* [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics
@ 2026-10-29 6:45 Cen Zhang
2026-10-29 8:02 ` gang.yan
2026-10-29 8:47 ` MPTCP CI
0 siblings, 2 replies; 3+ messages in thread
From: Cen Zhang @ 2026-10-29 6:45 UTC (permalink / raw)
To: matttbe, martineau
Cc: geliang, mptcp, edumazet, gang.yan, baijiaju1990, jjzuming,
zzzccc427
mptcp_diag_get_info() reports the accept queue of a listening MPTCP
socket by reading msk->first. The token based dump and the exact token
query only hold a reference on the MPTCP socket, which pins neither the
first subflow nor the listener hash bucket, and __mptcp_close_ssk()
drops the last reference on the first subflow before clearing
msk->first.
An application can disconnect a connected MPTCP socket with AF_UNSPEC,
which removes the token but retains the first subflow, listen on it
again and close it. A dump that obtained the MPTCP socket before the
disconnect then reads the backlog of a freed TCP listener:
Token diagnostic Application
mptcp_token_iter_next()
retain MPTCP socket
connect(AF_UNSPEC)
remove token, retain first
listen()
reuse first
mptcp_diag_get_info()
observe TCP_LISTEN
lsk = msk->first
close()
mptcp_destroy()
__mptcp_close_ssk()
release first
read lsk->sk_ack_backlog
The report below was decoded with scripts/decode_stacktrace.sh against
the 7.2.0-rc5 based test kernel that produced it, with the line numbers
mapped to this tree; only the relevant frames are kept:
BUG: KASAN: slab-use-after-free in mptcp_diag_get_info (net/mptcp/mptcp_diag.c:209)
Read of size 4 at addr ffff888111763818 by task python3/499
Call Trace:
mptcp_diag_get_info (net/mptcp/mptcp_diag.c:209)
inet_sk_diag_fill (net/ipv4/inet_diag.c:330)
mptcp_diag_dump (net/mptcp/mptcp_diag.c:23 net/mptcp/mptcp_diag.c:177)
__inet_diag_dump (net/ipv4/inet_diag.c:823)
netlink_dump (net/netlink/af_netlink.c:2355)
Allocated by task 497:
sk_alloc (net/core/sock.c:2337)
inet_create (net/ipv4/af_inet.c:333)
__sock_create (net/socket.c:1679)
mptcp_subflow_create_socket (net/mptcp/subflow.c:1836)
__mptcp_nmpc_sk (net/mptcp/protocol.c:111 net/mptcp/protocol.c:143)
mptcp_setsockopt (net/mptcp/sockopt.c:313 net/mptcp/sockopt.c:916)
Freed by task 0:
slab_free_after_rcu_debug (mm/slub.c:6571)
rcu_core (kernel/rcu/tree.c:2919)
Second to last potentially related work creation:
__call_rcu_common.constprop.0 (kernel/rcu/tree.c:3287)
sk_destruct (net/core/sock.c:2446)
__sk_free (net/core/sock.c:2459)
sk_free (net/core/sock.c:2470)
__mptcp_close_ssk (include/net/sock.h:2024 net/mptcp/protocol.c:2723)
mptcp_destroy_common (net/mptcp/protocol.c:3581)
mptcp_destroy (net/mptcp/protocol.c:3817)
__mptcp_destroy_sock (net/mptcp/protocol.c:3423)
__mptcp_close (net/mptcp/protocol.c:3525)
mptcp_close (net/mptcp/protocol.c:3540)
inet_release (net/ipv4/af_inet.c:442)
The first subflow is a TCP socket: TCP listeners carry SOCK_RCU_FREE
and tcp_prot/tcpv6_prot sockets live in SLAB_TYPESAFE_BY_RCU caches, so
reading the two backlog counters under rcu_read_lock() is safe, and a
stale value is acceptable for diagnostics. mptcp_diag_dump_listeners()
already runs the formatter inside an RCU read-side section; only the
token dump and mptcp_diag_dump_one() reach it without one. Take
rcu_read_lock() around the msk->first snapshot and the backlog reads.
That alone does not cover the token dump: __mptcp_close_ssk() clears
msk->first only after dropping its reference on the first subflow, so a
dump that enters its read-side section once the grace period has ended
can still load the pointer to the freed listener. Clear msk->first
before dropping the reference, as mptcp_sk_clone_init() already does on
its error path.
Fixes: 4fa39b701ce9 ("mptcp: listen diag dump support")
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: LLM
---
Changes in v3:
- Clear msk->first in __mptcp_close_ssk() before dropping the reference on
the first subflow: the RCU read-side section only protects a pointer that
is cleared before the subflow can be released (Sashiko review).
- Rebase on the export-net branch of mptcp_net-next and remap the decoded
line numbers to it; send to the MPTCP list only, as Gang Yan and Matthieu
Baerts suggested.
Changes in v2:
- Take rcu_read_lock() around the first subflow reads instead of the MPTCP
data lock plus an owner check, as suggested by Eric Dumazet; this avoids
the new msk slock -> listener hash lock nesting and keeps ss reporting the
accept queue while the socket is owned.
- Decode the stack trace with scripts/decode_stacktrace.sh, map the line
numbers to this tree and keep only the relevant frames.
Link to v1: https://lore.kernel.org/r/pm-mptcp-objects-candidate-0066-v3-73df72b7a543d4cada0e@gmail.com
Link to v2: https://lore.kernel.org/r/pm-mptcp-objects-candidate-0066-v5-4d1b83d62fcde2d57e8d@gmail.com
net/mptcp/mptcp_diag.c | 5 ++++-
net/mptcp/protocol.c | 7 +++++--
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
index 136c2d05c0ee..28a42eee6651 100644
--- a/net/mptcp/mptcp_diag.c
+++ b/net/mptcp/mptcp_diag.c
@@ -200,8 +200,10 @@ static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
r->idiag_wqueue = sk_wmem_alloc_get(sk);
if (inet_sk_state_load(sk) == TCP_LISTEN) {
- struct sock *lsk = READ_ONCE(msk->first);
+ struct sock *lsk;
+ rcu_read_lock();
+ lsk = READ_ONCE(msk->first);
if (lsk) {
/* override with settings from tcp listener,
* so Send-Q will show accept queue.
@@ -209,6 +211,7 @@ static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
r->idiag_rqueue = READ_ONCE(lsk->sk_ack_backlog);
r->idiag_wqueue = READ_ONCE(lsk->sk_max_ack_backlog);
}
+ rcu_read_unlock();
}
if (!info)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 4335eb8f9f2d..efc6d4db5bbc 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2720,11 +2720,14 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
__mptcp_subflow_error_report(sk, ssk);
release_sock(ssk);
- sock_put(ssk);
-
+ /* the diag code reads msk->first under RCU only: clear it before
+ * dropping the reference that keeps the subflow alive
+ */
if (ssk == msk->first)
WRITE_ONCE(msk->first, NULL);
+ sock_put(ssk);
+
out:
__mptcp_sync_sndbuf(sk);
if (need_push)
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics
2026-10-29 6:45 [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics Cen Zhang
@ 2026-10-29 8:02 ` gang.yan
2026-10-29 8:47 ` MPTCP CI
1 sibling, 0 replies; 3+ messages in thread
From: gang.yan @ 2026-10-29 8:02 UTC (permalink / raw)
To: Cen Zhang, matttbe, martineau
Cc: geliang, mptcp, edumazet, baijiaju1990, jjzuming, zzzccc427
>
> mptcp_diag_get_info() reports the accept queue of a listening MPTCP
> socket by reading msk->first. The token based dump and the exact token
> query only hold a reference on the MPTCP socket, which pins neither the
> first subflow nor the listener hash bucket, and __mptcp_close_ssk()
> drops the last reference on the first subflow before clearing
> msk->first.
>
> An application can disconnect a connected MPTCP socket with AF_UNSPEC,
> which removes the token but retains the first subflow, listen on it
> again and close it. A dump that obtained the MPTCP socket before the
> disconnect then reads the backlog of a freed TCP listener:
>
> Token diagnostic Application
> mptcp_token_iter_next()
> retain MPTCP socket
> connect(AF_UNSPEC)
> remove token, retain first
> listen()
> reuse first
> mptcp_diag_get_info()
> observe TCP_LISTEN
> lsk = msk->first
> close()
> mptcp_destroy()
> __mptcp_close_ssk()
> release first
> read lsk->sk_ack_backlog
>
> The report below was decoded with scripts/decode_stacktrace.sh against
> the 7.2.0-rc5 based test kernel that produced it, with the line numbers
> mapped to this tree; only the relevant frames are kept:
>
> BUG: KASAN: slab-use-after-free in mptcp_diag_get_info (net/mptcp/mptcp_diag.c:209)
> Read of size 4 at addr ffff888111763818 by task python3/499
>
> Call Trace:
> mptcp_diag_get_info (net/mptcp/mptcp_diag.c:209)
> inet_sk_diag_fill (net/ipv4/inet_diag.c:330)
> mptcp_diag_dump (net/mptcp/mptcp_diag.c:23 net/mptcp/mptcp_diag.c:177)
> __inet_diag_dump (net/ipv4/inet_diag.c:823)
> netlink_dump (net/netlink/af_netlink.c:2355)
>
> Allocated by task 497:
> sk_alloc (net/core/sock.c:2337)
> inet_create (net/ipv4/af_inet.c:333)
> __sock_create (net/socket.c:1679)
> mptcp_subflow_create_socket (net/mptcp/subflow.c:1836)
> __mptcp_nmpc_sk (net/mptcp/protocol.c:111 net/mptcp/protocol.c:143)
> mptcp_setsockopt (net/mptcp/sockopt.c:313 net/mptcp/sockopt.c:916)
>
> Freed by task 0:
> slab_free_after_rcu_debug (mm/slub.c:6571)
> rcu_core (kernel/rcu/tree.c:2919)
>
> Second to last potentially related work creation:
> __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3287)
> sk_destruct (net/core/sock.c:2446)
> __sk_free (net/core/sock.c:2459)
> sk_free (net/core/sock.c:2470)
> __mptcp_close_ssk (include/net/sock.h:2024 net/mptcp/protocol.c:2723)
> mptcp_destroy_common (net/mptcp/protocol.c:3581)
> mptcp_destroy (net/mptcp/protocol.c:3817)
> __mptcp_destroy_sock (net/mptcp/protocol.c:3423)
> __mptcp_close (net/mptcp/protocol.c:3525)
> mptcp_close (net/mptcp/protocol.c:3540)
> inet_release (net/ipv4/af_inet.c:442)
>
> The first subflow is a TCP socket: TCP listeners carry SOCK_RCU_FREE
> and tcp_prot/tcpv6_prot sockets live in SLAB_TYPESAFE_BY_RCU caches, so
> reading the two backlog counters under rcu_read_lock() is safe, and a
> stale value is acceptable for diagnostics. mptcp_diag_dump_listeners()
> already runs the formatter inside an RCU read-side section; only the
> token dump and mptcp_diag_dump_one() reach it without one. Take
> rcu_read_lock() around the msk->first snapshot and the backlog reads.
>
> That alone does not cover the token dump: __mptcp_close_ssk() clears
> msk->first only after dropping its reference on the first subflow, so a
> dump that enters its read-side section once the grace period has ended
> can still load the pointer to the freed listener. Clear msk->first
> before dropping the reference, as mptcp_sk_clone_init() already does on
> its error path.
>
> Fixes: 4fa39b701ce9 ("mptcp: listen diag dump support")
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> Assisted-by: LLM
Hi Cen
According to [1], the Assisted-by tag is not required here.
> ---
> Changes in v3:
> - Clear msk->first in __mptcp_close_ssk() before dropping the reference on
> the first subflow: the RCU read-side section only protects a pointer that
> is cleared before the subflow can be released (Sashiko review).
> - Rebase on the export-net branch of mptcp_net-next and remap the decoded
> line numbers to it; send to the MPTCP list only, as Gang Yan and Matthieu
> Baerts suggested.
>
> Changes in v2:
> - Take rcu_read_lock() around the first subflow reads instead of the MPTCP
> data lock plus an owner check, as suggested by Eric Dumazet; this avoids
> the new msk slock -> listener hash lock nesting and keeps ss reporting the
> accept queue while the socket is owned.
> - Decode the stack trace with scripts/decode_stacktrace.sh, map the line
> numbers to this tree and keep only the relevant frames.
>
> Link to v1: https://lore.kernel.org/r/pm-mptcp-objects-candidate-0066-v3-73df72b7a543d4cada0e@gmail.com
> Link to v2: https://lore.kernel.org/r/pm-mptcp-objects-candidate-0066-v5-4d1b83d62fcde2d57e8d@gmail.com
>
> net/mptcp/mptcp_diag.c | 5 ++++-
> net/mptcp/protocol.c | 7 +++++--
> 2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
> index 136c2d05c0ee..28a42eee6651 100644
> --- a/net/mptcp/mptcp_diag.c
> +++ b/net/mptcp/mptcp_diag.c
> @@ -200,8 +200,10 @@ static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
> r->idiag_wqueue = sk_wmem_alloc_get(sk);
>
> if (inet_sk_state_load(sk) == TCP_LISTEN) {
> - struct sock *lsk = READ_ONCE(msk->first);
> + struct sock *lsk;
>
> + rcu_read_lock();
> + lsk = READ_ONCE(msk->first);
> if (lsk) {
> /* override with settings from tcp listener,
> * so Send-Q will show accept queue.
> @@ -209,6 +211,7 @@ static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
> r->idiag_rqueue = READ_ONCE(lsk->sk_ack_backlog);
> r->idiag_wqueue = READ_ONCE(lsk->sk_max_ack_backlog);
> }
> + rcu_read_unlock();
> }
>
> if (!info)
> diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
> index 4335eb8f9f2d..efc6d4db5bbc 100644
> --- a/net/mptcp/protocol.c
> +++ b/net/mptcp/protocol.c
> @@ -2720,11 +2720,14 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
> __mptcp_subflow_error_report(sk, ssk);
> release_sock(ssk);
>
> - sock_put(ssk);
> -
> + /* the diag code reads msk->first under RCU only: clear it before
> + * dropping the reference that keeps the subflow alive
> + */
This comment doesn't seem necessary. I'd suggest dropping it.
Otherwise LGTM.
Reviewed-by: Gang Yan <gang.yan@linux.dev>
[1] https://lore.kernel.org/lkml/87o6cww7c1.fsf@trenco.lwn.net/
> if (ssk == msk->first)
> WRITE_ONCE(msk->first, NULL);
>
> + sock_put(ssk);
> +
> out:
> __mptcp_sync_sndbuf(sk);
> if (need_push)
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics
2026-10-29 6:45 [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics Cen Zhang
2026-10-29 8:02 ` gang.yan
@ 2026-10-29 8:47 ` MPTCP CI
1 sibling, 0 replies; 3+ messages in thread
From: MPTCP CI @ 2026-10-29 8:47 UTC (permalink / raw)
To: Cen Zhang; +Cc: mptcp
Hi Cen,
Thank you for your modifications, that's great!
Our CI did some validations and here is its report:
- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Critical: mptcp-perf/01-Test_1/client.log: Global Timeout - Critical: mptcp-perf/01-Test_1/server.log: Global Timeout - Critical: sched-baseline/01-slow_primary/client.log: Global Timeout - Critical: sched-baseline/01-slow_primary/server.log: Global Timeout - Critical: sched-baseline/02-tiny_primary/client.log: Global Timeout - Critical: sched-baseline/02-tiny_primary/server.log: Global Timeout - Critical: sched-baseline/03-fast_both/client.log: Global Timeout - Critical: sched-baseline/03-fast_both/server.log: Global Timeout - Critical: sched-baseline/04-balanced/client.log: Global Timeout - Critical: sched-baseline/04-balanced/server.log: Global Timeout - Critical: sched-baseline/05-slow_near_primary/client.log: Global Timeout - Critical: sched-baseline/05-slow_near_primary/server.log: Global Timeout - Critical: sched-baseline/06-slow_secondary/client.log: Global Timeout - Critical: sched-baseline/06-slow_secondary/server.log: Global Timeout - Critical: sched-baseline/07-very_fast/client.log: Global Timeout - Critical: sched-baseline/07-very_fast/server.log: Global Timeout - Critical: sched-baseline/08-shallow_primary/client.log: Global Timeout - Critical: sched-baseline/08-shallow_primary/server.log: Global Timeout - Critical: sched-baseline/09-high_lat_primary/client.log: Global Timeout - Critical: sched-baseline/09-high_lat_primary/server.log: Global Timeout - Critical: sched-baseline/10-huge_lat_primary/client.log: Global Timeout - Critical: sched-baseline/10-huge_lat_primary/server.log: Global Timeout - Critical: sched-baseline/11-high_lat_secondary/client.log: Global Timeout - Critical: sched-baseline/11-high_lat_secondary/server.log: Global Timeout - Critical: sched-baseline/12-huge_lat_secondary/client.log: Global Timeout - Critical: sched-baseline/12-huge_lat_secondary/server.log: Global Timeout - Critical: sched-baseline/13-bloated_primary/client.log: Global Timeout - Critical: sched-baseline/13-bloated_primary/server.log: Global Timeout - Critical: sched-baseline/14-bloated_secondary/client.log: Global Timeout - Critical: sched-baseline/14-bloated_secondary/server.log: Global Timeout - Critical: sched-baseline/15-slow_primary_upload/client.log: Global Timeout - Critical: sched-baseline/15-slow_primary_upload/server.log: Global Timeout - Critical: sched-baseline/16-balanced_upload/client.log: Global Timeout - Critical: sched-baseline/16-balanced_upload/server.log: Global Timeout - Critical: sched-baseline/17-slow_primary_parallel_4/client.log: Global Timeout - Critical: sched-baseline/17-slow_primary_parallel_4/server.log: Global Timeout - Critical: sched-baseline/18-balanced_parallel_4/client.log: Global Timeout - Critical: sched-baseline/18-balanced_parallel_4/server.log: Global Timeout - Critical: sched-bbr/01-slow_primary_bbr/client.log: Global Timeout - Critical: sched-bbr/01-slow_primary_bbr/server.log: Global Timeout - Critical: sched-bbr/02-balanced_bbr/client.log: Global Timeout - Critical: sched-bbr/02-balanced_bbr/server.log: Global Timeout - Critical: sched-bbr/03-slow_near_primary_bbr/client.log: Global Timeout - Critical: sched-bbr/03-slow_near_primary_bbr/server.log: Global Timeout - Critical: sched-bbr/04-high_lat_primary_bbr/client.log: Global Timeout - Critical: sched-bbr/04-high_lat_primary_bbr/server.log: Global Timeout - Critical: sched-bbr/05-huge_lat_primary_bbr/client.log: Global Timeout - Critical: sched-bbr/05-huge_lat_primary_bbr/server.log: Global Timeout - Critical: sched-bbr/06-high_lat_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/06-high_lat_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/07-huge_lat_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/07-huge_lat_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/08-slow_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/08-slow_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/09-very_fast_bbr/client.log: Global Timeout - Critical: sched-bbr/09-very_fast_bbr/server.log: Global Timeout - Critical: sched-bbr/10-bloated_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/10-bloated_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/11-bloated_slow_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/11-bloated_slow_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/12-very_bloated_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/12-very_bloated_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/13-bad_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/13-bad_secondary_bbr/server.log: Global Timeout - Critical: sched-bbr/14-far_secondary_bbr/client.log: Global Timeout - Critical: sched-bbr/14-far_secondary_bbr/server.log: Global Timeout - Critical: sched-clientlim/01-slow_primary_bw_5/client.log: Global Timeout - Critical: sched-clientlim/01-slow_primary_bw_5/server.log: Global Timeout - Critical: sched-clientlim/02-balanced_bw_5/client.log: Global Timeout - Critical: sched-clientlim/02-balanced_bw_5/server.log: Global Timeout - Critical: sched-clientlim/03-huge_lat_primary_bw_5/client.log: Global Timeout - Critical: sched-clientlim/03-huge_lat_primary_bw_5/server.log: Global Timeout - Critical: sched-clientlim/04-slow_secondary_bw_5/client.log: Global Timeout - Critical: sched-clientlim/04-slow_secondary_bw_5/server.log: Global Timeout - Critical: sched-clientlim/05-slow_primary_bw_10/client.log: Global Timeout - Critical: sched-clientlim/05-slow_primary_bw_10/server.log: Global Timeout - Critical: sched-clientlim/06-balanced_bw_10/client.log: Global Timeout - Critical: sched-clientlim/06-balanced_bw_10/server.log: Global Timeout - Critical: sched-clientlim/07-huge_lat_primary_bw_10/client.log: Global Timeout - Critical: sched-clientlim/07-huge_lat_primary_bw_10/server.log: Global Timeout - Critical: sched-clientlim/08-slow_secondary_bw_10/client.log: Global Timeout - Critical: sched-clientlim/08-slow_secondary_bw_10/server.log: Global Timeout - Critical: sched-clientlim/09-slow_primary_bw_50/client.log: Global Timeout - Critical: sched-clientlim/09-slow_primary_bw_50/server.log: Global Timeout - Critical: sched-clientlim/10-balanced_bw_50/client.log: Global Timeout - Critical: sched-clientlim/10-balanced_bw_50/server.log: Global Timeout - Critical: sched-clientlim/11-huge_lat_primary_bw_50/client.log: Global Timeout - Critical: sched-clientlim/11-huge_lat_primary_bw_50/server.log: Global Timeout - Critical: sched-clientlim/12-slow_secondary_bw_50/client.log: Global Timeout - Critical: sched-clientlim/12-slow_secondary_bw_50/server.log: Global Timeout - Critical: sched-cpu-preempt/01-shallow_primary/client.log: Global Timeout - Critical: sched-cpu-preempt/01-shallow_primary/server.log: Global Timeout - Critical: sched-cpu-preempt/02-shallow_primary_cpu_hog/client.log: Global Timeout - Critical: sched-cpu-preempt/02-shallow_primary_cpu_hog/server.log: Global Timeout - Critical: sched-mem-pressure/01-bloated_slow_secondary_receiver_tcp_mem_parallel_1/client.log: Global Timeout - Critical: sched-mem-pressure/01-bloated_slow_secondary_receiver_tcp_mem_parallel_1/server.log: Global Timeout - Critical: sched-mem-pressure/02-bloated_slow_secondary_receiver_tcp_mem_parallel_16/client.log: Global Timeout - Critical: sched-mem-pressure/02-bloated_slow_secondary_receiver_tcp_mem_parallel_16/server.log: Global Timeout - Critical: sched-mem-pressure/03-bloated_slow_secondary_receiver_tcp_mem_parallel_99/client.log: Global Timeout - Critical: sched-mem-pressure/03-bloated_slow_secondary_receiver_tcp_mem_parallel_99/server.log: Global Timeout - Critical: sched-mem-pressure/04-very_bloated_primary_both_tcp_mem_parallel_1/client.log: Global Timeout - Critical: sched-mem-pressure/04-very_bloated_primary_both_tcp_mem_parallel_1/server.log: Global Timeout - Critical: sched-mem-pressure/05-slow_primary_both_tcp_mem_parallel_1/client.log: Global Timeout - Critical: sched-mem-pressure/05-slow_primary_both_tcp_mem_parallel_1/server.log: Global Timeout - Critical: sched-mem-pressure/06-balanced_both_tcp_mem_parallel_1/client.log: Global Timeout - Critical: sched-mem-pressure/06-balanced_both_tcp_mem_parallel_1/server.log: Global Timeout - Critical: sched-mem-pressure/07-very_bloated_primary_both_tcp_mem_parallel_10/client.log: Global Timeout - Critical: sched-mem-pressure/07-very_bloated_primary_both_tcp_mem_parallel_10/server.log: Global Timeout - Critical: sched-mem-pressure/08-slow_primary_both_tcp_mem_parallel_10/client.log: Global Timeout - Critical: sched-mem-pressure/08-slow_primary_both_tcp_mem_parallel_10/server.log: Global Timeout - Critical: sched-mem-pressure/09-balanced_both_tcp_mem_parallel_10/client.log: Global Timeout - Critical: sched-mem-pressure/09-balanced_both_tcp_mem_parallel_10/server.log: Global Timeout - Critical: sched-rmem/01-slow_primary_rmem_200/client.log: Global Timeout - Critical: sched-rmem/01-slow_primary_rmem_200/server.log: Global Timeout - Critical: sched-rmem/02-balanced_rmem_200/client.log: Global Timeout - Critical: sched-rmem/02-balanced_rmem_200/server.log: Global Timeout - Critical: sched-rmem/03-huge_lat_primary_rmem_200/client.log: Global Timeout - Critical: sched-rmem/03-huge_lat_primary_rmem_200/server.log: Global Timeout - Critical: sched-rmem/04-bloated_primary_rmem_200/client.log: Global Timeout - Critical: sched-rmem/04-bloated_primary_rmem_200/server.log: Global Timeout - Critical: sched-rmem/05-slow_primary_rmem_800/client.log: Global Timeout - Critical: sched-rmem/05-slow_primary_rmem_800/server.log: Global Timeout - Critical: sched-rmem/06-balanced_rmem_800/client.log: Global Timeout - Critical: sched-rmem/06-balanced_rmem_800/server.log: Global Timeout - Critical: sched-rmem/07-huge_lat_primary_rmem_800/client.log: Global Timeout - Critical: sched-rmem/07-huge_lat_primary_rmem_800/server.log: Global Timeout - Critical: sched-rmem/08-bloated_primary_rmem_800/client.log: Global Timeout - Critical: sched-rmem/08-bloated_primary_rmem_800/server.log: Global Timeout - Critical: sched-rmem/09-slow_primary_rmem_2000/client.log: Global Timeout - Critical: sched-rmem/09-slow_primary_rmem_2000/server.log: Global Timeout - Critical: sched-rmem/10-balanced_rmem_2000/client.log: Global Timeout - Critical: sched-rmem/10-balanced_rmem_2000/server.log: Global Timeout - Critical: sched-rmem/11-huge_lat_primary_rmem_2000/client.log: Global Timeout - Critical: sched-rmem/11-huge_lat_primary_rmem_2000/server.log: Global Timeout - Critical: sched-rmem/12-bloated_primary_rmem_2000/client.log: Global Timeout - Critical: sched-rmem/12-bloated_primary_rmem_2000/server.log: Global Timeout - Critical: sched-rmem/13-slow_primary_rmem_6000/client.log: Global Timeout - Critical: sched-rmem/13-slow_primary_rmem_6000/server.log: Global Timeout - Critical: sched-rmem/14-balanced_rmem_6000/client.log: Global Timeout - Critical: sched-rmem/14-balanced_rmem_6000/server.log: Global Timeout - Critical: sched-rmem/15-huge_lat_primary_rmem_6000/client.log: Global Timeout - Critical: sched-rmem/15-huge_lat_primary_rmem_6000/server.log: Global Timeout - Critical: sched-rmem/16-bloated_primary_rmem_6000/client.log: Global Timeout - Critical: sched-rmem/16-bloated_primary_rmem_6000/server.log: Global Timeout - Critical: sched-serverlim/01-slow_primary_bw_5_burst_10/client.log: Global Timeout - Critical: sched-serverlim/01-slow_primary_bw_5_burst_10/server.log: Global Timeout - Critical: sched-serverlim/02-balanced_bw_5_burst_10/client.log: Global Timeout - Critical: sched-serverlim/02-balanced_bw_5_burst_10/server.log: Global Timeout - Critical: sched-serverlim/03-huge_lat_primary_bw_5_burst_10/client.log: Global Timeout - Critical: sched-serverlim/03-huge_lat_primary_bw_5_burst_10/server.log: Global Timeout - Critical: sched-serverlim/04-slow_secondary_bw_5_burst_10/client.log: Global Timeout - Critical: sched-serverlim/04-slow_secondary_bw_5_burst_10/server.log: Global Timeout - Critical: sched-serverlim/05-slow_primary_bw_5_burst_250/client.log: Global Timeout - Critical: sched-serverlim/05-slow_primary_bw_5_burst_250/server.log: Global Timeout - Critical: sched-serverlim/06-balanced_bw_5_burst_250/client.log: Global Timeout - Critical: sched-serverlim/06-balanced_bw_5_burst_250/server.log: Global Timeout - Critical: sched-serverlim/07-huge_lat_primary_bw_5_burst_250/client.log: Global Timeout - Critical: sched-serverlim/07-huge_lat_primary_bw_5_burst_250/server.log: Global Timeout - Critical: sched-serverlim/08-slow_secondary_bw_5_burst_250/client.log: Global Timeout - Critical: sched-serverlim/08-slow_secondary_bw_5_burst_250/server.log: Global Timeout - Critical: sched-serverlim/09-slow_primary_bw_10_burst_10/client.log: Global Timeout - Critical: sched-serverlim/09-slow_primary_bw_10_burst_10/server.log: Global Timeout - Critical: sched-serverlim/10-balanced_bw_10_burst_10/client.log: Global Timeout - Critical: sched-serverlim/10-balanced_bw_10_burst_10/server.log: Global Timeout - Critical: sched-serverlim/11-huge_lat_primary_bw_10_burst_10/client.log: Global Timeout - Critical: sched-serverlim/11-huge_lat_primary_bw_10_burst_10/server.log: Global Timeout - Critical: sched-serverlim/12-slow_secondary_bw_10_burst_10/client.log: Global Timeout - Critical: sched-serverlim/12-slow_secondary_bw_10_burst_10/server.log: Global Timeout - Critical: sched-serverlim/13-slow_primary_bw_10_burst_250/client.log: Global Timeout - Critical: sched-serverlim/13-slow_primary_bw_10_burst_250/server.log: Global Timeout - Critical: sched-serverlim/14-balanced_bw_10_burst_250/client.log: Global Timeout - Critical: sched-serverlim/14-balanced_bw_10_burst_250/server.log: Global Timeout - Critical: sched-serverlim/15-huge_lat_primary_bw_10_burst_250/client.log: Global Timeout - Critical: sched-serverlim/15-huge_lat_primary_bw_10_burst_250/server.log: Global Timeout - Critical: sched-serverlim/16-slow_secondary_bw_10_burst_250/client.log: Global Timeout - Critical: sched-serverlim/16-slow_secondary_bw_10_burst_250/server.log: Global Timeout - Critical: sched-serverlim/17-slow_primary_bw_50_burst_10/client.log: Global Timeout - Critical: sched-serverlim/17-slow_primary_bw_50_burst_10/server.log: Global Timeout - Critical: sched-serverlim/18-balanced_bw_50_burst_10/client.log: Global Timeout - Critical: sched-serverlim/18-balanced_bw_50_burst_10/server.log: Global Timeout - Critical: sched-serverlim/19-huge_lat_primary_bw_50_burst_10/client.log: Global Timeout - Critical: sched-serverlim/19-huge_lat_primary_bw_50_burst_10/server.log: Global Timeout - Critical: sched-serverlim/20-slow_secondary_bw_50_burst_10/client.log: Global Timeout - Critical: sched-serverlim/20-slow_secondary_bw_50_burst_10/server.log: Global Timeout - Critical: sched-serverlim/21-slow_primary_bw_50_burst_250/client.log: Global Timeout - Critical: sched-serverlim/21-slow_primary_bw_50_burst_250/server.log: Global Timeout - Critical: sched-serverlim/22-balanced_bw_50_burst_250/client.log: Global Timeout - Critical: sched-serverlim/22-balanced_bw_50_burst_250/server.log: Global Timeout - Critical: sched-serverlim/23-huge_lat_primary_bw_50_burst_250/client.log: Global Timeout - Critical: sched-serverlim/23-huge_lat_primary_bw_50_burst_250/server.log: Global Timeout - Critical: sched-serverlim/24-slow_secondary_bw_50_burst_250/client.log: Global Timeout - Critical: sched-serverlim/24-slow_secondary_bw_50_burst_250/server.log: Global Timeout - Critical: sched-serverlim/25-slow_primary_bw_10_burst_10_wmem_6000/client.log: Global Timeout - Critical: sched-serverlim/25-slow_primary_bw_10_burst_10_wmem_6000/server.log: Global Timeout - Critical: sched-serverlim/26-balanced_bw_10_burst_10_wmem_6000/client.log: Global Timeout - Critical: sched-serverlim/26-balanced_bw_10_burst_10_wmem_6000/server.log: Global Timeout - Critical: sched-serverlim/27-slow_primary_bw_50_burst_10_wmem_6000/client.log: Global Timeout - Critical: sched-serverlim/27-slow_primary_bw_50_burst_10_wmem_6000/server.log: Global Timeout - Critical: sched-serverlim/28-balanced_bw_50_burst_10_wmem_6000/client.log: Global Timeout - Critical: sched-serverlim/28-balanced_bw_50_burst_10_wmem_6000/server.log: Global Timeout - Critical: sched-weak-secondary/01-weak_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/01-weak_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/02-bad_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/02-bad_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/03-far_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/03-far_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/04-bloated_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/04-bloated_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/05-bloated_slow_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/05-bloated_slow_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/06-very_bloated_secondary/client.log: Global Timeout - Critical: sched-weak-secondary/06-very_bloated_secondary/server.log: Global Timeout - Critical: sched-weak-secondary/07-weak_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/07-weak_secondary_backup/server.log: Global Timeout - Critical: sched-weak-secondary/08-bad_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/08-bad_secondary_backup/server.log: Global Timeout - Critical: sched-weak-secondary/09-far_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/09-far_secondary_backup/server.log: Global Timeout - Critical: sched-weak-secondary/10-bloated_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/10-bloated_secondary_backup/server.log: Global Timeout - Critical: sched-weak-secondary/11-bloated_slow_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/11-bloated_slow_secondary_backup/server.log: Global Timeout - Critical: sched-weak-secondary/12-very_bloated_secondary_backup/client.log: Global Timeout - Critical: sched-weak-secondary/12-very_bloated_secondary_backup/server.log: Global Timeout ❌
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/40833566301
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/70b5a2f58dad
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1195955
If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:
$ cd [kernel source code]
$ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
--pull always mptcp/mptcp-upstream-virtme-docker:latest \
auto-normal
For more details:
https://github.com/multipath-tcp/mptcp-upstream-virtme-docker
Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)
Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-29 8:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-29 6:45 [PATCH mptcp-net v3] mptcp: protect listener backlog reads in diagnostics Cen Zhang
2026-10-29 8:02 ` gang.yan
2026-10-29 8:47 ` MPTCP CI
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.