From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48D7E35BDA3 for ; Wed, 22 Oct 2025 14:32:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143530; cv=none; b=F314ZP2b2rntsGuARbr5LKNhu6n++Y3gobwU0xh0UlcLj/33ApbPuAwd9VH1xovcFxztbpFrkzCwKzP0zzV2EhX98HGAaOQ4uXLflN1dvpzq5acxobDsLIpDDw6VN3Xww9MjyGVMtCHGLlY1eKa/5Cc8+C8QItp255Y/6n1OODQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143530; c=relaxed/simple; bh=znx2HFTd2rH6xUuCooNzlawKI4U39jMC5Vp6ONfKKQI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=PpYz9OIlJC5g4495mrLEzxUDRaRZ3rvMopGtDPMKQIq68YkTGMR1oJXEgRN+ypaicyi2EUkytjIKeHXiGkx9YoSVfea2m6C70r8jSyeeD2x1zySgooDByVUb71nwK8j2W8TR3WZvJco5vaT9JvqQbrJZ2aIQUm01jsGFpqCl+Ss= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=UVLRXpz1; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="UVLRXpz1" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143527; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zPyAyZpLsNM5P/F8f0f6Eg9OvJ4UQF9u7d6wBBCteYs=; b=UVLRXpz1sVCP8Eawle1zK4/POPnh+BYVFpysITMkfdlBVe2DJ4kZhx1GUc3oNTdl4yCcnh tMDS8luoqzSZoZFKb4azfQUu9KUeFkdwuv4F+zbzy2+536+uwx2QIc4De4pUHRthriMCg0 j+yOE9SQKF5bpbvgt109VDzpLd5ijF8= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-175-9hr0l-J2MNSvczXTrQNakQ-1; Wed, 22 Oct 2025 10:32:03 -0400 X-MC-Unique: 9hr0l-J2MNSvczXTrQNakQ-1 X-Mimecast-MFC-AGG-ID: 9hr0l-J2MNSvczXTrQNakQ_1761143522 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BA0DC1805802; Wed, 22 Oct 2025 14:32:02 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 511561956056; Wed, 22 Oct 2025 14:32:01 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 01/11] mptcp: drop bogus optimization in __mptcp_check_push() Date: Wed, 22 Oct 2025 16:31:44 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: zpZQDEgQaTnrjPGgI3w5_80V9g7htpb3wTEj6roXZu4_1761143522 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data. That in turn could cause unexpected tx lock and timeout. Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses. Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- net/mptcp/protocol.c | 11 ++++------- net/mptcp/protocol.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index f42e28a031f39a..804227736638e3 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -998,7 +998,7 @@ static void __mptcp_clean_una(struct sock *sk) if (WARN_ON_ONCE(!msk->recovery)) break; =20 - WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); + msk->first_pending =3D mptcp_send_next(sk); } =20 dfrag_clear(sk, dfrag); @@ -1543,7 +1543,7 @@ static int __subflow_push_pending(struct sock *sk, st= ruct sock *ssk, =20 mptcp_update_post_push(msk, dfrag, ret); } - WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); + msk->first_pending =3D mptcp_send_next(sk); =20 if (msk->snd_burst <=3D 0 || !sk_stream_memory_free(ssk) || @@ -1903,7 +1903,7 @@ static int mptcp_sendmsg(struct sock *sk, struct msgh= dr *msg, size_t len) get_page(dfrag->page); list_add_tail(&dfrag->list, &msk->rtx_queue); if (!msk->first_pending) - WRITE_ONCE(msk->first_pending, dfrag); + msk->first_pending =3D dfrag; } pr_debug("msk=3D%p dfrag at seq=3D%llu len=3D%u sent=3D%u new=3D%d\n", m= sk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent, @@ -2874,7 +2874,7 @@ static void __mptcp_clear_xmit(struct sock *sk) struct mptcp_sock *msk =3D mptcp_sk(sk); struct mptcp_data_frag *dtmp, *dfrag; =20 - WRITE_ONCE(msk->first_pending, NULL); + msk->first_pending =3D NULL; list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list) dfrag_clear(sk, dfrag); } @@ -3414,9 +3414,6 @@ void __mptcp_data_acked(struct sock *sk) =20 void __mptcp_check_push(struct sock *sk, struct sock *ssk) { - if (!mptcp_send_head(sk)) - return; - if (!sock_owned_by_user(sk)) __mptcp_subflow_push_pending(sk, ssk, false); else diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 0545eab231250d..a3bbce8950a5e0 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -415,7 +415,7 @@ static inline struct mptcp_data_frag *mptcp_send_head(c= onst struct sock *sk) { const struct mptcp_sock *msk =3D mptcp_sk(sk); =20 - return READ_ONCE(msk->first_pending); + return msk->first_pending; } =20 static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk) --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12D0B34C121 for ; Wed, 22 Oct 2025 14:32:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143533; cv=none; b=ZchsyBCqEmrNqQ0G7t1PcYUtSlahLX3RrZDlVki1P/Fr8xx2vCzzn8nfhk1VxEJjPc+W4r7ODy5kXiPaikQnz0XppjfCUhFHCMMfu2GhxChG1pBfO6zLMTwA3SG/887uoUycUztK2etsLK3ZKpUrsjCeXjTKe4qWLqXjfn7zTyk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143533; c=relaxed/simple; bh=M65r3wGCHhYypEpcgzmf3MFhS27QAlIJwXkabHyllF4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=jAHt61JT8Z7UXWho7LIETq6bwtInUCu1paI23gO82xlqGYWPRArFw2WQRKTZhN+bPktUegU+hM4KRp+bsguT7sU7ZQachqND3B6uJztOwL2zx317N9LoFI4jJfnbRHgDlitCWUl+9/o4VukogzzvdcCjShi+unrTu7SDQEA85W8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NW9ndJ1Y; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NW9ndJ1Y" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143529; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TKg15c9LhlrMfzKU6Z28kLvA5dar/+ZIlwoPtQsyR7M=; b=NW9ndJ1YHQMTS/aHcmzhcgMcFjikp+ZI9vbcr9feeCX+H0kiSs5HGXB/bjDQILEV7IkTH2 jaSRzRbYO4+TLLkcJC0DgW/D2D9sRvPLtEzItjZUzgvrrWW4CJaXOFrBvintGZCpmXP6Z0 flCpbAP1zXN3dIStF0SyZ1w4Pewkwk8= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-411-mVrw4jyeOHuyuAuZWUN5jg-1; Wed, 22 Oct 2025 10:32:05 -0400 X-MC-Unique: mVrw4jyeOHuyuAuZWUN5jg-1 X-Mimecast-MFC-AGG-ID: mVrw4jyeOHuyuAuZWUN5jg_1761143524 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AF1241800245; Wed, 22 Oct 2025 14:32:04 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 447651956056; Wed, 22 Oct 2025 14:32:03 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 02/11] mptcp: borrow forward memory from subflow Date: Wed, 22 Oct 2025 16:31:45 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: qtuBAwSDfjg5wY73XKGjK0nDlKTu51EoXhaEGgfZloY_1761143524 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" In the MPTCP receive path, we release the subflow allocated fwd memory just to allocate it again shortly after for the msk. That could increases the failures chances, especially during backlog processing, when other actions could consume the just released memory before the msk socket has a chance to do the rcv allocation. Replace the skb_orphan() call with an open-coded variant that explicitly borrows, with a PAGE_SIZE granularity, the fwd memory from the subflow socket instead of releasing it. During backlog processing the borrowed memory is accounted at release_cb time. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- v1 -> v2: - rebased - explain why skb_orphan is removed --- net/mptcp/protocol.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 804227736638e3..372ae2d9fd229e 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -337,11 +337,12 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *m= sk, struct sk_buff *skb) mptcp_rcvbuf_grow(sk); } =20 -static void mptcp_init_skb(struct sock *ssk, struct sk_buff *skb, int offs= et, - int copy_len) +static int mptcp_init_skb(struct sock *ssk, + struct sk_buff *skb, int offset, int copy_len) { const struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(ssk); bool has_rxtstamp =3D TCP_SKB_CB(skb)->has_rxtstamp; + int borrowed; =20 /* the skb map_seq accounts for the skb offset: * mptcp_subflow_get_mapped_dsn() is based on the current tp->copied_seq @@ -357,6 +358,13 @@ static void mptcp_init_skb(struct sock *ssk, struct sk= _buff *skb, int offset, =20 skb_ext_reset(skb); skb_dst_drop(skb); + + /* "borrow" the fwd memory from the subflow, instead of reclaiming it */ + skb->destructor =3D NULL; + borrowed =3D ssk->sk_forward_alloc - sk_unused_reserved_mem(ssk); + borrowed &=3D ~(PAGE_SIZE - 1); + sk_forward_alloc_add(ssk, skb->truesize - borrowed); + return borrowed; } =20 static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb) @@ -690,9 +698,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mptc= p_sock *msk, =20 if (offset < skb->len) { size_t len =3D skb->len - offset; + int bmem; =20 - mptcp_init_skb(ssk, skb, offset, len); - skb_orphan(skb); + bmem =3D mptcp_init_skb(ssk, skb, offset, len); + skb->sk =3D NULL; + sk_forward_alloc_add(sk, bmem); + atomic_sub(skb->truesize, &ssk->sk_rmem_alloc); ret =3D __mptcp_move_skb(sk, skb) || ret; seq +=3D len; =20 --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 840FB33F8DC for ; Wed, 22 Oct 2025 14:32:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143539; cv=none; b=GOj7Xr/elzZnZNLPEUtxNhw/k8u5BFR1ABUtPC52NMfwuOAjF2EQSaeFtsztOSacLrU93pebTpZ/UJonfy18KNY0BgzvtWw1VTCc2K+Jw+AXLt+iAbxpf/hIaVtmo7meGPeWL6q1YDetBHUM3AzANWIE4iBbKogA+XtzGRLlNaM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143539; c=relaxed/simple; bh=oZyYKPe7uUMeS4kgPt35j5eo6Z61wKpmP/26cOJRnn8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=ndSy4N6+BbNakF4POgxjFxaSZYpHiVD7VLOUT0yIUxB7iM8KPoleiE7prycsFwAnoVwwklsE3gEYY2uif0knCUJBkLvxUJhKlXSjKbVBF6jT3Cfu0kIIzGp4Mm6KyiMxPB2XBYZNGEb67az7tAfWLOWPoY1hcd9yni+SWys8kzA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=BUSWfigh; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="BUSWfigh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143535; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0P+xuL6QyOomNNqsC20omlo8taSnXjOgCXp/nwpVRk8=; b=BUSWfigh/jxVOMCuZstis7dq0c7MRZEQZOegzyajuV8oYwK+QRPBr2+U16sYh05vFlcrTT ea32Mfubc6IhnL+1SSwINrYQj64q9sxuxUiB0ey3j1mz1+c6buHWPRo1GrYrKcmuh2TOqH H6XlISb+SiVAdoO/DL67Yp8nOlO0CVw= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-451-qqNGzLSXOQ64VZZ5bZK2Lw-1; Wed, 22 Oct 2025 10:32:07 -0400 X-MC-Unique: qqNGzLSXOQ64VZZ5bZK2Lw-1 X-Mimecast-MFC-AGG-ID: qqNGzLSXOQ64VZZ5bZK2Lw_1761143526 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9759419560A5; Wed, 22 Oct 2025 14:32:06 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 378D31956056; Wed, 22 Oct 2025 14:32:04 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 03/11] mptcp: cleanup fallback data fin reception Date: Wed, 22 Oct 2025 16:31:46 +0200 Message-ID: <3d0984585464292af2c671af2f532d7251d08a7e.1761142784.git.pabeni@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 0kwR2PTL4xkOuXua0hIxCaacE6PtKF9PpDxa_IJAEJA_1761143526 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" MPTCP currently generate a dummy data_fin for fallback socket when the fallback subflow has completed data reception using the current ack_seq. We are going to introduce backlog usage for the msk soon, even for fallback sockets: the ack_seq value will not match the most recent sequence number seen by the fallback subflow socket, as it will ignore data_seq sitting in the backlog. Instead use the last map sequence number to set the data_fin, as fallback (dummy) map sequences are always in sequence. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Paolo Abeni --- v2 -> v3: - keep the close check in subflow_sched_work_if_closed, fix CI failures --- net/mptcp/subflow.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index e8325890a32238..b9455c04e8a462 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1285,6 +1285,7 @@ static bool subflow_is_done(const struct sock *sk) /* sched mptcp worker for subflow cleanup if no more data is pending */ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct so= ck *ssk) { + const struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(ssk); struct sock *sk =3D (struct sock *)msk; =20 if (likely(ssk->sk_state !=3D TCP_CLOSE && @@ -1303,7 +1304,8 @@ static void subflow_sched_work_if_closed(struct mptcp= _sock *msk, struct sock *ss */ if (__mptcp_check_fallback(msk) && subflow_is_done(ssk) && msk->first =3D=3D ssk && - mptcp_update_rcv_data_fin(msk, READ_ONCE(msk->ack_seq), true)) + mptcp_update_rcv_data_fin(msk, subflow->map_seq + + subflow->map_data_len, true)) mptcp_schedule_work(sk); } =20 --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5362E34C121 for ; Wed, 22 Oct 2025 14:32:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143537; cv=none; b=UY4gULbkQa8vWDpWpQoIaeqGpYgW6vCZb7x0kr5XPvZSsJmn1FO+A48xNtbLzHb9N4MwhJAyP+zxMLThBmToaYq46C85A6xz8aLEoAsZkyS9NI7wZsya4AYy6fN/IAAXUiv9DinznV+ZjNAAGaIYGh2rmUfuppEBJJvUUjI1nyw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143537; c=relaxed/simple; bh=kA8vd/GNw50g13H/UPvsPo9sv6I4n3K82Ytjd2I4QUQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=jbkqzx9rI9petibXTX6wVk8CsSzx4QQUuXKnRUIxyQ/H5OtJ+81adwtbJfGFAm2Kzs/7QMinBNLhrQBbr8j39pO8MjJgx1DVgP2LgzsrVyb4k3GR2ijLeYJ/IIMvp4VmyTLBdnP8rRg6UGEEOz4JRMcwDR4ry3zf46QKl6bvjmM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=T1ToBCQh; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="T1ToBCQh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hMKRN/j7zUvuRprYvSHHKMxMhHAR3ssijBExuINanhM=; b=T1ToBCQhplSC/F62PtsVuJFY0EhWn/ji78Nbp4RolweCYLDgWq/Xu042fNvS8Vf5TrlwiH IvXMRDumCg/ZQwot1ZhLG2FHgtyJEWSKxYsPEZnOzTIy6es6vb+W0qfaGroV8uELxv//19 pG+zru+X+wjK0mTf0zWVbhLBx07+oAk= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-237-KAaQRkaYNWy6zi5BhS0GBg-1; Wed, 22 Oct 2025 10:32:09 -0400 X-MC-Unique: KAaQRkaYNWy6zi5BhS0GBg-1 X-Mimecast-MFC-AGG-ID: KAaQRkaYNWy6zi5BhS0GBg_1761143528 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 949B418001D1; Wed, 22 Oct 2025 14:32:08 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 330E41956056; Wed, 22 Oct 2025 14:32:06 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 04/11] mptcp: cleanup fallback dummy mapping generation Date: Wed, 22 Oct 2025 16:31:47 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: GoXjq_YbmVoyfirPeGi1ZCTuTUfFyFyvbl_HejvHzXI_1761143528 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" MPTCP currently access ack_seq outside the msk socket log scope to generate the dummy mapping for fallback socket. Soon we are going to introduce backlog usage and even for fallback socket the ack_seq value will be significantly off outside of the msk socket lock scope. Avoid relying on ack_seq for dummy mapping generation, using instead the subflow sequence number. Note that in case of disconnect() and (re)connect() we must ensure that any previous state is re-set. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- v2 -> v3: - reordered before the backlog introduction to avoid transiently break the fallback - explicitly reset ack_seq --- net/mptcp/protocol.c | 3 +++ net/mptcp/subflow.c | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 372ae2d9fd229e..51c55a45aeaccd 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3234,6 +3234,9 @@ static int mptcp_disconnect(struct sock *sk, int flag= s) msk->bytes_retrans =3D 0; msk->rcvspace_init =3D 0; =20 + /* for fallback's sake */ + WRITE_ONCE(msk->ack_seq, 0); + WRITE_ONCE(sk->sk_shutdown, 0); sk_error_report(sk); return 0; diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index b9455c04e8a462..ac8616e7521e8a 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -491,6 +491,9 @@ static void subflow_set_remote_key(struct mptcp_sock *m= sk, mptcp_crypto_key_sha(subflow->remote_key, NULL, &subflow->iasn); subflow->iasn++; =20 + /* for fallback's sake */ + subflow->map_seq =3D subflow->iasn; + WRITE_ONCE(msk->remote_key, subflow->remote_key); WRITE_ONCE(msk->ack_seq, subflow->iasn); WRITE_ONCE(msk->can_ack, true); @@ -1435,9 +1438,12 @@ static bool subflow_check_data_avail(struct sock *ss= k) =20 skb =3D skb_peek(&ssk->sk_receive_queue); subflow->map_valid =3D 1; - subflow->map_seq =3D READ_ONCE(msk->ack_seq); subflow->map_data_len =3D skb->len; subflow->map_subflow_seq =3D tcp_sk(ssk)->copied_seq - subflow->ssn_offse= t; + subflow->map_seq =3D __mptcp_expand_seq(subflow->map_seq, + subflow->iasn + + TCP_SKB_CB(skb)->seq - + subflow->ssn_offset - 1); WRITE_ONCE(subflow->data_avail, true); return true; } --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1BFF34C996 for ; Wed, 22 Oct 2025 14:32:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143536; cv=none; b=EZVwyG8C66ftCPHYDpySJrP39Nqf/P5yQmibxTF2vV2Iu3nyWStH+44F5y2eLmR1v9GWcZOS+lQbhOJBfysRHfLhiJJS+UHnwUmGidLsKZRF7MbV5Iy8/So1wyO7Jw6v046kVP1WMI5BLAukRIqjAsFq4jHw0RTpJfy0MYhUzR0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143536; c=relaxed/simple; bh=wcFbRlFn09cO8JrFl3jDJjSD6lD1/6FbycDMfK2/uvc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=FH191E3VffrOwdkXY3JTtoYd3phG4gMaDzFuqZB5Vc8ZOgz6kwpErf4senLgfYmF0+u1T4KhoJwX/Ht7EHQmAaflofuwKoI47qRs+I9rsnq8VJjAZkvFoXfzrMvG/RZeWoAA7PC/2lugeeR1iWbDpYgwhhBGlivvVh8UzoPzeS0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Zn7B3jK5; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Zn7B3jK5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=t26jJwvEzgZECrnxA8C544K1Fn9+fuNz+u1NXmq+UJE=; b=Zn7B3jK51B69hsA5LV4WImokzhbQSKQeV8Yk60Zw76aEJ9BgcKvWJ+o+jV7KPWwb10ryOA oAkMX0KTBnYC4yq1Nl9qcd8aoDmvgyn+QBz3crZPKHPVIw+lKuGNeDrE1HPHaNyqWvSj3W Gntp0BTx+rIQbu5zVNLcDTBwP1+7waY= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-340-r4SP96U_OFek7JAA0wSk9g-1; Wed, 22 Oct 2025 10:32:11 -0400 X-MC-Unique: r4SP96U_OFek7JAA0wSk9g-1 X-Mimecast-MFC-AGG-ID: r4SP96U_OFek7JAA0wSk9g_1761143530 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 820D41800D81; Wed, 22 Oct 2025 14:32:10 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1B40E1956056; Wed, 22 Oct 2025 14:32:08 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 05/11] mptcp: fix MSG_PEEK stream corruption Date: Wed, 22 Oct 2025 16:31:48 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: vJc-eb8GeyGbpARA6GBAFBwMkuGvfDnOonHO20UfJfc_1761143530 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the receive queue and recvmsg() need to waits for more data - i.e. it's a blocking one - upon arrival of the next packet the MPTCP protocol will start again copying the oldest data present in the receive queue, corrupting the data stream. Address the issue explicitly tracking the peeked sequence number, restarting from the last peeked byte. Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support") Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- This may sound quite esoteric, but it will soon become very easy to reproduce with mptcp_connect, thanks to the backlog. --- net/mptcp/protocol.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 51c55a45aeaccd..200b657080eb3e 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1947,22 +1947,36 @@ static int mptcp_sendmsg(struct sock *sk, struct ms= ghdr *msg, size_t len) =20 static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied); =20 -static int __mptcp_recvmsg_mskq(struct sock *sk, - struct msghdr *msg, - size_t len, int flags, +static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg, + size_t len, int flags, int copied_total, struct scm_timestamping_internal *tss, int *cmsg_flags) { struct mptcp_sock *msk =3D mptcp_sk(sk); struct sk_buff *skb, *tmp; + int total_data_len =3D 0; int copied =3D 0; =20 skb_queue_walk_safe(&sk->sk_receive_queue, skb, tmp) { - u32 offset =3D MPTCP_SKB_CB(skb)->offset; + u32 delta, offset =3D MPTCP_SKB_CB(skb)->offset; u32 data_len =3D skb->len - offset; - u32 count =3D min_t(size_t, len - copied, data_len); + u32 count; int err; =20 + if (flags & MSG_PEEK) { + /* skip already peeked skbs*/ + if (total_data_len + data_len <=3D copied_total) { + total_data_len +=3D data_len; + continue; + } + + /* skip the already peeked data in the current skb */ + delta =3D copied_total - total_data_len; + offset +=3D delta; + data_len -=3D delta; + } + + count =3D min_t(size_t, len - copied, data_len); if (!(flags & MSG_TRUNC)) { err =3D skb_copy_datagram_msg(skb, offset, msg, count); if (unlikely(err < 0)) { @@ -1979,16 +1993,14 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, =20 copied +=3D count; =20 - if (count < data_len) { - if (!(flags & MSG_PEEK)) { + if (!(flags & MSG_PEEK)) { + msk->bytes_consumed +=3D count; + if (count < data_len) { MPTCP_SKB_CB(skb)->offset +=3D count; MPTCP_SKB_CB(skb)->map_seq +=3D count; - msk->bytes_consumed +=3D count; + break; } - break; - } =20 - if (!(flags & MSG_PEEK)) { /* avoid the indirect call, we know the destructor is sock_rfree */ skb->destructor =3D NULL; skb->sk =3D NULL; @@ -1996,7 +2008,6 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, sk_mem_uncharge(sk, skb->truesize); __skb_unlink(skb, &sk->sk_receive_queue); skb_attempt_defer_free(skb); - msk->bytes_consumed +=3D count; } =20 if (copied >=3D len) @@ -2194,7 +2205,8 @@ static int mptcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, while (copied < len) { int err, bytes_read; =20 - bytes_read =3D __mptcp_recvmsg_mskq(sk, msg, len - copied, flags, &tss, = &cmsg_flags); + bytes_read =3D __mptcp_recvmsg_mskq(sk, msg, len - copied, flags, + copied, &tss, &cmsg_flags); if (unlikely(bytes_read < 0)) { if (!copied) copied =3D bytes_read; --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B74E34C99B for ; Wed, 22 Oct 2025 14:32:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143538; cv=none; b=MItNIDFUxk+ouikHwsEt5z4udvCdfiz/atEEkPWNAvkoBGpk74Px8oV/1lmMdXsqUqC/NRzVOKuwHLzuIQY+jhS5sGGkAuAbSnED21HzUqgj1JMpzlnZDXQCAT2f0pBhU03iYMbY/Mb0fq9mGW1M1bkXalLXkvILUf+y+dPlbls= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143538; c=relaxed/simple; bh=hmnn5v67eRtqPqqo82oKNOc5mkPji0VO3J+OwYb+UIg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=GFmryMS91BdCgVM/icCmaudQUwWs5veGYGnCKnU7XoTwUumNGjZWruXE53OZzHKf0iEPtkviDZshCrshKLkN2xxd1RnFmSRwOrhMdJWe6Z5ZRhANOi6qYsvjOHr4kdjzc9FUGynESCTHvJTryew+hUJMLRSTbT2PfgtAdYwfc6E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ZR67Tvx8; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ZR67Tvx8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143534; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PJKnA934wjcnyia+ooZM/93BjVChre+fjCJQ/3BTBvg=; b=ZR67Tvx8POCqoCQ90Bv9SgKpMYdpRo0M+nq6Os4IL/yd0qisa1rFbFHQ3r4cWVhSueBAPd 10LqSzSOhGVaIerBx0WIg4Yzr12BIgS/vECtxN4rHXs26HNVQQSs4Y2odlDUo0mZt+yyGn Yx/wzFEpO/ewCbryEuzKKWen/Gcc+9U= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-591-qdgB9tN1Pt2BVARhn4fPpw-1; Wed, 22 Oct 2025 10:32:13 -0400 X-MC-Unique: qdgB9tN1Pt2BVARhn4fPpw-1 X-Mimecast-MFC-AGG-ID: qdgB9tN1Pt2BVARhn4fPpw_1761143532 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7B736180121B; Wed, 22 Oct 2025 14:32:12 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0FBE11956056; Wed, 22 Oct 2025 14:32:10 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 06/11] mptcp: ensure the kernel PM does not take action too late Date: Wed, 22 Oct 2025 16:31:49 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 4U1hYGfsfbksT94bUaTjDmWlctVYlf4fS0n973ZKurc_1761143532 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" The PM hooks can currently take place when when the msk is already shutting down. Subflow creation will fail, thanks to the existing check at join time, but we can entirely avoid starting the to be failed operations. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- net/mptcp/pm.c | 4 +++- net/mptcp/pm_kernel.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c index daf6dcb8068431..eade530d38e018 100644 --- a/net/mptcp/pm.c +++ b/net/mptcp/pm.c @@ -588,6 +588,7 @@ void mptcp_pm_subflow_established(struct mptcp_sock *ms= k) void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, const struct mptcp_subflow_context *subflow) { + struct sock *sk =3D (struct sock *)msk; struct mptcp_pm_data *pm =3D &msk->pm; bool update_subflows; =20 @@ -611,7 +612,8 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, /* Even if this subflow is not really established, tell the PM to try * to pick the next ones, if possible. */ - if (mptcp_pm_nl_check_work_pending(msk)) + if (mptcp_is_fully_established(sk) && + mptcp_pm_nl_check_work_pending(msk)) mptcp_pm_schedule_work(msk, MPTCP_PM_SUBFLOW_ESTABLISHED); =20 spin_unlock_bh(&pm->lock); diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c index da431da16ae04c..07b5142004e73e 100644 --- a/net/mptcp/pm_kernel.c +++ b/net/mptcp/pm_kernel.c @@ -328,6 +328,8 @@ static void mptcp_pm_create_subflow_or_signal_addr(stru= ct mptcp_sock *msk) struct mptcp_pm_local local; =20 mptcp_mpc_endpoint_setup(msk); + if (!mptcp_is_fully_established(sk)) + return; =20 pr_debug("local %d:%d signal %d:%d subflows %d:%d\n", msk->pm.local_addr_used, endp_subflow_max, --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED3E034CFC5 for ; Wed, 22 Oct 2025 14:32:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143543; cv=none; b=FSsWmRuZ7VptQZSfs1n+SZm5Rveyj065L5nV//VMdgUlI8WXFaDAI+jnllMrtUNV8mJWzuHKxnYSEwa6SkCnQp7V6VNj5ScTaVAzz8AvnCUGmZpdMwu/n9AK+CQZz2FXg6KO3EKImi2neGOVEguwCxJXPvAXmfT9ggQV6Kvby6k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143543; c=relaxed/simple; bh=eaMYQX+TvELGANQJQm4+Yp2fUQAnchWMwdgNqaPqnNo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=sUkmEZwT85XNSNiBXUw7pNvlNJZoEP951W+R/rIi4WSobMifpgvNJStiw48HKmCGJhW9+Qpl+gmB61ocC+fd9jE2fJSf1YiAily2MzPDxcSdSfn6zcc/8qGcShAJoX/IdGzNfI2JA7jKZu9hJdSrJUMVD6LlGdnvFIw5scW3OQ8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Cqo5CERp; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Cqo5CERp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143539; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=heGPi6cAbBN2yxMkd2fBr/CJiKgfH467iIpJUwG6JWI=; b=Cqo5CERpMKWGEFTZu5qGHCp/8Vrmv3Q3oJrBvMu953tz4v6YaBY54UpLcjlvPxTWyJeJqT OrAAILc8BBHmDciNsvwlx2zH2RBWprH3H8sAWYbD69fuSBHvUHj3fWJg7rSM9ntb0M7xfY 8bchqDouaz1xpU/WLXv2F4R2yJ6mR1k= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-554-qSwwG9fnN6WQorgSBJbnRw-1; Wed, 22 Oct 2025 10:32:16 -0400 X-MC-Unique: qSwwG9fnN6WQorgSBJbnRw-1 X-Mimecast-MFC-AGG-ID: qSwwG9fnN6WQorgSBJbnRw_1761143534 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7D9B019560B5; Wed, 22 Oct 2025 14:32:14 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0726E1956056; Wed, 22 Oct 2025 14:32:12 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 07/11] mptcp: do not miss early first subflow close event notification. Date: Wed, 22 Oct 2025 16:31:50 +0200 Message-ID: <60e46264540b92e915a1464ad037b4a2a6066228.1761142784.git.pabeni@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 7xCORb3jMvaXRly7YPHNrjJFUbBWHkjQpxrkV89CwYE_1761143534 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" The MPTCP protocol is not currently emitting the NL event when the first subflow is closed before msk accept() time. By replacing the in use close helper is such scenario, implicitly introduce the missing notification. Note that in such scenario we want to be sure that mptcp_close_ssk() will not trigger any PM work, move the msk state change update earlier, so that the previous patch will offer such guarantee. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 200b657080eb3e..8c835ba5a437a2 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3985,10 +3985,10 @@ static int mptcp_stream_accept(struct socket *sock,= struct socket *newsock, * deal with bad peers not doing a complete shutdown. */ if (unlikely(inet_sk_state_load(msk->first) =3D=3D TCP_CLOSE)) { - __mptcp_close_ssk(newsk, msk->first, - mptcp_subflow_ctx(msk->first), 0); if (unlikely(list_is_singular(&msk->conn_list))) mptcp_set_state(newsk, TCP_CLOSE); + mptcp_close_ssk(newsk, msk->first, + mptcp_subflow_ctx(msk->first)); } } else { tcpfallback: --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEF12347FEC for ; Wed, 22 Oct 2025 14:32:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143541; cv=none; b=nVJ9LybH74x8aRb0juahDjpCf1SKPpxAFaAmFcQARcfvebbn5sOzloaPBGOJQZR44WZujurXcdqXRSmzZ4REBGBIOWlNrBmpSFILR03ZrZj03yZZZhKAyR0Qs6ea7shOeacI8zzeTxZAassOgHxtceBFTvdotBygEtIC+PdFvFs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143541; c=relaxed/simple; bh=7dVqvgKPaeM/YUjV2fcz1xyIP+/mWLKa43dfXThBShA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=tNk5vYJ0ZVseGQL/3pDwB8S9ydPLC19RQOEllrEuAvr0OF/wdae5juL43qXI0vU+Xsl0jTXelj7FgtntxXvtbLCtGjU2rfKCMUT2RG5afLnsEQupXKWAKtdJGs/DisCec7Io5ExbWtopfSqGekX5OxEL+xWZyWVhYBS+Q+mvnLo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QPWQwnjq; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QPWQwnjq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143538; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZSF375RAz2J4FLfFRCYtSYJAE8SjjJOxSqXyLCAEAA8=; b=QPWQwnjqLlBjOApyXeJrWGzI/cjAgGjNobZWg8xPhcSW/C5KDcnl+6AfYyw3boHO6uI5Yf iFh1jzMKMEfnanWGJYscv5qLNecIDHXmyaGZK2h/c/ZR8yR2J6kNdET6o8F6chXv6oIpTE HBHoKbLeY9kPkx6VVbbQSP7Oo1TOJsE= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-629-Dhiq8K11PPG7_v5ZYGG_lQ-1; Wed, 22 Oct 2025 10:32:17 -0400 X-MC-Unique: Dhiq8K11PPG7_v5ZYGG_lQ-1 X-Mimecast-MFC-AGG-ID: Dhiq8K11PPG7_v5ZYGG_lQ_1761143536 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6DF841956068; Wed, 22 Oct 2025 14:32:16 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 082961956056; Wed, 22 Oct 2025 14:32:14 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 08/11] mptcp: make mptcp_destroy_common() static Date: Wed, 22 Oct 2025 16:31:51 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: q4tPHfmZaklYkcH8V1tP_QSluBjo08S71izKTMHky_o_1761143536 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" Such function is only used inside protocol.c, there is no need to expose it to the whole stack. Note that the function definition most be moved earlier to avoid forward declaration. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- net/mptcp/protocol.c | 42 +++++++++++++++++++++--------------------- net/mptcp/protocol.h | 2 -- 2 files changed, 21 insertions(+), 23 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 8c835ba5a437a2..3653b10d24887e 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3195,6 +3195,27 @@ static void mptcp_copy_inaddrs(struct sock *msk, con= st struct sock *ssk) inet_sk(msk)->inet_rcv_saddr =3D inet_sk(ssk)->inet_rcv_saddr; } =20 +static void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flag= s) +{ + struct mptcp_subflow_context *subflow, *tmp; + struct sock *sk =3D (struct sock *)msk; + + __mptcp_clear_xmit(sk); + + /* join list will be eventually flushed (with rst) at sock lock release t= ime */ + mptcp_for_each_subflow_safe(msk, subflow, tmp) + __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, flags); + + __skb_queue_purge(&sk->sk_receive_queue); + skb_rbtree_purge(&msk->out_of_order_queue); + + /* move all the rx fwd alloc into the sk_mem_reclaim_final in + * inet_sock_destruct() will dispose it + */ + mptcp_token_destroy(msk); + mptcp_pm_destroy(msk); +} + static int mptcp_disconnect(struct sock *sk, int flags) { struct mptcp_sock *msk =3D mptcp_sk(sk); @@ -3399,27 +3420,6 @@ void mptcp_rcv_space_init(struct mptcp_sock *msk, co= nst struct sock *ssk) msk->rcvq_space.space =3D TCP_INIT_CWND * TCP_MSS_DEFAULT; } =20 -void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags) -{ - struct mptcp_subflow_context *subflow, *tmp; - struct sock *sk =3D (struct sock *)msk; - - __mptcp_clear_xmit(sk); - - /* join list will be eventually flushed (with rst) at sock lock release t= ime */ - mptcp_for_each_subflow_safe(msk, subflow, tmp) - __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, flags); - - __skb_queue_purge(&sk->sk_receive_queue); - skb_rbtree_purge(&msk->out_of_order_queue); - - /* move all the rx fwd alloc into the sk_mem_reclaim_final in - * inet_sock_destruct() will dispose it - */ - mptcp_token_destroy(msk); - mptcp_pm_destroy(msk); -} - static void mptcp_destroy(struct sock *sk) { struct mptcp_sock *msk =3D mptcp_sk(sk); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index a3bbce8950a5e0..dc61579282b2fc 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -979,8 +979,6 @@ static inline void mptcp_propagate_sndbuf(struct sock *= sk, struct sock *ssk) local_bh_enable(); } =20 -void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags); - #define MPTCP_TOKEN_MAX_RETRIES 4 =20 void __init mptcp_token_init(void); --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EA61330325 for ; Wed, 22 Oct 2025 14:32:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143546; cv=none; b=tpuZ6TDx8TR297NVwYnUrY/b9IuS/mOUY24h0ConSlJgLQ6d4n789Y9OewcY/zsTOmQV4XSkLQswAJrw5jm2zrYULNX2sXCp9W3PlYGfWMhE9aeiGVS/B3Zks6vtAmLT4mJ4cFIDLCHjHVAE3lZtNwEDnFGNyZKTOZNTuTQE8qI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143546; c=relaxed/simple; bh=awA3VBsYZo3Op2bzU/pQGVj/YeDvjUparqV186Dl85E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=IcS/xU4InRDS4AkPeTgqEJz5702WnPNyUADj6AF8eQxwW7U6geIMsRq7n1oG4DhZdyerVbEVdCCyVkDkL17LLs0Mx03AndH3jjjheiPPnGqwRyoJ5n5JY09ERvohInHSrzQtIKRIdkxDqqRRmeWI2bbVLjx+OccitEfmxAEDzmo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=eIhcb3xT; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="eIhcb3xT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143544; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3wrNCfBcM2+0ja8CMsTK1rqUHGoAuuNWsOnjamBxLx8=; b=eIhcb3xT5QeGvOm8LMrvEOkVm9OcZW/GTIQ1MljxvhG8x9ALkXKJzNIwWzB/v9ThldE2bs vS7NieHmRoVvsZTKFce+7Y/8Kxx9S5VSODL3wrDipBYWKJjySXU1zH4xhA+Tv0cGzDNTPo 6cYg9krFOVEHxDBNM3Fqc9VN3YfR+4w= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-640-Q77VcR0MPJ6qDWngs4Pkqg-1; Wed, 22 Oct 2025 10:32:19 -0400 X-MC-Unique: Q77VcR0MPJ6qDWngs4Pkqg-1 X-Mimecast-MFC-AGG-ID: Q77VcR0MPJ6qDWngs4Pkqg_1761143538 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6782D1805814; Wed, 22 Oct 2025 14:32:18 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id F28B51954102; Wed, 22 Oct 2025 14:32:16 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 09/11] mptcp: drop the __mptcp_data_ready() helper Date: Wed, 22 Oct 2025 16:31:52 +0200 Message-ID: <67952c23fbff74910a98b96d863cdb2468e9e011.1761142784.git.pabeni@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: TCNQUDISw-AK6wrHuL9otKAOlxAiC4W4GwaYX0V_QT4_1761143538 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" It adds little clarity and there is a single user of such helper, just inline it in the caller. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- - v4 -> v5: split out of main backlog patch, to make the latter smaller --- net/mptcp/protocol.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 3653b10d24887e..c68a4b410e7e5b 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -838,18 +838,10 @@ static bool move_skbs_to_msk(struct mptcp_sock *msk, = struct sock *ssk) return moved; } =20 -static void __mptcp_data_ready(struct sock *sk, struct sock *ssk) -{ - struct mptcp_sock *msk =3D mptcp_sk(sk); - - /* Wake-up the reader only for in-sequence data */ - if (move_skbs_to_msk(msk, ssk) && mptcp_epollin_ready(sk)) - sk->sk_data_ready(sk); -} - void mptcp_data_ready(struct sock *sk, struct sock *ssk) { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(ssk); + struct mptcp_sock *msk =3D mptcp_sk(sk); =20 /* The peer can send data while we are shutting down this * subflow at msk destruction time, but we must avoid enqueuing @@ -859,10 +851,14 @@ void mptcp_data_ready(struct sock *sk, struct sock *s= sk) return; =20 mptcp_data_lock(sk); - if (!sock_owned_by_user(sk)) - __mptcp_data_ready(sk, ssk); - else + if (!sock_owned_by_user(sk)) { + /* Wake-up the reader only for in-sequence data */ + if (move_skbs_to_msk(msk, ssk) && mptcp_epollin_ready(sk)) + sk->sk_data_ready(sk); + =09 + } else { __set_bit(MPTCP_DEQUEUE, &mptcp_sk(sk)->cb_flags); + } mptcp_data_unlock(sk); } =20 --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B41C634DB77 for ; Wed, 22 Oct 2025 14:32:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143549; cv=none; b=t3at25kcvN9HzdB86SPrsp8Amufw0tjngpCaCmNq/Vp3FL4gV9xcikOgI9LqnQ5A+EDcUXwej2yS/yM8GkkRNiZOqnOSS8Vsi98Cq4T+PXIFThT44AAFW7Midaxyl3xbEFyD+2ARk+dkXWjL9CFcKtWs1f0GKEUFaysqz5PqvFc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143549; c=relaxed/simple; bh=moSIjfPSzQGeOLbv4n4MwJtNqYMzSg42jMOWoBapWWY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=igFMmJkBAE0MvT+SJ26+EyakAUsCOrrMPx5vAYK+vy0OhCWy76rSl+ySL3I4tntbA9Lgby71V9nntX1gpTzJ0ACJaGdAmMCvak4j18XQ8iaoKON9mE5buN3JncctH0lln+WqFWuHJ2PYH04CaFUQkUk5RllW/nueZg3elXM2unY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SAOGo03+; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SAOGo03+" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143546; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=amXsxLfjkO/birrnkPHv1ERF1at+xhVIm+Nv4cVA5lU=; b=SAOGo03+2DEzan1Tqti/XO7Nj+mqvzosedbmSpt2SSPbjiv6eYfWz6j66XcOMo3hCOPtBG jamIgf1jcHUbJSKLk+rFflgkrd2Ftkz2W6D2eQjpewMakJ2LBgcMwo9gjoEW409QGAoVyB M+o3YO13tzP2zMOAEM4OxkZIdKQnu+8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-441-i4zxc5RWNGy8ctyU_R2clA-1; Wed, 22 Oct 2025 10:32:22 -0400 X-MC-Unique: i4zxc5RWNGy8ctyU_R2clA-1 X-Mimecast-MFC-AGG-ID: i4zxc5RWNGy8ctyU_R2clA_1761143540 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 72312195605B; Wed, 22 Oct 2025 14:32:20 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 077081956056; Wed, 22 Oct 2025 14:32:18 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 10/11] mptcp: introduce mptcp-level backlog Date: Wed, 22 Oct 2025 16:31:53 +0200 Message-ID: <56af6ae6256042ffd201aa6e95c907f260480010.1761142784.git.pabeni@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: s4Bi1g2oAspK8M0OsRH6XuFFkHv95SdW2HDj-ZjFdcQ_1761143540 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" We are soon using it for incoming data processing. MPTCP can't leverage the sk_backlog, as the latter is processed before the release callback, and such callback for MPTCP releases and re-acquire the socket spinlock, breaking the sk_backlog processing assumption. Add a skb backlog list inside the mptcp sock struct, and implement basic helper to transfer packet to and purge such list. Packets in the backlog are not memory accounted, but still use the incoming subflow receive memory, to allow back-pressure. No packet is currently added to the backlog, so no functional changes intended here. Signed-off-by: Paolo Abeni -- v5 -> v6: - call mptcp_bl_free() instead of inlining it. - report the bl mem in diag mem info - moved here the mptcp_close_ssk chunk from the next patch. (logically belongs here) v4 -> v5: - split out of the next path, to make the latter smaller - set a custom destructor for skbs in the backlog, this avoid duplicate code, and fix a few places where the need ssk cleanup was not performed. - factor out the backlog purge in a new helper, use spinlock protection, clear the backlog list and zero the backlog len - explicitly init the backlog_len at mptcp_init_sock() time Reviewed-by: Geliang Tang Tested-by: Geliang Tang --- net/mptcp/mptcp_diag.c | 3 +- net/mptcp/protocol.c | 85 ++++++++++++++++++++++++++++++++++++++++-- net/mptcp/protocol.h | 4 ++ 3 files changed, 87 insertions(+), 5 deletions(-) diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c index ac974299de71cd..136c2d05c0eeb8 100644 --- a/net/mptcp/mptcp_diag.c +++ b/net/mptcp/mptcp_diag.c @@ -195,7 +195,8 @@ static void mptcp_diag_get_info(struct sock *sk, struct= inet_diag_msg *r, struct mptcp_sock *msk =3D mptcp_sk(sk); struct mptcp_info *info =3D _info; =20 - r->idiag_rqueue =3D sk_rmem_alloc_get(sk); + r->idiag_rqueue =3D sk_rmem_alloc_get(sk) + + READ_ONCE(mptcp_sk(sk)->backlog_len); r->idiag_wqueue =3D sk_wmem_alloc_get(sk); =20 if (inet_sk_state_load(sk) =3D=3D TCP_LISTEN) { diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index c68a4b410e7e5b..5a1d8f9e0fb0ec 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -337,6 +337,11 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *ms= k, struct sk_buff *skb) mptcp_rcvbuf_grow(sk); } =20 +static void mptcp_bl_free(struct sk_buff *skb) +{ + atomic_sub(skb->truesize, &skb->sk->sk_rmem_alloc); +} + static int mptcp_init_skb(struct sock *ssk, struct sk_buff *skb, int offset, int copy_len) { @@ -360,7 +365,7 @@ static int mptcp_init_skb(struct sock *ssk, skb_dst_drop(skb); =20 /* "borrow" the fwd memory from the subflow, instead of reclaiming it */ - skb->destructor =3D NULL; + skb->destructor =3D mptcp_bl_free; borrowed =3D ssk->sk_forward_alloc - sk_unused_reserved_mem(ssk); borrowed &=3D ~(PAGE_SIZE - 1); sk_forward_alloc_add(ssk, skb->truesize - borrowed); @@ -373,6 +378,13 @@ static bool __mptcp_move_skb(struct sock *sk, struct s= k_buff *skb) struct mptcp_sock *msk =3D mptcp_sk(sk); struct sk_buff *tail; =20 + /* Avoid the indirect call overhead, we know destructor is + * mptcp_bl_free at this point. + */ + mptcp_bl_free(skb); + skb->sk =3D NULL; + skb->destructor =3D NULL; + /* try to fetch required memory from subflow */ if (!sk_rmem_schedule(sk, skb, skb->truesize)) { MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED); @@ -654,6 +666,35 @@ static void mptcp_dss_corruption(struct mptcp_sock *ms= k, struct sock *ssk) } } =20 +static void __mptcp_add_backlog(struct sock *sk, struct sk_buff *skb) +{ + struct mptcp_sock *msk =3D mptcp_sk(sk); + struct sk_buff *tail =3D NULL; + bool fragstolen; + int delta; + + if (unlikely(sk->sk_state =3D=3D TCP_CLOSE)) { + kfree_skb_reason(skb, SKB_DROP_REASON_SOCKET_CLOSE); + return; + } + + /* Try to coalesce with the last skb in our backlog */ + if (!list_empty(&msk->backlog_list)) + tail =3D list_last_entry(&msk->backlog_list, struct sk_buff, list); + + if (tail && MPTCP_SKB_CB(skb)->map_seq =3D=3D MPTCP_SKB_CB(tail)->end_seq= && + skb->sk =3D=3D tail->sk && + __mptcp_try_coalesce(sk, tail, skb, &fragstolen, &delta)) { + skb->truesize -=3D delta; + kfree_skb_partial(skb, fragstolen); + WRITE_ONCE(msk->backlog_len, msk->backlog_len + delta); + return; + } + + list_add_tail(&skb->list, &msk->backlog_list); + WRITE_ONCE(msk->backlog_len, msk->backlog_len + skb->truesize); +} + static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk, struct sock *ssk) { @@ -701,10 +742,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mpt= cp_sock *msk, int bmem; =20 bmem =3D mptcp_init_skb(ssk, skb, offset, len); - skb->sk =3D NULL; sk_forward_alloc_add(sk, bmem); - atomic_sub(skb->truesize, &ssk->sk_rmem_alloc); - ret =3D __mptcp_move_skb(sk, skb) || ret; + + if (true) + ret |=3D __mptcp_move_skb(sk, skb); + else + __mptcp_add_backlog(sk, skb); seq +=3D len; =20 if (unlikely(map_remaining < len)) { @@ -2516,6 +2559,9 @@ static void __mptcp_close_ssk(struct sock *sk, struct= sock *ssk, void mptcp_close_ssk(struct sock *sk, struct sock *ssk, struct mptcp_subflow_context *subflow) { + struct mptcp_sock *msk =3D mptcp_sk(sk); + struct sk_buff *skb; + /* The first subflow can already be closed and still in the list */ if (subflow->close_event_done) return; @@ -2525,6 +2571,18 @@ void mptcp_close_ssk(struct sock *sk, struct sock *s= sk, if (sk->sk_state =3D=3D TCP_ESTABLISHED) mptcp_event(MPTCP_EVENT_SUB_CLOSED, mptcp_sk(sk), ssk, GFP_KERNEL); =20 + /* Remove any reference from the backlog to this ssk, accounting the + * related skb directly to the main socket + */ + list_for_each_entry(skb, &msk->backlog_list, list) { + if (skb->sk !=3D ssk) + continue; + + atomic_sub(skb->truesize, &skb->sk->sk_rmem_alloc); + atomic_add(skb->truesize, &sk->sk_rmem_alloc); + skb->sk =3D sk; + } + /* subflow aborted before reaching the fully_established status * attempt the creation of the next subflow */ @@ -2753,12 +2811,28 @@ static void mptcp_mp_fail_no_response(struct mptcp_= sock *msk) unlock_sock_fast(ssk, slow); } =20 +static void mptcp_backlog_purge(struct sock *sk) +{ + struct mptcp_sock *msk =3D mptcp_sk(sk); + struct sk_buff *tmp, *skb; + LIST_HEAD(backlog); + + mptcp_data_lock(sk); + list_splice_init(&msk->backlog_list, &backlog); + msk->backlog_len =3D 0; + mptcp_data_unlock(sk); + + list_for_each_entry_safe(skb, tmp, &backlog, list) + kfree_skb_reason(skb, SKB_DROP_REASON_SOCKET_CLOSE); +} + static void mptcp_do_fastclose(struct sock *sk) { struct mptcp_subflow_context *subflow, *tmp; struct mptcp_sock *msk =3D mptcp_sk(sk); =20 mptcp_set_state(sk, TCP_CLOSE); + mptcp_backlog_purge(sk); mptcp_for_each_subflow_safe(msk, subflow, tmp) __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, MPTCP_CF_FASTCLOSE); @@ -2816,11 +2890,13 @@ static void __mptcp_init_sock(struct sock *sk) INIT_LIST_HEAD(&msk->conn_list); INIT_LIST_HEAD(&msk->join_list); INIT_LIST_HEAD(&msk->rtx_queue); + INIT_LIST_HEAD(&msk->backlog_list); INIT_WORK(&msk->work, mptcp_worker); msk->out_of_order_queue =3D RB_ROOT; msk->first_pending =3D NULL; msk->timer_ival =3D TCP_RTO_MIN; msk->scaling_ratio =3D TCP_DEFAULT_SCALING_RATIO; + msk->backlog_len =3D 0; =20 WRITE_ONCE(msk->first, NULL); inet_csk(sk)->icsk_sync_mss =3D mptcp_sync_mss; @@ -3197,6 +3273,7 @@ static void mptcp_destroy_common(struct mptcp_sock *m= sk, unsigned int flags) struct sock *sk =3D (struct sock *)msk; =20 __mptcp_clear_xmit(sk); + mptcp_backlog_purge(sk); =20 /* join list will be eventually flushed (with rst) at sock lock release t= ime */ mptcp_for_each_subflow_safe(msk, subflow, tmp) diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index dc61579282b2fc..d814e8151458d5 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -358,6 +358,9 @@ struct mptcp_sock { * allow_infinite_fallback and * allow_join */ + + struct list_head backlog_list; /* protected by the data lock */ + u32 backlog_len; }; =20 #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) @@ -408,6 +411,7 @@ static inline int mptcp_space_from_win(const struct soc= k *sk, int win) static inline int __mptcp_space(const struct sock *sk) { return mptcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf) - + READ_ONCE(mptcp_sk(sk)->backlog_len) - sk_rmem_alloc_get(sk)); } =20 --=20 2.51.0 From nobody Fri Oct 31 16:12:52 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 682AD34E745 for ; Wed, 22 Oct 2025 14:32:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143552; cv=none; b=Fnig3zBSK4Ma6FSUPhUmmxxZedVHfzMsKkxqpCI246N76ihmHCk+/5WHzMVN/Og6fu8nK2AQJFfTAj6cUeW8ZRw5Oeo+gS4WHxs/WL2mpNgrdrL1MM4tWx5Z1ILHHuOQ6j5i48h+VPFhk+w9Jz2uFcqhN0yMAN6p2ng1q0GL25I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761143552; c=relaxed/simple; bh=LKSArMTqn22YhAzDwyKldOAlGOzBs48sHtNLe1HiHvU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:content-type; b=SEylOqbnWWvRZ74alsc6gmBT/WBmluj4O3vTmf4UVHRSLoHAjACg1T8/ucaG6179doePHIDpD9L3/9Hfn9IMAwoR/2dPKwXc4M2iQW4goM0JAxfC/ImKcSaDjCSwnVNQ3ZlCY9WsKYcla5ApQnFo37Q9j9kvrk1Fucvhv2K2Dls= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ZR8vi5gh; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ZR8vi5gh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761143549; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=otsrmCEqmWTbrR3ElRvevVQVuA2Fc2sFeePF2UV2PxY=; b=ZR8vi5ghek7xeR6WdtAK8sTj3FIQbG9WVhtqQmt4hx0mLPnONzs2craf/7rKs+wOUdz/Js XJMQRds7LZh3pVQehSvQfAjIIO9BXmT1CPr5+naMdWOslU0HNfEx7d4k62pkwzXLSwsvSH OxFQuA3l7NuGobaHn+701NPDekaqu7Q= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-204-avOX9E7BPIiEwi_gTK2Sxg-1; Wed, 22 Oct 2025 10:32:24 -0400 X-MC-Unique: avOX9E7BPIiEwi_gTK2Sxg-1 X-Mimecast-MFC-AGG-ID: avOX9E7BPIiEwi_gTK2Sxg_1761143542 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6454B1801312; Wed, 22 Oct 2025 14:32:22 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.45.225.237]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id F3ACD1956056; Wed, 22 Oct 2025 14:32:20 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Cc: Mat Martineau , Geliang Tang Subject: [PATCH v6 mptcp-next 11/11] mptcp: leverage the backlog for RX packet processing Date: Wed, 22 Oct 2025 16:31:54 +0200 Message-ID: <2201f259d2176bca0ad37500a352658f7ef5a1f0.1761142784.git.pabeni@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: MlSq82DaxMXAn1IvN3x1LKqklDIqkGlJ1iv1QTdfLPc_1761143542 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" When the msk socket is owned or the msk receive buffer is full, move the incoming skbs in a msk level backlog list. This avoid traversing the joined subflows and acquiring the subflow level socket lock at reception time, improving the RX performances. When processing the backlog, use the fwd alloc memory borrowed from the incoming subflow. skbs exceeding the msk receive space are not dropped; instead they are kept into the backlog until the receive buffer is freed. Dropping packets already acked at the TCP level is explicitly discouraged by the RFC and would corrupt the data stream for fallback sockets. Move the conditional reschedule in release_cb() to take action only after the first loop iteration, to avoid rescheduling just before releasing the lock. Special care is needed to avoid adding skbs to the backlog of a closed msk and to avoid leaving dangling references into the backlog at subflow closing time. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Mat Martineau Tested-by: Geliang Tang --- v5 -> v6: - do backlog len update asap to advise the correct window. - explicitly bound backlog processing loop to the maximum BL len v4 -> v5: - consolidate ssk rcvbuf accunting in __mptcp_move_skb(), remove some code duplication - return soon in __mptcp_add_backlog() when dropping skbs due to the msk closed. This avoid later UaF --- net/mptcp/protocol.c | 151 +++++++++++++++++++++++++++---------------- net/mptcp/protocol.h | 2 +- 2 files changed, 96 insertions(+), 57 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 5a1d8f9e0fb0ec..0aae17ab77edb2 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -696,7 +696,7 @@ static void __mptcp_add_backlog(struct sock *sk, struct= sk_buff *skb) } =20 static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk, - struct sock *ssk) + struct sock *ssk, bool own_msk) { struct mptcp_subflow_context *subflow =3D mptcp_subflow_ctx(ssk); struct sock *sk =3D (struct sock *)msk; @@ -712,9 +712,6 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp= _sock *msk, struct sk_buff *skb; bool fin; =20 - if (sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) - break; - /* try to move as much data as available */ map_remaining =3D subflow->map_data_len - mptcp_subflow_get_map_offset(subflow); @@ -742,9 +739,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mptc= p_sock *msk, int bmem; =20 bmem =3D mptcp_init_skb(ssk, skb, offset, len); - sk_forward_alloc_add(sk, bmem); + if (own_msk) + sk_forward_alloc_add(sk, bmem); + else + msk->borrowed_mem +=3D bmem; =20 - if (true) + if (own_msk && sk_rmem_alloc_get(sk) < sk->sk_rcvbuf) ret |=3D __mptcp_move_skb(sk, skb); else __mptcp_add_backlog(sk, skb); @@ -866,7 +866,7 @@ static bool move_skbs_to_msk(struct mptcp_sock *msk, st= ruct sock *ssk) struct sock *sk =3D (struct sock *)msk; bool moved; =20 - moved =3D __mptcp_move_skbs_from_subflow(msk, ssk); + moved =3D __mptcp_move_skbs_from_subflow(msk, ssk, true); __mptcp_ofo_queue(msk); if (unlikely(ssk->sk_err)) __mptcp_subflow_error_report(sk, ssk); @@ -898,9 +898,8 @@ void mptcp_data_ready(struct sock *sk, struct sock *ssk) /* Wake-up the reader only for in-sequence data */ if (move_skbs_to_msk(msk, ssk) && mptcp_epollin_ready(sk)) sk->sk_data_ready(sk); - =09 } else { - __set_bit(MPTCP_DEQUEUE, &mptcp_sk(sk)->cb_flags); + __mptcp_move_skbs_from_subflow(msk, ssk, false); } mptcp_data_unlock(sk); } @@ -2135,60 +2134,92 @@ static void mptcp_rcv_space_adjust(struct mptcp_soc= k *msk, int copied) msk->rcvq_space.time =3D mstamp; } =20 -static struct mptcp_subflow_context * -__mptcp_first_ready_from(struct mptcp_sock *msk, - struct mptcp_subflow_context *subflow) +static bool __mptcp_move_skbs(struct sock *sk, struct list_head *skbs, u32= *delta) { - struct mptcp_subflow_context *start_subflow =3D subflow; + struct sk_buff *skb =3D list_first_entry(skbs, struct sk_buff, list); + struct mptcp_sock *msk =3D mptcp_sk(sk); + bool moved =3D false; + + *delta =3D 0; + while (1) { + /* If the msk recvbuf is full stop, don't drop */ + if (sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) + break; + + prefetch(skb->next); + list_del(&skb->list); + *delta +=3D skb->truesize; + + moved |=3D __mptcp_move_skb(sk, skb); + if (list_empty(skbs)) + break; =20 - while (!READ_ONCE(subflow->data_avail)) { - subflow =3D mptcp_next_subflow(msk, subflow); - if (subflow =3D=3D start_subflow) - return NULL; + skb =3D list_first_entry(skbs, struct sk_buff, list); } - return subflow; + + __mptcp_ofo_queue(msk); + if (moved) + mptcp_check_data_fin((struct sock *)msk); + return moved; } =20 -static bool __mptcp_move_skbs(struct sock *sk) +static bool mptcp_can_spool_backlog(struct sock *sk, u32 moved, + struct list_head *skbs) { - struct mptcp_subflow_context *subflow; struct mptcp_sock *msk =3D mptcp_sk(sk); - bool ret =3D false; =20 - if (list_empty(&msk->conn_list)) + if (list_empty(&msk->backlog_list)) return false; =20 - subflow =3D list_first_entry(&msk->conn_list, - struct mptcp_subflow_context, node); - for (;;) { - struct sock *ssk; - bool slowpath; + /* Borrowed mem could be zero only in the unlikely event that the bl + * is full + */ + if (likely(msk->borrowed_mem)) { + sk_forward_alloc_add(sk, msk->borrowed_mem); + msk->borrowed_mem =3D 0; + sk->sk_reserved_mem =3D msk->backlog_len; + } =20 - /* - * As an optimization avoid traversing the subflows list - * and ev. acquiring the subflow socket lock before baling out - */ - if (sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) - break; + /* Limit the backlog loop to the maximum backlog size; moved skbs are + * accounted on both the backlog and the receive buffer; the caller + * should update the backlog usage ASAP, to avoid underestimate the + * rcvwnd. + */ + if (moved > sk->sk_rcvbuf || sk_rmem_alloc_get(sk) > sk->sk_rcvbuf) + return false; =20 - subflow =3D __mptcp_first_ready_from(msk, subflow); - if (!subflow) - break; + INIT_LIST_HEAD(skbs); + list_splice_init(&msk->backlog_list, skbs); + return true; +} =20 - ssk =3D mptcp_subflow_tcp_sock(subflow); - slowpath =3D lock_sock_fast(ssk); - ret =3D __mptcp_move_skbs_from_subflow(msk, ssk) || ret; - if (unlikely(ssk->sk_err)) - __mptcp_error_report(sk); - unlock_sock_fast(ssk, slowpath); +static void mptcp_backlog_spooled(struct sock *sk, u32 moved, + struct list_head *skbs) +{ + struct mptcp_sock *msk =3D mptcp_sk(sk); =20 - subflow =3D mptcp_next_subflow(msk, subflow); - } + WRITE_ONCE(msk->backlog_len, msk->backlog_len - moved); + list_splice(skbs, &msk->backlog_list); + sk->sk_reserved_mem =3D msk->backlog_len; +} =20 - __mptcp_ofo_queue(msk); - if (ret) - mptcp_check_data_fin((struct sock *)msk); - return ret; +static bool mptcp_move_skbs(struct sock *sk) +{ + u32 moved, total_moved =3D 0; + struct list_head skbs; + bool enqueued =3D false; + + mptcp_data_lock(sk); + while (mptcp_can_spool_backlog(sk, total_moved, &skbs)) { + mptcp_data_unlock(sk); + enqueued |=3D __mptcp_move_skbs(sk, &skbs, &moved); + + mptcp_data_lock(sk); + total_moved +=3D moved; + mptcp_backlog_spooled(sk, moved, &skbs); + } + mptcp_data_unlock(sk); + return enqueued; } =20 static unsigned int mptcp_inq_hint(const struct sock *sk) @@ -2254,7 +2285,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, =20 copied +=3D bytes_read; =20 - if (skb_queue_empty(&sk->sk_receive_queue) && __mptcp_move_skbs(sk)) + if (!list_empty(&msk->backlog_list) && mptcp_move_skbs(sk)) continue; =20 /* only the MPTCP socket status is relevant here. The exit @@ -3521,20 +3552,22 @@ void __mptcp_check_push(struct sock *sk, struct soc= k *ssk) =20 #define MPTCP_FLAGS_PROCESS_CTX_NEED (BIT(MPTCP_PUSH_PENDING) | \ BIT(MPTCP_RETRANSMIT) | \ - BIT(MPTCP_FLUSH_JOIN_LIST) | \ - BIT(MPTCP_DEQUEUE)) + BIT(MPTCP_FLUSH_JOIN_LIST)) =20 /* processes deferred events and flush wmem */ static void mptcp_release_cb(struct sock *sk) __must_hold(&sk->sk_lock.slock) { struct mptcp_sock *msk =3D mptcp_sk(sk); + u32 moved, total_moved =3D 0; =20 for (;;) { unsigned long flags =3D (msk->cb_flags & MPTCP_FLAGS_PROCESS_CTX_NEED); - struct list_head join_list; + struct list_head join_list, skbs; + bool spool_bl; =20 - if (!flags) + spool_bl =3D mptcp_can_spool_backlog(sk, total_moved, &skbs); + if (!flags && !spool_bl) break; =20 INIT_LIST_HEAD(&join_list); @@ -3550,20 +3583,26 @@ static void mptcp_release_cb(struct sock *sk) msk->cb_flags &=3D ~flags; spin_unlock_bh(&sk->sk_lock.slock); =20 + if (total_moved) + cond_resched(); + if (flags & BIT(MPTCP_FLUSH_JOIN_LIST)) __mptcp_flush_join_list(sk, &join_list); if (flags & BIT(MPTCP_PUSH_PENDING)) __mptcp_push_pending(sk, 0); if (flags & BIT(MPTCP_RETRANSMIT)) __mptcp_retrans(sk); - if ((flags & BIT(MPTCP_DEQUEUE)) && __mptcp_move_skbs(sk)) { + if (spool_bl && __mptcp_move_skbs(sk, &skbs, &moved)) { /* notify ack seq update */ mptcp_cleanup_rbuf(msk, 0); sk->sk_data_ready(sk); } =20 - cond_resched(); spin_lock_bh(&sk->sk_lock.slock); + if (spool_bl) { + total_moved +=3D moved; + mptcp_backlog_spooled(sk, moved, &skbs); + } } =20 if (__test_and_clear_bit(MPTCP_CLEAN_UNA, &msk->cb_flags)) @@ -3796,7 +3835,7 @@ static int mptcp_ioctl(struct sock *sk, int cmd, int = *karg) return -EINVAL; =20 lock_sock(sk); - if (__mptcp_move_skbs(sk)) + if (mptcp_move_skbs(sk)) mptcp_cleanup_rbuf(msk, 0); *karg =3D mptcp_inq_hint(sk); release_sock(sk); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index d814e8151458d5..9e2a44546354a0 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -124,7 +124,6 @@ #define MPTCP_FLUSH_JOIN_LIST 5 #define MPTCP_SYNC_STATE 6 #define MPTCP_SYNC_SNDBUF 7 -#define MPTCP_DEQUEUE 8 =20 struct mptcp_skb_cb { u64 map_seq; @@ -301,6 +300,7 @@ struct mptcp_sock { u32 last_ack_recv; unsigned long timer_ival; u32 token; + u32 borrowed_mem; unsigned long flags; unsigned long cb_flags; bool recovery; /* closing subflow write queue reinjected */ --=20 2.51.0