[PATCH mptcp-net 0/4] Squash to "mptcp: misc fixes for v7.2-rc6"

[PATCH mptcp-net 0/4] Squash to "mptcp: misc fixes for v7.2-rc6"

[Matthieu Baerts (NGI0)]

Addressing comments from Clashiko.

Note that patches 2 and 4/5 of this series will get a few more
precisions in the commit message to ignore more silly comments from
Clashiko.

Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260728-net-mptcp-misc-fixes-7-2-rc6-v1-0-f7e2d229159d%40kernel.org
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Matthieu Baerts (NGI0) (4):
      Squash to "mptcp: avoid combining some incoming suboptions"
      Squash to "mptcp: reclaim forward-allocated memory on RX path errors"
      mptcp: options: reset DSS fields in case of unexpected size
      [mptcp-next] mptcp: remove MPC && MPJ check

 net/mptcp/options.c  | 16 ++++++++++++----
 net/mptcp/protocol.c |  3 +--
 net/mptcp/subflow.c  |  5 -----
 3 files changed, 13 insertions(+), 11 deletions(-)
---
base-commit: 23c7cb4262d954b810468b0e661d48af82b418d5
change-id: 20260731-mptcp-squash-fix-7-2rc6-edc6ba026efc

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH mptcp-net 1/4] Squash to "mptcp: avoid combining some incoming suboptions"

[Matthieu Baerts (NGI0)]

Another stack could send a FASTCLOSE on a plain ACK, with a DSS. That's
when they follow the "Option A" [1], while here, the "Option B" is
implemented on the sent side.

So we need to allow that, and this seems to be handled by the stack in
mptcp_incoming_options().

Note: this note should be added in the commit message:

  Note that now, combining both an MP_CAPABLE and an MP_JOIN will no
  longer result to a reject of the two options, but only the second one.
  That seems OK to do that for this unexpected error. At least now all
  inconsistent combinations are handled the same way. This could change
  later.

Link: https://www.rfc-editor.org/rfc/rfc8684.html#section-3.5-5.1
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/options.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index d6b009319839..5611de38f4d9 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -170,6 +170,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 		if ((mp_opt->suboptions & ~(OPTION_MPTCP_ADD_ADDR |
 					    OPTION_MPTCP_RM_ADDR |
 					    OPTION_MPTCP_PRIO |
+					    OPTION_MPTCP_FASTCLOSE |
 					    OPTION_MPTCP_FAIL)) != 0)
 			break;
 
@@ -357,8 +358,9 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 		break;
 
 	case MPTCPOPT_MP_FASTCLOSE:
-		/* Can be used only with RST */
-		if ((mp_opt->suboptions & ~OPTION_MPTCP_RST) != 0)
+		/* Can be used with a restricted number of other options */
+		if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS |
+					    OPTION_MPTCP_RST)) != 0)
 			break;
 
 		if (opsize != TCPOLEN_MPTCP_FASTCLOSE)
@@ -1478,7 +1480,7 @@ void mptcp_write_options(struct tcphdr *th, __be32 *ptr, struct tcp_sock *tp,
 	 *  RM   |  C   |  C   |  C   |  P   |------|------|------|------|
 	 *  PRIO |  X   |  C   |  C   |  C   |  C   |------|------|------|
 	 *  FAIL |  X   |  X   |  C   |  X   |  X   |  X   |------|------|
-	 *  FC   |  X   |  X   |  X   |  X   |  X   |  X   |  X   |------|
+	 *  FC   |  X   |  X   |  P   |  X   |  X   |  X   |  X   |------|
 	 *  RST  |  X   |  X   |  X   |  X   |  X   |  X   |  O   |  O   |
 	 * ------|------|------|------|------|------|------|------|------|
 	 *

-- 
2.53.0

[PATCH mptcp-net 2/4] Squash to "mptcp: reclaim forward-allocated memory on RX path errors"

[Matthieu Baerts (NGI0)]

Follow the same style as in most places in MPTCP. This was the
previously enforced style for netdev.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/protocol.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 90dc894cb976..3dee08862027 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -149,8 +149,7 @@ struct sock *__mptcp_nmpc_sk(struct mptcp_sock *msk)
 
 static void mptcp_drop(struct sock *sk, struct sk_buff *skb)
 {
-	/*
-	 * The skb forward memory was already transferred to sk by
+	/* The skb forward memory was already transferred to sk by
 	 * mptcp_borrow_fwdmem(), even before setting the destructor.
 	 */
 	if (!skb->destructor)

-- 
2.53.0

[PATCH mptcp-net 3/4] mptcp: options: reset DSS fields in case of unexpected size

[Matthieu Baerts (NGI0)]

A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.

Explicitly reset the fields that could have been modified in case of
unexpected size.

Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260728-net-mptcp-misc-fixes-7-2-rc6-v1-0-f7e2d229159d%40kernel.org?part=1
Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/options.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 5611de38f4d9..dd75fef7f046 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -209,8 +209,14 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 		 * RFC 8684 Section 3.3.0 checks later in subflow_data_ready
 		 */
 		if (opsize != expected_opsize &&
-		    opsize != expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM)
+		    opsize != expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM) {
+			mp_opt->dsn64 = 0;
+			mp_opt->use_map = 0;
+			mp_opt->ack64 = 0;
+			mp_opt->use_ack = 0;
+			mp_opt->data_fin = 0;
 			break;
+		}
 
 		mp_opt->suboptions |= OPTION_MPTCP_DSS;
 		if (mp_opt->use_ack) {

-- 
2.53.0

[PATCH mptcp-next mptcp-net 4/4] mptcp: remove MPC && MPJ check

[Matthieu Baerts (NGI0)]

After commit <   TODO   > ("mptcp: avoid combining some incoming
suboptions"), the parsing step no longer allow to have both the
MP_CAPABLE and MP_JOIN suboptions set together.

These checks can then be removed.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Note: the commit "mptcp: avoid combining some incoming suboptions" is
not upstream yet, hence the TODO for the SHA
---
 net/mptcp/subflow.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 8e386899ceb9..e1f20ff8fdb4 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -174,8 +174,6 @@ static int subflow_check_req(struct request_sock *req,
 
 		if (unlikely(listener->pm_listener))
 			return subflow_reset_req_endp(req, skb);
-		if (opt_mp_join)
-			return 0;
 	} else if (opt_mp_join) {
 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINSYNRX);
 
@@ -277,9 +275,6 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
 
 	opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK);
 	opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK);
-	if (opt_mp_capable && opt_mp_join)
-		return -EINVAL;
-
 	if (opt_mp_capable && listener->request_mptcp) {
 		if (mp_opt.sndr_key == 0)
 			return -EINVAL;

-- 
2.53.0

Re: [PATCH mptcp-net 0/4] Squash to "mptcp: misc fixes for v7.2-rc6"

[MPTCP CI]

Hi Matthieu,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/30636651226

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/0090c801f5d3
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1138152


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)