow_req->msk =3D mptcp_token_get_sock(sock_net(req_to_sk(req)), + subflow_req->token); + + /* Can't fall back to TCP in this case. */ + if (!subflow_req->msk) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN); + subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP); + return -EPERM; + } + + /* Stop it early if the subflow cannot be accepted. + * This check is inherently racy, the consistency safeguard is given by + * the fallback check at finish_join time. + */ + if (!mptcp_can_accept_new_subflow(subflow_req->msk)) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINDISALLOWED); + subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); + return -EPERM; + } + + if (subflow_use_different_sport(subflow_req->msk, sk_listener)) { + pr_debug("syn inet_sport=3D%d %d\n", + ntohs(inet_sk(sk_listener)->inet_sport), + ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport)); + if (!mptcp_pm_announced_has_ssk(subflow_req->msk, sk_listener)) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX); + subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); + return -EPERM; + } + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTSYNRX); + } + + local_id =3D mptcp_pm_get_local_id(subflow_req->msk, + (struct sock_common *)req); + if (local_id < 0) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPJOINNOIDFOUND); + subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP); + return -EPERM; + } + subflow_req->local_id =3D local_id; + subflow_req->request_bkup =3D mptcp_pm_is_backup(subflow_req->msk, + (struct sock_common *)req); + subflow_req_create_thmac(subflow_req); + + if (unlikely(req->syncookie)) + subflow_init_req_cookie_join_save(subflow_req, skb); + + pr_debug("token=3D%u, remote_nonce=3D%u msk=3D%p\n", subflow_req->token, + subflow_req->remote_nonce, subflow_req->msk); + + return 0; +} + +static int subflow_check_req_mp_capable(struct request_sock *req, + struct sk_buff *skb) +{ + struct mptcp_subflow_request_sock *subflow_req =3D mptcp_subflow_rsk(req); + int err, retries =3D MPTCP_TOKEN_MAX_RETRIES; + + subflow_req->ssn_offset =3D TCP_SKB_CB(skb)->seq; +again: + do { + get_random_bytes(&subflow_req->local_key, + sizeof(subflow_req->local_key)); + } while (subflow_req->local_key =3D=3D 0); + + if (unlikely(req->syncookie)) { + mptcp_crypto_key_sha(subflow_req->local_key, + &subflow_req->token, + &subflow_req->idsn); + if (mptcp_token_exists(subflow_req->token)) { + if (retries-- > 0) + goto again; + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT); + } else { + subflow_req->mp_capable =3D 1; + } + return 0; + } + + err =3D mptcp_token_new_request(req); + if (err =3D=3D 0) + subflow_req->mp_capable =3D 1; + else if (retries-- > 0) + goto again; + else + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT); + + return 0; +} + /* Init mptcp request socket. * * Returns an error code if a JOIN has failed and a TCP reset @@ -234,74 +302,15 @@ static int subflow_check_req(struct request_sock *req, return subflow_reset_req_endp(req, skb); } =20 - if (opt_mp_capable && listener->request_mptcp) { - int err, retries =3D MPTCP_TOKEN_MAX_RETRIES; + if (!listener->request_mptcp) + return 0; =20 - subflow_req->ssn_offset =3D TCP_SKB_CB(skb)->seq; -again: - do { - get_random_bytes(&subflow_req->local_key, sizeof(subflow_req->local_key= )); - } while (subflow_req->local_key =3D=3D 0); + if (opt_mp_capable) + return subflow_check_req_mp_capable(req, skb); =20 - if (unlikely(req->syncookie)) { - mptcp_crypto_key_sha(subflow_req->local_key, - &subflow_req->token, - &subflow_req->idsn); - if (mptcp_token_exists(subflow_req->token)) { - if (retries-- > 0) - goto again; - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT); - } else { - subflow_req->mp_capable =3D 1; - } - return 0; - } - - err =3D mptcp_token_new_request(req); - if (err =3D=3D 0) - subflow_req->mp_capable =3D 1; - else if (retries-- > 0) - goto again; - else - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT); - - } else if (opt_mp_join && listener->request_mptcp) { - u8 reason; - - subflow_req->ssn_offset =3D TCP_SKB_CB(skb)->seq; - subflow_req->mp_join =3D 1; - subflow_req->backup =3D mp_opt.backup; - subflow_req->remote_id =3D mp_opt.join_id; - subflow_req->token =3D mp_opt.token; - subflow_req->remote_nonce =3D mp_opt.nonce; - subflow_req->msk =3D subflow_token_join_request(req, &reason); - - /* Can't fall back to TCP in this case. */ - if (!subflow_req->msk) { - subflow_add_reset_reason(skb, reason); - return -EPERM; - } - - if (subflow_use_different_sport(subflow_req->msk, sk_listener)) { - pr_debug("syn inet_sport=3D%d %d\n", - ntohs(inet_sk(sk_listener)->inet_sport), - ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport)); - if (!mptcp_pm_announced_has_ssk(subflow_req->msk, sk_listener)) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX); - subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); - return -EPERM; - } - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTSYNRX); - } - - subflow_req_create_thmac(subflow_req); - - if (unlikely(req->syncookie)) - subflow_init_req_cookie_join_save(subflow_req, skb); - - pr_debug("token=3D%u, remote_nonce=3D%u msk=3D%p\n", subflow_req->token, - subflow_req->remote_nonce, subflow_req->msk); - } + if (opt_mp_join) + return subflow_check_req_mp_join(req, sk_listener, skb, + &mp_opt); =20 return 0; } @@ -2148,7 +2157,7 @@ static void subflow_ulp_clone(const struct request_so= ck *req, new_ctx->token =3D subflow_req->token; =20 /* the subflow req id is valid, fetched via subflow_check_req() - * and subflow_token_join_request() + * and subflow_check_req_mp_join() */ subflow_set_local_id(new_ctx, subflow_req->local_id); } --=20 2.55.0 From nobody Thu Nov 5 07:32:45 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793316133; b=jgfJhs276NmC41vvhtTTscbSm1mbupRF0WthQwUmml7ltf7KJRzwFaAZTAAbpn19KTMU uGMmNbAGF2QU2kr97rUWKCGtIw8jREHP2D90rE+nAOo/bybZ3Z5Vrhp3Vlh5cTZeYjyR2 s6VH7Z2cwLIjJ63dFgrJhIKMrKRriVJR0VBMBkUwbN1uydVWb10cC60LunJLx3w4VRLzk aTlXmsTfQ11JlpSMXpmWXjVn1Wlb5Xk8X3kpxbeOTubOXmixMZz2Nvco47wM91hRmUaLv KqU8kl6imvHRrq0hmkS0irYaBUjFy8ciuihdLH9rUxuFQ8CCkyM+rZEO80H0T2/82xg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793316133; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=0mwfzXjgJR769+bZp2OdJ/gIcyw6eV9uDbrZYfYqy94=; b=FHsJLPJhP7lTI/7ylkcWHgth/uK3PclehL6wF2Xtmcu9iP9iHgS2qKka5Ps6H00DwF/Z mBteiIaPR2UP4Ldnla2teqn/yJaiFiQHqLkw5lke52yZoehjI3aWgi/BUQaPrR9ehmHKy Fgt4CzsZ5cskqFJirv2kEKVVlXMcAh5ApQVbsLoooSXFmJ4j9AkxSo37DrupFVpl/xGyL B/aloPqfThORbOdTkLpfd/q7YFXZtv5eCkbG0L1V62jkiQPOEhcsQamMwrvJ0BcXhgQVG +sQTd2uVM/9EOwJ1S+H08JcniWciytqxkL9NFlY9BA20BxumG3HSeag7bVRdOxsr8Iw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=S1IGMcT0; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C51E4606A31A for ; Thu, 29 Oct 2026 23:22:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=S1IGMcT0 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DDBA1F01829; Thu, 29 Oct 2026 23:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793316132; bh=0mwfzXjgJR769+bZp2OdJ/gIcyw6eV9uDbrZYfYqy94=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=S1IGMcT08ao0hwDGJzqBdAkNO4DApUFqp8GnaCnfdloVF0tQVkpQPXq33zy9MXBFn VwrrHyWCVjPM3XrZNvZ8ORlH+pvFzLEWVtqsqviKRHIoAV2gzgohc/yV7wY9Mr7BEY 5YjHNYxfBHCNq21pZjS5qzFsxCuWw/aw6gRhI+5IHFw2+3TdWWXfIfcruNLGsURU+H RTtZPnsSB2lhB+jv6Y6GGs+NTUWxBUFq799ChP7rBGZ6arHiaj4n/+s5SM2sFbPLqY 3WBa8MgmrExFADKhSOwjW6fUhhfvO8f5v/HPZbT/ywQ2nurSxySSBU5OCkmxJ3kwy8 p2VVHW+rm6/PA== From: "Matthieu Baerts (NGI0)" Date: Fri, 30 Oct 2026 00:21:42 +0100 Subject: [PATCH mptcp-next v2 4/5] mptcp: pm: kernel: skip operating on closing connections X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261030-mptcp-reset-mpj-early-v2-4-90f119392263@kernel.org> References: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> In-Reply-To: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> To: MPTCP Linux Cc: Paolo Abeni , Chenguang Zhao , Gang Yan , "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2910; i=matttbe@kernel.org; h=from:subject:message-id; bh=woq2Ebd+o/geGRTdpEwZaJeha2d3xtjlNHgyH/ud76k=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLIeX5VJOmllLrR4npY7307nj78vsfosVdGMr1RSzFyc+ MHOTGhZRykLgxgXg6yYIot0W2T+zOdVvCVefhYwc1iZQIYwcHEKwER2v2Fk2F6ZEzrzu7IUQ7iu VG7MmQ/HtHRad4Rc+CUkq9jWu+22IsM/i0tSk44F2EQ2vJ7wZpNvutocP/ON7Ivrbh4RP3yde2Y LLwA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When iterating over each MPTCP connection after having manipulated MPTCP endpoints, there is no need to operate on closing (or not ready) connections. We can then safely skip those. Note that mptcp_nl_add_subflow_or_signal_addr() was already checking the fully_established state, but it is better to check the connection state with mptcp_is_fully_established(): no need to create new subflows or signal new addresses if we are closing. For the other states, better not to check the connection state: it might still be interesting to do some signalling while the connection is half closed. Signed-off-by: Matthieu Baerts (NGI0) --- v2: don't check the connection state, except for new subflow/ADD_ADDR. --- net/mptcp/pm_kernel.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index d3014bf57bf3..096ffea80f61 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c @@ -969,7 +969,7 @@ static int mptcp_nl_add_subflow_or_signal_addr(struct n= et *net, struct sock *sk =3D (struct sock *)msk; struct mptcp_addr_info mpc_addr; =20 - if (!READ_ONCE(msk->fully_established) || + if (!mptcp_is_fully_established(sk) || mptcp_pm_is_userspace(msk)) goto next; =20 @@ -1095,7 +1095,8 @@ static int mptcp_nl_remove_subflow_and_signal_addr(st= ruct net *net, struct sock *sk =3D (struct sock *)msk; bool remove_subflow; =20 - if (mptcp_pm_is_userspace(msk)) + if (!READ_ONCE(msk->fully_established) || + mptcp_pm_is_userspace(msk)) goto next; =20 lock_sock(sk); @@ -1141,7 +1142,9 @@ static int mptcp_nl_remove_id_zero_address(struct net= *net, struct mptcp_addr_info anno_addr; bool announced; =20 - if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk)) + if (list_empty(&msk->conn_list) || + !READ_ONCE(msk->fully_established) || + mptcp_pm_is_userspace(msk)) goto next; =20 mptcp_local_address((struct sock_common *)msk, &msk_local); @@ -1288,7 +1291,8 @@ static void mptcp_nl_flush_addrs_list(struct net *net, while ((msk =3D mptcp_token_iter_next(net, &s_slot, &s_num)) !=3D NULL) { struct sock *sk =3D (struct sock *)msk; =20 - if (!mptcp_pm_is_userspace(msk)) { + if (READ_ONCE(msk->fully_established) && + !mptcp_pm_is_userspace(msk)) { lock_sock(sk); mptcp_pm_flush_addrs_and_subflows(msk, rm_list, NULL); release_sock(sk); @@ -1502,7 +1506,9 @@ static void mptcp_pm_nl_set_flags_all(struct net *net, while ((msk =3D mptcp_token_iter_next(net, &s_slot, &s_num)) !=3D NULL) { struct sock *sk =3D (struct sock *)msk; =20 - if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk)) + if (list_empty(&msk->conn_list) || + !READ_ONCE(msk->fully_established) || + mptcp_pm_is_userspace(msk)) goto next; =20 lock_sock(sk); --=20 2.55.0 From nobody Thu Nov 5 07:32:45 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793316134; b=ebndOzdR/aa7yRj3xYXTxFG4NG0AuNWx8NCd+x/olUNOvqguzl0PXic8gNEHW5s1i/xA W1S6FzxGNDK2pUdnmJY4L1FXC7vFB2yuiqj1fRcyDTQrf6hdpsUtL7q/Y6PROJoCqZ814 gvsmVQvVzZSsV7WrPWLa3ISgO8X+Iy8rJUCooBII8k6dOcRcx0Sm3WiAq57XmoVJ09LyA OJmUUcUObXzuMajvz6QwijQflSoiP08dDzeEUXZ5gN0TALGSFuzepAnZ0gGgGJl/7178U MQi6OQFQB/oiiBPWvRrv2k52K1J6Ge3ZHsybxK4u0KQQoAhJ0l1OBnLPqGqYp5/hqOw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793316134; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=HyCkS8rRWl0pRzwjO6c4qhtJD8Oar1dl5moffglq0iE=; b=OlaY/pUxSexyrJVfsNhqSfFUqk4A0KzjMhUpQbB51Ucd7Pagj/fCXLr8/zBoBVAV9eej 1Z28dl1u9otd8IV76F0uIZvNRxbvwAzbm8ymm2ikO6KBsKfeLouzli0ucIwkO+NpERGGj GJNnWWf9z0C7ReT2l58AQBfKXecNkMoYqFLOv8Y96rdK0+hAZ3hZw4f7Xeo8diw5zSvEj vm97KptdGRk3JMxR9BayLvpQCMnU6PrVIyJwuafjul11PpsUZCEOG8Rwmvd8FMbnSQKE3 5KKAzfXtz6eS3coTy8wQz2IiUNxady3jm1dKDxvNi0JAWmjaqEojjFwg0bntfYq9KjA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=fambBQbL; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9A65606A31A for ; Thu, 29 Oct 2026 23:22:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=fambBQbL Received: by smtp.kernel.org (Postfix) with ESMTPSA id C27C81F01826; Thu, 29 Oct 2026 23:22:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793316133; bh=HyCkS8rRWl0pRzwjO6c4qhtJD8Oar1dl5moffglq0iE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fambBQbLUP6r1+u0TKLHUr03B7lM10zwl/9KOHeJy7hRS+iSaSIHhnRkq+8Mbbs+B PsVgFSV9L+DiSafnO580M8KNEydqfHrJUJx8qJf0KDKTPMa0jjCMwlUb2HAUlKWlw/ V6uTzrjPsD3qtckefmple/DaDxjnJXPHVUeluYTim0F0LMV0D0Ntl5GMeJXh8qzGU6 jXPM8SPRERFEEzmNIGf1ewdcSEM7tFWe0/QTR2Sge17U2illcjvdwDORgXGb49hmkZ QfgZ/hpmgRlE7L3R+BzITUwAk+zD9ua7eGTkzmnly7Nfb8hDxHlO+6u/sM4M2XlVnn 2bHP3mJiRM09A== From: "Matthieu Baerts (NGI0)" Date: Fri, 30 Oct 2026 00:21:43 +0100 Subject: [PATCH mptcp-next v2 5/5] mptcp: pm: kernel: avoid mptcp_pm_is_userspace checks X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261030-mptcp-reset-mpj-early-v2-5-90f119392263@kernel.org> References: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> In-Reply-To: <20261030-mptcp-reset-mpj-early-v2-0-90f119392263@kernel.org> To: MPTCP Linux Cc: Paolo Abeni , Chenguang Zhao , Gang Yan , "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2014; i=matttbe@kernel.org; h=from:subject:message-id; bh=mKiqJx82yHSZxVlMvmsYjk/GQTMm/9kWzwXJL5d8PJg=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLIeX5U1sTqX7hGY/mLWMpug6i/bGLff3N+uuT7pTCOT8 /yqA6/6OkpZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACaykpfhf8aBaUv4ls+bO3+H rtZjt8r3DDavfxuvaF+5Yq7qfcmcLkeG/0kL7ByNz1m////PVjwjx0Ri+gPtUw5ltstiS4U+Hzq Xxw4A X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 It is strange to see them in the kernel code, plus it is more logical that way: only do in-kernel PM specific for this PM. Signed-off-by: Matthieu Baerts (NGI0) --- v2: new --- net/mptcp/pm_kernel.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index 096ffea80f61..670db79ff4d3 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c @@ -970,7 +970,7 @@ static int mptcp_nl_add_subflow_or_signal_addr(struct n= et *net, struct mptcp_addr_info mpc_addr; =20 if (!mptcp_is_fully_established(sk) || - mptcp_pm_is_userspace(msk)) + !mptcp_pm_is_kernel(msk)) goto next; =20 /* if the endp linked to the init sf is re-added with a !=3D ID */ @@ -1096,7 +1096,7 @@ static int mptcp_nl_remove_subflow_and_signal_addr(st= ruct net *net, bool remove_subflow; =20 if (!READ_ONCE(msk->fully_established) || - mptcp_pm_is_userspace(msk)) + !mptcp_pm_is_kernel(msk)) goto next; =20 lock_sock(sk); @@ -1144,7 +1144,7 @@ static int mptcp_nl_remove_id_zero_address(struct net= *net, =20 if (list_empty(&msk->conn_list) || !READ_ONCE(msk->fully_established) || - mptcp_pm_is_userspace(msk)) + !mptcp_pm_is_kernel(msk)) goto next; =20 mptcp_local_address((struct sock_common *)msk, &msk_local); @@ -1292,7 +1292,7 @@ static void mptcp_nl_flush_addrs_list(struct net *net, struct sock *sk =3D (struct sock *)msk; =20 if (READ_ONCE(msk->fully_established) && - !mptcp_pm_is_userspace(msk)) { + mptcp_pm_is_kernel(msk)) { lock_sock(sk); mptcp_pm_flush_addrs_and_subflows(msk, rm_list, NULL); release_sock(sk); @@ -1508,7 +1508,7 @@ static void mptcp_pm_nl_set_flags_all(struct net *net, =20 if (list_empty(&msk->conn_list) || !READ_ONCE(msk->fully_established) || - mptcp_pm_is_userspace(msk)) + !mptcp_pm_is_kernel(msk)) goto next; =20 lock_sock(sk); --=20 2.55.0