* [PATCH mptcp-net v3 1/2] mptcp: prevent race between disconnect() and rtx
2026-08-28 10:17 [PATCH mptcp-net v3 0/2] mptcp: more cleanups Paolo Abeni
@ 2026-08-28 10:17 ` Paolo Abeni
2026-08-28 10:17 ` [PATCH mptcp-net v3 2/2] Squash-to: "mptcp: do not reschedule the RTX timer for fallback sockets" Paolo Abeni
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Paolo Abeni @ 2026-08-28 10:17 UTC (permalink / raw)
To: mptcp
Sashiko noted that the two event can race, leading to inconsistent
status. Prevent the race using the synchronous timer stop operation.
Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
net/mptcp/protocol.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f22d64ab1c53..1e7e59d497c5 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3625,6 +3625,7 @@ static void mptcp_destroy_common(struct mptcp_sock *msk)
static int mptcp_disconnect(struct sock *sk, int flags)
{
+ struct inet_connection_sock *icsk = inet_csk(sk);
struct mptcp_sock *msk = mptcp_sk(sk);
/* We are on the fastopen error path. We can't call straight into the
@@ -3637,8 +3638,13 @@ static int mptcp_disconnect(struct sock *sk, int flags)
mptcp_check_listen_stop(sk);
mptcp_set_state(sk, TCP_CLOSE);
- mptcp_stop_rtx_timer(sk);
- mptcp_stop_tout_timer(sk);
+ /* The later subflow close can not kick again the tout timer,
+ * as the msk is already in closed status.
+ */
+ msk->timer_ival = icsk->icsk_rto_min;
+ sk_stop_timer_sync(sk, &sk->mptcp_retransmit_timer);
+ icsk->icsk_mtup.probe_timestamp = 0;
+ sk_stop_timer_sync(sk, &icsk->mptcp_tout_timer);
mptcp_pm_connection_closed(msk);
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH mptcp-net v3 2/2] Squash-to: "mptcp: do not reschedule the RTX timer for fallback sockets"
2026-08-28 10:17 [PATCH mptcp-net v3 0/2] mptcp: more cleanups Paolo Abeni
2026-08-28 10:17 ` [PATCH mptcp-net v3 1/2] mptcp: prevent race between disconnect() and rtx Paolo Abeni
@ 2026-08-28 10:17 ` Paolo Abeni
2026-08-28 11:22 ` [PATCH mptcp-net v3 0/2] mptcp: more cleanups MPTCP CI
2026-08-28 17:32 ` Matthieu Baerts
3 siblings, 0 replies; 5+ messages in thread
From: Paolo Abeni @ 2026-08-28 10:17 UTC (permalink / raw)
To: mptcp
Sashiko noted that the 'RTX disabled' status is carried over
across connect() failures, potentially to subsequent successful connect()
or listen().
Explicitly control the RTX enabling status across the whole msk life-cycle.
To make the code more straight forward switch the newly introduced flag
semantic.
To be appended to the squash-to commit message:
"""
The RTX enable bit is clear at close time and set before the msk could
start retransmitting, with a couple of caveats:
- passive sockets inherit the bit from the listener msk; set the bit on
such socket to avoid flipping it in the fast-path, even if the listener
will obviously never retransmit.
- while fastopening, mptcp_sendmsg_fastopen still ends-up calling
mptcp_connect via tcp_sendmsg_fastopen ->
__inet_stream_connect(ssk->sk_socket), and the first subflow sk_socket
points to the msk one.
"""
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
v2 -> v3:
- roll back to v1, sashiko review was wrong and I should have noticed :(
hopefully the update changelog should guide sashiko review to avoid
repeating the sloop, in any case the issue reported here:
https://sashiko.dev/#/patchset/f1e8ffe44c3756195391a25ecf60e56e02e0f34f.1787739122.git.pabeni%40redhat.com
is a false positive (see the above changelog).
v1 -> v2:
- consolidate enable, fix missing enable for fastopen
---
net/mptcp/protocol.c | 8 +++++---
net/mptcp/protocol.h | 2 +-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 1e7e59d497c5..08e06511cd6f 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -96,7 +96,7 @@ bool __mptcp_try_fallback(struct mptcp_sock *msk, int fb_mib)
msk->allow_subflows = false;
set_bit(MPTCP_FALLBACK_DONE, &msk->flags);
- set_bit(MPTCP_RTX_DISABLED, &msk->flags);
+ clear_bit(MPTCP_RTX_ENABLED, &msk->flags);
__MPTCP_INC_STATS(net, fb_mib);
spin_unlock_bh(&msk->fallback_lock);
return true;
@@ -1126,7 +1126,7 @@ static void mptcp_reset_rtx_timer(struct sock *sk)
unsigned long tout;
/* Prevent rescheduling on close and in case of fallback. */
- if (test_bit(MPTCP_RTX_DISABLED, &msk->flags))
+ if (!test_bit(MPTCP_RTX_ENABLED, &msk->flags))
return;
tout = msk->timer_ival;
@@ -3363,7 +3363,7 @@ void mptcp_set_state(struct sock *sk, int state)
*/
break;
case TCP_CLOSE:
- set_bit(MPTCP_RTX_DISABLED, &mptcp_sk(sk)->flags);
+ clear_bit(MPTCP_RTX_ENABLED, &mptcp_sk(sk)->flags);
fallthrough;
default:
if (oldstate == TCP_ESTABLISHED || oldstate == TCP_CLOSE_WAIT)
@@ -4189,6 +4189,7 @@ static int mptcp_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
if (IS_ERR(ssk))
return PTR_ERR(ssk);
+ set_bit(MPTCP_RTX_ENABLED, &msk->flags);
mptcp_set_state(sk, TCP_SYN_SENT);
subflow = mptcp_subflow_ctx(ssk);
#ifdef CONFIG_TCP_MD5SIG
@@ -4336,6 +4337,7 @@ static int mptcp_listen(struct socket *sock, int backlog)
goto unlock;
}
+ set_bit(MPTCP_RTX_ENABLED, &msk->flags);
mptcp_set_state(sk, TCP_LISTEN);
sock_set_flag(sk, SOCK_RCU_FREE);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 3d250e8204d5..482d4a549881 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -116,7 +116,7 @@
#define MPTCP_WORK_RTX 1
#define MPTCP_FALLBACK_DONE 2
#define MPTCP_WORK_CLOSE_SUBFLOW 3
-#define MPTCP_RTX_DISABLED 4
+#define MPTCP_RTX_ENABLED 4
/* MPTCP socket release cb flags */
#define MPTCP_PUSH_PENDING 1
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread