net/ipv4/tcp_output.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
BPF_SOCK_OPS_RWND_INIT lets a sockops BPF program pick the initial TCP
receive window, e.g. to advertise a larger window up front in environments
where that is known to be safe. Today it is only effective for the passive
(listener) side; on the active (connect) side the value is computed and
then silently discarded.
On the passive path tcp_openreq_init_rwin() inflates full_space when the
program returns a non-zero window, so tcp_select_initial_window() can offer
it:
else if (full_space < rcv_wnd * mss)
full_space = rcv_wnd * mss;
tcp_select_initial_window() only clamps the requested window *down* to the
available space, so without inflating the space first the BPF reply can
never raise the offered window above tcp_full_space(sk).
tcp_connect_init() calls tcp_rwnd_init_bpf() but never inflates full_space,
so on connect() the requested window is clamped back to tcp_full_space(sk)
(~64KB at the default rcvbuf) and the program's value is ignored.
Mirror the listener-side inflation in tcp_connect_init() so both directions
behave the same. tp->advmss is the mss the listener path uses as well (both
are tcp_mss_clamp(tp, dst_metric_advmss(dst))).
Fixes: 13d3b1ebe287 ("bpf: Support for setting initial receive window")
Signed-off-by: Tejas Birajdar <tejasbirajdar@meta.com>
---
Functional test: attached a cgroup sockops BPF program that sets
skops->reply for BPF_SOCK_OPS_RWND_INIT on the connecting socket, and
drove it with packetdrill on the active-open (connect) path (wscale 11,
advmss 1440). On the patched kernel the advertised receive window on the
first post-handshake ACK now reflects the requested value; unpatched it
stays clamped at ~64 KB:
req_segs unpatched patched
256 ~64 KB 360 KB (256 * 1440)
1024 ~64 KB 1.41 MB (1024 * 1440)
4096 ~64 KB 5.63 MB (4096 * 1440)
(The SYN window itself is unscaled/capped; the offered window appears on
the first scaled post-handshake ACK.)
Regression: tools/testing/selftests/net/packetdrill run under virtme-ng
on this commit vs its parent produces an identical pass/fail set (no
newly failing tests).
net/ipv4/tcp_output.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index d7c1444b5e30..478e4951140f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -4101,6 +4101,7 @@ static void tcp_ca_dst_init(struct sock *sk, const struct dst_entry *dst)
static void tcp_connect_init(struct sock *sk)
{
const struct dst_entry *dst = __sk_dst_get(sk);
+ int full_space = tcp_full_space(sk);
struct tcp_sock *tp = tcp_sk(sk);
__u8 rcv_wscale;
u16 user_mss;
@@ -4133,14 +4134,16 @@ static void tcp_connect_init(struct sock *sk)
/* limit the window selection if the user enforce a smaller rx buffer */
if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
- (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
- WRITE_ONCE(tp->window_clamp, tcp_full_space(sk));
+ (tp->window_clamp > full_space || tp->window_clamp == 0))
+ WRITE_ONCE(tp->window_clamp, full_space);
rcv_wnd = tcp_rwnd_init_bpf(sk);
if (rcv_wnd == 0)
rcv_wnd = dst_metric(dst, RTAX_INITRWND);
+ else if (full_space < rcv_wnd * tp->advmss)
+ full_space = rcv_wnd * tp->advmss;
- tcp_select_initial_window(sk, tcp_full_space(sk),
+ tcp_select_initial_window(sk, full_space,
tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
&tp->rcv_wnd,
&tp->window_clamp,
--
2.53.0-MetaOn Wed, Jul 22, 2026 at 7:01 PM Tejas Birajdar <tejasbirajdar@meta.com> wrote:
>
> BPF_SOCK_OPS_RWND_INIT lets a sockops BPF program pick the initial TCP
> receive window, e.g. to advertise a larger window up front in environments
> where that is known to be safe. Today it is only effective for the passive
> (listener) side; on the active (connect) side the value is computed and
> then silently discarded.
>
> On the passive path tcp_openreq_init_rwin() inflates full_space when the
> program returns a non-zero window, so tcp_select_initial_window() can offer
> it:
>
> else if (full_space < rcv_wnd * mss)
> full_space = rcv_wnd * mss;
>
> tcp_select_initial_window() only clamps the requested window *down* to the
> available space, so without inflating the space first the BPF reply can
> never raise the offered window above tcp_full_space(sk).
>
> tcp_connect_init() calls tcp_rwnd_init_bpf() but never inflates full_space,
> so on connect() the requested window is clamped back to tcp_full_space(sk)
> (~64KB at the default rcvbuf) and the program's value is ignored.
>
> Mirror the listener-side inflation in tcp_connect_init() so both directions
> behave the same. tp->advmss is the mss the listener path uses as well (both
> are tcp_mss_clamp(tp, dst_metric_advmss(dst))).
>
> Fixes: 13d3b1ebe287 ("bpf: Support for setting initial receive window")
> Signed-off-by: Tejas Birajdar <tejasbirajdar@meta.com>
> ---
> Functional test: attached a cgroup sockops BPF program that sets
> skops->reply for BPF_SOCK_OPS_RWND_INIT on the connecting socket, and
> drove it with packetdrill on the active-open (connect) path (wscale 11,
> advmss 1440). On the patched kernel the advertised receive window on the
> first post-handshake ACK now reflects the requested value; unpatched it
> stays clamped at ~64 KB:
>
> req_segs unpatched patched
> 256 ~64 KB 360 KB (256 * 1440)
> 1024 ~64 KB 1.41 MB (1024 * 1440)
> 4096 ~64 KB 5.63 MB (4096 * 1440)
>
> (The SYN window itself is unscaled/capped; the offered window appears on
> the first scaled post-handshake ACK.)
>
> Regression: tools/testing/selftests/net/packetdrill run under virtme-ng
> on this commit vs its parent produces an identical pass/fail set (no
> newly failing tests).
>
> net/ipv4/tcp_output.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> index d7c1444b5e30..478e4951140f 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
> @@ -4101,6 +4101,7 @@ static void tcp_ca_dst_init(struct sock *sk, const struct dst_entry *dst)
> static void tcp_connect_init(struct sock *sk)
> {
> const struct dst_entry *dst = __sk_dst_get(sk);
> + int full_space = tcp_full_space(sk);
> struct tcp_sock *tp = tcp_sk(sk);
> __u8 rcv_wscale;
> u16 user_mss;
> @@ -4133,14 +4134,16 @@ static void tcp_connect_init(struct sock *sk)
>
> /* limit the window selection if the user enforce a smaller rx buffer */
> if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
> - (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
> - WRITE_ONCE(tp->window_clamp, tcp_full_space(sk));
> + (tp->window_clamp > full_space || tp->window_clamp == 0))
> + WRITE_ONCE(tp->window_clamp, full_space);
>
> rcv_wnd = tcp_rwnd_init_bpf(sk);
> if (rcv_wnd == 0)
> rcv_wnd = dst_metric(dst, RTAX_INITRWND);
> + else if (full_space < rcv_wnd * tp->advmss)
> + full_space = rcv_wnd * tp->advmss;
>
> - tcp_select_initial_window(sk, tcp_full_space(sk),
> + tcp_select_initial_window(sk, full_space,
> tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
> &tp->rcv_wnd,
> &tp->window_clamp,
> --
LGTM, but it seems "rcv_wnd * tp->advmss" could overflow
I would suggest squashing to your patch the following fix to current code,
and apply the same logic to your added code.
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index ddc4b17a826b52afa967e17d482403f373f2f72a..f8c1123aba433713f60b30fd4e1df7fe4f1860bc
100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -453,8 +453,8 @@ void tcp_openreq_init_rwin(struct request_sock *req,
rcv_wnd = tcp_rwnd_init_bpf((struct sock *)req);
if (rcv_wnd == 0)
rcv_wnd = dst_metric(dst, RTAX_INITRWND);
- else if (full_space < rcv_wnd * mss)
- full_space = rcv_wnd * mss;
+ else if (full_space < (u64)rcv_wnd * mss)
+ full_space = min_t(u64, (u64)rcv_wnd * mss, INT_MAX);
/* tcp_full_space because it is guaranteed to be the first packet */
tcp_select_initial_window(sk_listener, full_space,
© 2016 - 2026 Red Hat, Inc.