* [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio
@ 2026-10-17 5:23 ` Quanye Yang
0 siblings, 0 replies; 4+ messages in thread
From: Quanye Yang via B4 Relay @ 2026-10-17 5:23 UTC (permalink / raw)
To: MPTCP Linux; +Cc: Matthieu Baerts (NGI0)
From: Quanye Yang <quanyeyang@proton.me>
mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
same byte via mptcp_win_from_space() after mptcp_release_cb() drops
that lock, so it can run concurrently with the RX path.
KCSAN reports:
BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready
write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248
read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
__mptcp_space net/mptcp/protocol.h:431 [inline]
mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
release_sock+0x100/0x150 net/core/sock.c:3866
sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496
value changed: 0xd0 -> 0xd5
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)
The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
advertised window. A slightly stale ratio is acceptable, so annotate
the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
widening the data lock. Do the same in mptcp_space_from_win(), which
reads the same field from DRS and SO_RCVLOWAT.
Fixes: d2000361e4dd ("mptcp: better mptcp-level RTT estimator")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/634
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
Changes in v2:
- add READ_ONCE in trace_mptcp_rcvbuf_grow, missed before
- Link to v1: https://patch.msgid.link/20261015-t-mptcp-scaling-ratio-kcsan-v1-1-db146f55802e@proton.me
---
include/trace/events/mptcp.h | 2 +-
net/mptcp/protocol.c | 11 ++++++++---
net/mptcp/protocol.h | 6 ++++--
3 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/include/trace/events/mptcp.h b/include/trace/events/mptcp.h
index 22882bd03459..c47fa2672b84 100644
--- a/include/trace/events/mptcp.h
+++ b/include/trace/events/mptcp.h
@@ -229,7 +229,7 @@ TRACE_EVENT(mptcp_rcvbuf_grow,
__entry->rcvbuf = sk->sk_rcvbuf;
__entry->rcv_wnd = atomic64_read(&msk->rcv_wnd_sent) -
msk->ack_seq;
- __entry->scaling_ratio = msk->scaling_ratio;
+ __entry->scaling_ratio = READ_ONCE(msk->scaling_ratio);
__entry->sport = ntohs(inet->inet_sport);
__entry->dport = ntohs(inet->inet_dport);
__entry->family = sk->sk_family;
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 05c38564e8fd..ffd22849b719 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -988,6 +988,7 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
{
const struct tcp_sock *tp = tcp_sk(subflow->tcp_sock);
u32 rtt_us = tp->rcv_rtt_est.rtt_us;
+ u8 scaling_ratio;
int id;
/* Update once per subflow per rcvwnd to avoid touching the msk
@@ -1004,9 +1005,13 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
if (++msk->rcv_rtt_est.next_sample == MPTCP_RTT_SAMPLES)
msk->rcv_rtt_est.next_sample = 0;
- /* EWMA among the incoming subflows */
- msk->scaling_ratio = ((msk->scaling_ratio << 3) - msk->scaling_ratio +
- tp->scaling_ratio) >> 3;
+ /* EWMA among the incoming subflows.
+ * Pairs with READ_ONCE() in mptcp_win_from_space().
+ */
+ scaling_ratio = READ_ONCE(msk->scaling_ratio);
+ WRITE_ONCE(msk->scaling_ratio,
+ ((scaling_ratio << 3) - scaling_ratio +
+ tp->scaling_ratio) >> 3);
}
void mptcp_data_ready(struct sock *sk, struct sock *ssk)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4ed598febbf0..11e3c6db5e53 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -417,12 +417,14 @@ static inline void msk_owned_by_me(const struct mptcp_sock *msk)
static inline int mptcp_win_from_space(const struct sock *sk, int space)
{
- return __tcp_win_from_space(mptcp_sk(sk)->scaling_ratio, space);
+ return __tcp_win_from_space(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+ space);
}
static inline int mptcp_space_from_win(const struct sock *sk, int win)
{
- return __tcp_space_from_win(mptcp_sk(sk)->scaling_ratio, win);
+ return __tcp_space_from_win(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+ win);
}
static inline int __mptcp_space(const struct sock *sk)
---
base-commit: a22035be824449c4921ec406f6383089016a628c
change-id: 20261015-t-mptcp-scaling-ratio-kcsan-91fb2f56026d
Best regards,
--
Quanye Yang <quanyeyang@proton.me>
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio
@ 2026-10-17 5:23 ` Quanye Yang
0 siblings, 0 replies; 4+ messages in thread
From: Quanye Yang @ 2026-10-17 5:23 UTC (permalink / raw)
To: MPTCP Linux; +Cc: Matthieu Baerts (NGI0)
mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
same byte via mptcp_win_from_space() after mptcp_release_cb() drops
that lock, so it can run concurrently with the RX path.
KCSAN reports:
BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready
write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248
read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
__mptcp_space net/mptcp/protocol.h:431 [inline]
mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
release_sock+0x100/0x150 net/core/sock.c:3866
sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496
value changed: 0xd0 -> 0xd5
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)
The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
advertised window. A slightly stale ratio is acceptable, so annotate
the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
widening the data lock. Do the same in mptcp_space_from_win(), which
reads the same field from DRS and SO_RCVLOWAT.
Fixes: d2000361e4dd ("mptcp: better mptcp-level RTT estimator")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/634
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
Changes in v2:
- add READ_ONCE in trace_mptcp_rcvbuf_grow, missed before
- Link to v1: https://patch.msgid.link/20261015-t-mptcp-scaling-ratio-kcsan-v1-1-db146f55802e@proton.me
---
include/trace/events/mptcp.h | 2 +-
net/mptcp/protocol.c | 11 ++++++++---
net/mptcp/protocol.h | 6 ++++--
3 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/include/trace/events/mptcp.h b/include/trace/events/mptcp.h
index 22882bd03459..c47fa2672b84 100644
--- a/include/trace/events/mptcp.h
+++ b/include/trace/events/mptcp.h
@@ -229,7 +229,7 @@ TRACE_EVENT(mptcp_rcvbuf_grow,
__entry->rcvbuf = sk->sk_rcvbuf;
__entry->rcv_wnd = atomic64_read(&msk->rcv_wnd_sent) -
msk->ack_seq;
- __entry->scaling_ratio = msk->scaling_ratio;
+ __entry->scaling_ratio = READ_ONCE(msk->scaling_ratio);
__entry->sport = ntohs(inet->inet_sport);
__entry->dport = ntohs(inet->inet_dport);
__entry->family = sk->sk_family;
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 05c38564e8fd..ffd22849b719 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -988,6 +988,7 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
{
const struct tcp_sock *tp = tcp_sk(subflow->tcp_sock);
u32 rtt_us = tp->rcv_rtt_est.rtt_us;
+ u8 scaling_ratio;
int id;
/* Update once per subflow per rcvwnd to avoid touching the msk
@@ -1004,9 +1005,13 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
if (++msk->rcv_rtt_est.next_sample == MPTCP_RTT_SAMPLES)
msk->rcv_rtt_est.next_sample = 0;
- /* EWMA among the incoming subflows */
- msk->scaling_ratio = ((msk->scaling_ratio << 3) - msk->scaling_ratio +
- tp->scaling_ratio) >> 3;
+ /* EWMA among the incoming subflows.
+ * Pairs with READ_ONCE() in mptcp_win_from_space().
+ */
+ scaling_ratio = READ_ONCE(msk->scaling_ratio);
+ WRITE_ONCE(msk->scaling_ratio,
+ ((scaling_ratio << 3) - scaling_ratio +
+ tp->scaling_ratio) >> 3);
}
void mptcp_data_ready(struct sock *sk, struct sock *ssk)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4ed598febbf0..11e3c6db5e53 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -417,12 +417,14 @@ static inline void msk_owned_by_me(const struct mptcp_sock *msk)
static inline int mptcp_win_from_space(const struct sock *sk, int space)
{
- return __tcp_win_from_space(mptcp_sk(sk)->scaling_ratio, space);
+ return __tcp_win_from_space(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+ space);
}
static inline int mptcp_space_from_win(const struct sock *sk, int win)
{
- return __tcp_space_from_win(mptcp_sk(sk)->scaling_ratio, win);
+ return __tcp_space_from_win(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+ win);
}
static inline int __mptcp_space(const struct sock *sk)
---
base-commit: a22035be824449c4921ec406f6383089016a628c
change-id: 20261015-t-mptcp-scaling-ratio-kcsan-91fb2f56026d
Best regards,
--
Quanye Yang <quanyeyang@proton.me>
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio
2026-10-17 5:23 ` Quanye Yang
(?)
@ 2026-10-21 12:09 ` MPTCP CI
-1 siblings, 0 replies; 4+ messages in thread
From: MPTCP CI @ 2026-10-21 12:09 UTC (permalink / raw)
To: Quanye Yang; +Cc: mptcp
Hi Quanye,
Thank you for your modifications, that's great!
Our CI did some validations and here is its report:
- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Critical: No conclusion ❓
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/39578547666
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/119c5a744b91
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1187813
If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:
$ cd [kernel source code]
$ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
--pull always mptcp/mptcp-upstream-virtme-docker:latest \
auto-normal
For more details:
https://github.com/multipath-tcp/mptcp-upstream-virtme-docker
Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)
Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio
2026-10-17 5:23 ` Quanye Yang
(?)
(?)
@ 2026-10-22 11:17 ` Matthieu Baerts
-1 siblings, 0 replies; 4+ messages in thread
From: Matthieu Baerts @ 2026-10-22 11:17 UTC (permalink / raw)
To: quanyeyang, MPTCP Linux
Hi Quanye,
On 17/10/2026 07:23, Quanye Yang via B4 Relay wrote:
> From: Quanye Yang <quanyeyang@proton.me>
>
> mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
> the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
> same byte via mptcp_win_from_space() after mptcp_release_cb() drops
> that lock, so it can run concurrently with the RX path.
>
> KCSAN reports:
>
> BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready
>
> write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
> mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
> mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
> subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
> tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
> tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
> tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
> tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
> tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248
>
> read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
> mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
> __mptcp_space net/mptcp/protocol.h:431 [inline]
> mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
> mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
> release_sock+0x100/0x150 net/core/sock.c:3866
> sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
> mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496
>
> value changed: 0xd0 -> 0xd5
>
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)
>
> The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
> advertised window. A slightly stale ratio is acceptable, so annotate
> the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
> widening the data lock. Do the same in mptcp_space_from_win(), which
> reads the same field from DRS and SO_RCVLOWAT.
Thank you, it looks good to me:
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
I just applied it in our tree, but for net-next because from what I
understood, KCSAN issues are not considered as "urgent", so it should go
to -next first.
New patches for t/upstream:
- ab82be554559: mptcp: annotate lockless access to msk->scaling_ratio
- Results: 54143bb812b1..15904a7a5590 (export)
Tests are now in progress:
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/10148edc4b64c7799f9109d3ece843362819f108/checks
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-22 11:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-17 5:23 [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio Quanye Yang via B4 Relay
2026-10-17 5:23 ` Quanye Yang
2026-10-21 12:09 ` MPTCP CI
2026-10-22 11:17 ` Matthieu Baerts
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.