Re: [PATCH mptcp-net] mptcp: reset MP_JOIN subflows on missing or invalid DSS options

[Matthieu Baerts <matttbe@kernel.org>]

Hi T S,

On 12/10/2026 13:26, T S Rameshkumar wrote:
> Per RFC 8684 Section 3.7, fallback to regular TCP is only permitted
> on the initial subflow. Additional subflows established via MP_JOIN
> MUST NOT fall back to regular TCP, and if an additional subflow
> encounters missing DSS mappings, corrupted mappings, or unmapped data,
> it MUST be closed with a reset.
> 
> Currently, in subflow_check_data_avail(), when an MP_JOIN subflow
> receives data without DSS mapping or with invalid mappings, it branches
> to the fallback label. If fallback was already performed or allowed on
> the connection, the subflow bypasses reset and incorrectly accepts
> plain TCP data, synthesizing a fake fallback mapping.

Do you have a reproducer for this?

> Fix this by explicitly checking if the subflow is a joined subflow
> (subflow->mp_join || ssk != READ_ONCE(msk->first)) under the fallback
> label. If so, immediately set the appropriate reset reason
> (MPTCP_RST_EMIDDLEBOX on MAPPING_NODSS, MPTCP_RST_EMPTCP otherwise),
> increment MPTCP_MIB_DSSRESET, and jump to reset.
> 
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/544
> Signed-off-by: T S Rameshkumar <rameshkumar.t@phytecembedded.in>
> ---
>  net/mptcp/subflow.c | 24 +++++++++++++++++++++++-
>  1 file changed, 23 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index 78e886b20..5faab6ffd 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -1446,7 +1446,7 @@ static bool subflow_check_data_avail(struct sock *ssk)
>  	return false;
>  
>  fallback:
> -	if (!__mptcp_check_fallback(msk)) {
> +	if (subflow->mp_join || ssk != READ_ONCE(msk->first)) {

Here you are changing the condition "did we already fallback". Is it
because a fallback already happened but yet you have a second subflow?
That's not consistent, and the root cause is elsewhere.

Maybe it is linked to:

https://lore.kernel.org/20260814-mptcp-reset-mpj-early-v1-0-3ca3260f9474@kernel.org

I didn't have time to work on a v2.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.