All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio
@ 2026-10-17  5:23 ` Quanye Yang
  0 siblings, 0 replies; 4+ messages in thread
From: Quanye Yang via B4 Relay @ 2026-10-17  5:23 UTC (permalink / raw)
  To: MPTCP Linux; +Cc: Matthieu Baerts (NGI0)

From: Quanye Yang <quanyeyang@proton.me>

mptcp_rcv_rtt_update() writes msk->scaling_ratio from BH while holding
the msk data lock (sk->sk_lock.slock). mptcp_cleanup_rbuf() reads the
same byte via mptcp_win_from_space() after mptcp_release_cb() drops
that lock, so it can run concurrently with the RX path.

KCSAN reports:

  BUG: KCSAN: data-race in mptcp_cleanup_rbuf / mptcp_data_ready

  write to 0xffff888014978790 of 1 bytes by interrupt on cpu 1:
   mptcp_rcv_rtt_update net/mptcp/protocol.c:1045 [inline]
   mptcp_data_ready+0x1c1/0x4d0 net/mptcp/protocol.c:1062
   subflow_data_ready+0x271/0x350 net/mptcp/subflow.c:1536
   tcp_data_ready+0x92/0x2c0 net/ipv4/tcp_input.c:5604
   tcp_data_queue+0x1236/0x26c0 net/ipv4/tcp_input.c:5694
   tcp_rcv_established+0x695/0x1fb0 net/ipv4/tcp_input.c:6689
   tcp_v4_do_rcv+0x356/0x6e0 net/ipv4/tcp_ipv4.c:1854
   tcp_v4_rcv+0x1b04/0x26b0 net/ipv4/tcp_ipv4.c:2248

  read to 0xffff888014978790 of 1 bytes by task 2624 on cpu 0:
   mptcp_win_from_space net/mptcp/protocol.h:421 [inline]
   __mptcp_space net/mptcp/protocol.h:431 [inline]
   mptcp_cleanup_rbuf+0x8a/0x380 net/mptcp/protocol.c:680
   mptcp_release_cb+0x375/0x900 net/mptcp/protocol.c:3889
   release_sock+0x100/0x150 net/core/sock.c:3866
   sk_wait_data+0x141/0x2f0 net/core/sock.c:3314
   mptcp_recvmsg+0x6cd/0xd50 net/mptcp/protocol.c:2496

  value changed: 0xd0 -> 0xd5

  Reported by Kernel Concurrency Sanitizer on:
  CPU: 0 UID: 0 PID: 2624 Comm: syz.7.22 Not tainted 7.3.0-rc1-gbaff4b3d06ef #77 PREEMPT(full)

The u8 EWMA is used only to convert sk_rcvbuf occupancy into an
advertised window. A slightly stale ratio is acceptable, so annotate
the lockless accesses with READ_ONCE()/WRITE_ONCE() instead of
widening the data lock. Do the same in mptcp_space_from_win(), which
reads the same field from DRS and SO_RCVLOWAT.

Fixes: d2000361e4dd ("mptcp: better mptcp-level RTT estimator")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/634
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
Changes in v2:
- add READ_ONCE in trace_mptcp_rcvbuf_grow, missed before
- Link to v1: https://patch.msgid.link/20261015-t-mptcp-scaling-ratio-kcsan-v1-1-db146f55802e@proton.me
---
 include/trace/events/mptcp.h |  2 +-
 net/mptcp/protocol.c         | 11 ++++++++---
 net/mptcp/protocol.h         |  6 ++++--
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/include/trace/events/mptcp.h b/include/trace/events/mptcp.h
index 22882bd03459..c47fa2672b84 100644
--- a/include/trace/events/mptcp.h
+++ b/include/trace/events/mptcp.h
@@ -229,7 +229,7 @@ TRACE_EVENT(mptcp_rcvbuf_grow,
 		__entry->rcvbuf = sk->sk_rcvbuf;
 		__entry->rcv_wnd = atomic64_read(&msk->rcv_wnd_sent) -
 				   msk->ack_seq;
-		__entry->scaling_ratio = msk->scaling_ratio;
+		__entry->scaling_ratio = READ_ONCE(msk->scaling_ratio);
 		__entry->sport = ntohs(inet->inet_sport);
 		__entry->dport = ntohs(inet->inet_dport);
 		__entry->family = sk->sk_family;
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 05c38564e8fd..ffd22849b719 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -988,6 +988,7 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 {
 	const struct tcp_sock *tp = tcp_sk(subflow->tcp_sock);
 	u32 rtt_us = tp->rcv_rtt_est.rtt_us;
+	u8 scaling_ratio;
 	int id;
 
 	/* Update once per subflow per rcvwnd to avoid touching the msk
@@ -1004,9 +1005,13 @@ static void mptcp_rcv_rtt_update(struct mptcp_sock *msk,
 	if (++msk->rcv_rtt_est.next_sample == MPTCP_RTT_SAMPLES)
 		msk->rcv_rtt_est.next_sample = 0;
 
-	/* EWMA among the incoming subflows */
-	msk->scaling_ratio = ((msk->scaling_ratio << 3) - msk->scaling_ratio +
-			     tp->scaling_ratio) >> 3;
+	/* EWMA among the incoming subflows.
+	 * Pairs with READ_ONCE() in mptcp_win_from_space().
+	 */
+	scaling_ratio = READ_ONCE(msk->scaling_ratio);
+	WRITE_ONCE(msk->scaling_ratio,
+		   ((scaling_ratio << 3) - scaling_ratio +
+		    tp->scaling_ratio) >> 3);
 }
 
 void mptcp_data_ready(struct sock *sk, struct sock *ssk)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4ed598febbf0..11e3c6db5e53 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -417,12 +417,14 @@ static inline void msk_owned_by_me(const struct mptcp_sock *msk)
 
 static inline int mptcp_win_from_space(const struct sock *sk, int space)
 {
-	return __tcp_win_from_space(mptcp_sk(sk)->scaling_ratio, space);
+	return __tcp_win_from_space(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    space);
 }
 
 static inline int mptcp_space_from_win(const struct sock *sk, int win)
 {
-	return __tcp_space_from_win(mptcp_sk(sk)->scaling_ratio, win);
+	return __tcp_space_from_win(READ_ONCE(mptcp_sk(sk)->scaling_ratio),
+				    win);
 }
 
 static inline int __mptcp_space(const struct sock *sk)

---
base-commit: a22035be824449c4921ec406f6383089016a628c
change-id: 20261015-t-mptcp-scaling-ratio-kcsan-91fb2f56026d

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>



^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-22 11:17 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-17  5:23 [PATCH mptcp-net v2] mptcp: annotate lockless access to msk->scaling_ratio Quanye Yang via B4 Relay
2026-10-17  5:23 ` Quanye Yang
2026-10-21 12:09 ` MPTCP CI
2026-10-22 11:17 ` Matthieu Baerts

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.