All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH mptcp-net] mptcp: annotate lockless access to msk->scaling_ratio
@ 2026-10-15 10:55 ` Quanye Yang
  0 siblings, 0 replies; 3+ messages in thread
From: Quanye Yang via B4 Relay @ 2026-10-15 10:55 UTC (permalink / raw)
  To: MPTCP Linux; +Cc: Matthieu Baerts (NGI0)

From: Quanye Yang <quanyeyang@proton.me>

mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
same byte via mptcp_win_from_space() after mptcp_release_cb() drops
that lock, so it can run concurrently with the RX path.

KCSAN reports:

  BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready

  write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
   mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
   mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
   subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
   tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
   tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
   tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
   tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
   tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248

  read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
   mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
   __mptcp_space net/mptcp/protocol.h:431 [inline]
   mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
   mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
   release_sock+0x100/0x150 net/core/sock.c:3866
   sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
   mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496

  value changed: 0xd0 -> 0xd5

  Reported by Kernel Concurrency Sanitizer on:
  CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)

The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
advertised window. A slightly stale ratio is acceptable, so annotate
the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
widening the data lock. Do the same in mptcp_space_from_win(), which
reads the same field from DRS and SO_RCVLOWAT.

Fixes: d2000361e4dd ("mptcp: better mptcp-level RTT estimator")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/634
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
 net/mptcp/protocol.c | 11 ++++++++---
 net/mptcp/protocol.h |  6 ++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 05c38564e8fd..ffd22849b719 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -988,6 +988,7 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 {
 	const struct tcp_sock *tp = tcp_sk(subflow->tcp_sock);
 	u32 rtt_us = tp->rcv_rtt_est.rtt_us;
+	u8 scaling_ratio;
 	int id;
 
 	/* Update once per subflow per rcvwnd to avoid touching the msk
@@ -1004,9 +1005,13 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 	if (++msk->rcv_rtt_est.next_sample == MPTCP_RTT_SAMPLES)
 		msk->rcv_rtt_est.next_sample = 0;
 
-	/* EWMA among the incoming subflows */
-	msk->scaling_ratio = ((msk->scaling_ratio << 3) - msk->scaling_ratio +
-			     tp->scaling_ratio) >> 3;
+	/* EWMA among the incoming subflows.
+	 * Pairs with READ_ONCE() in mptcp_win_from_space().
+	 */
+	scaling_ratio = READ_ONCE(msk->scaling_ratio);
+	WRITE_ONCE(msk->scaling_ratio,
+		   ((scaling_ratio << 3) - scaling_ratio +
+		    tp->scaling_ratio) >> 3);
 }
 
 void mptcp_data_ready(struct sock *sk, struct sock *ssk)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4ed598febbf0..11e3c6db5e53 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -417,12 +417,14 @@ static inline void msk_owned_by_me(const struct mptcp_sock *msk)
 
 static inline int mptcp_win_from_space(const struct sock *sk, int space)
 {
-	return __tcp_win_from_space(mptcp_sk(sk)->scaling_ratio, space);
+	return __tcp_win_from_space(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    space);
 }
 
 static inline int mptcp_space_from_win(const struct sock *sk, int win)
 {
-	return __tcp_space_from_win(mptcp_sk(sk)->scaling_ratio, win);
+	return __tcp_space_from_win(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    win);
 }
 
 static inline int __mptcp_space(const struct sock *sk)

---
base-commit: a22035be824449c4921ec406f6383089016a628c
change-id: 20261015-t-mptcp-scaling-ratio-kcsan-91fb2f56026d

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>



^ permalink raw reply related	[flat|nested] 3+ messages in thread
* [PATCH mptcp-net] mptcp: annotate lockless access to msk->scaling_ratio
@ 2026-10-15 10:55 ` Quanye Yang
  0 siblings, 0 replies; 3+ messages in thread
From: Quanye Yang @ 2026-10-15 10:55 UTC (permalink / raw)
  To: MPTCP Linux; +Cc: Matthieu Baerts (NGI0)

mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
same byte via mptcp_win_from_space() after mptcp_release_cb() drops
that lock, so it can run concurrently with the RX path.

KCSAN reports:

  BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready

  write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
   mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
   mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
   subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
   tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
   tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
   tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
   tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
   tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248

  read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
   mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
   __mptcp_space net/mptcp/protocol.h:431 [inline]
   mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
   mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
   release_sock+0x100/0x150 net/core/sock.c:3866
   sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
   mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496

  value changed: 0xd0 -> 0xd5

  Reported by Kernel Concurrency Sanitizer on:
  CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)

The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
advertised window. A slightly stale ratio is acceptable, so annotate
the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
widening the data lock. Do the same in mptcp_space_from_win(), which
reads the same field from DRS and SO_RCVLOWAT.

Fixes: d2000361e4dd ("mptcp: better mptcp-level RTT estimator")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/634
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
 net/mptcp/protocol.c | 11 ++++++++---
 net/mptcp/protocol.h |  6 ++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 05c38564e8fd..ffd22849b719 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -988,6 +988,7 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 {
 	const struct tcp_sock *tp = tcp_sk(subflow->tcp_sock);
 	u32 rtt_us = tp->rcv_rtt_est.rtt_us;
+	u8 scaling_ratio;
 	int id;
 
 	/* Update once per subflow per rcvwnd to avoid touching the msk
@@ -1004,9 +1005,13 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 	if (++msk->rcv_rtt_est.next_sample == MPTCP_RTT_SAMPLES)
 		msk->rcv_rtt_est.next_sample = 0;
 
-	/* EWMA among the incoming subflows */
-	msk->scaling_ratio = ((msk->scaling_ratio << 3) - msk->scaling_ratio +
-			     tp->scaling_ratio) >> 3;
+	/* EWMA among the incoming subflows.
+	 * Pairs with READ_ONCE() in mptcp_win_from_space().
+	 */
+	scaling_ratio = READ_ONCE(msk->scaling_ratio);
+	WRITE_ONCE(msk->scaling_ratio,
+		   ((scaling_ratio << 3) - scaling_ratio +
+		    tp->scaling_ratio) >> 3);
 }
 
 void mptcp_data_ready(struct sock *sk, struct sock *ssk)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4ed598febbf0..11e3c6db5e53 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -417,12 +417,14 @@ static inline void msk_owned_by_me(const struct mptcp_sock *msk)
 
 static inline int mptcp_win_from_space(const struct sock *sk, int space)
 {
-	return __tcp_win_from_space(mptcp_sk(sk)->scaling_ratio, space);
+	return __tcp_win_from_space(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    space);
 }
 
 static inline int mptcp_space_from_win(const struct sock *sk, int win)
 {
-	return __tcp_space_from_win(mptcp_sk(sk)->scaling_ratio, win);
+	return __tcp_space_from_win(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    win);
 }
 
 static inline int __mptcp_space(const struct sock *sk)

---
base-commit: a22035be824449c4921ec406f6383089016a628c
change-id: 20261015-t-mptcp-scaling-ratio-kcsan-91fb2f56026d

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH mptcp-net] mptcp: annotate lockless access to msk->scaling_ratio
  2026-10-15 10:55 ` Quanye Yang
  (?)
@ 2026-10-15 11:58 ` MPTCP CI
  -1 siblings, 0 replies; 3+ messages in thread
From: MPTCP CI @ 2026-10-15 11:58 UTC (permalink / raw)
  To: Quanye Yang; +Cc: mptcp

Hi Quanye,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): selftest_simult_flows ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/38724491426

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/75a65162c4c0
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1186377


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-15 11:58 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-15 10:55 [PATCH mptcp-net] mptcp: annotate lockless access to msk->scaling_ratio Quanye Yang via B4 Relay
2026-10-15 10:55 ` Quanye Yang
2026-10-15 11:58 ` MPTCP CI

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.