Re: [PATCH v8 mptcp-next 4/9] mptcp: allow subflow rcv wnd to shrink

[Matthieu Baerts <matttbe@kernel.org>]

Hi Paolo,

On 23/05/2026 07:43, Paolo Abeni wrote:
> In MPTCP connection, the `window` field in the TCP header refers to the
> MPTCP-level rcv_nxt and it's right edge should not move backward. Such
> constraint is enforced at DSS option generation time.
> 
> At the same time, the TCP stack ensures independently that the TCP-level
> rcv wnd right's edge does not move backward. That in turn causes artificial
> inflating of the MPTCP rcv window when the incoming data is acked at the
> TCP level and is OoO in the MPTCP sequence space (or lands in the backlog).
> 
> As a consequence, the incoming traffic can exceed the receiver rcvbuf size
> even when the sender is not misbehaving.
> 
> Prevent such scenario forcibly allowing the TCP subflow to shrink the
> TCP-level rcv wnd regardless of the current netns setting.
> 
> Fixes: f3589be0c420 ("mptcp: never shrink offered window")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
>  net/mptcp/options.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
> index 4d72f286a485..97ea4aa37b33 100644
> --- a/net/mptcp/options.c
> +++ b/net/mptcp/options.c
> @@ -566,6 +566,7 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
>  {
>  	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
>  	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
> +	struct tcp_sock *tp = tcp_sk(sk);
>  	unsigned int dss_size = 0;
>  	struct mptcp_ext *mpext;
>  	unsigned int ack_size;
> @@ -614,6 +615,12 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
>  	if (dss_size == 0)
>  		ack_size += TCPOLEN_MPTCP_DSS_BASE;
>  
> +	/* The caller is __tcp_transmit_skb(), and will compute the new rcv
> +	 * wnd soon: ensure that the window can shrink.
> +	 */
> +	if (skb)
> +		tp->rcv_wnd = tp->rcv_nxt - tp->rcv_wup;

Do you need to call tcp_update_max_rcv_wnd_seq() after having updated
rcv_wnd?

See 0e24d17bd966 ("tcp: implement RFC 7323 window retraction receiver
requirements") for more details about it.

If we do that, I guess we can declare "struct tcp_sock *tp" here in the
if-statement.

I can also update the patch when applying it. Apart from that:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.