Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] BPF programs can cause a kernel panic by passing `mss_now == 0` to the `bbr_tso_segs` kfunc, leading to a division by zero.
- [Medium] The `tcp_tso_autosize` function is not registered as a BPF kfunc, preventing BPF congestion control algorithms from reusing default TSO autosizing logic.
--

commit 39a9bf39a3860ba9dd1b2bed8669b97491df87c6
Author: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>

tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

This patch replaces existing min_tso_segs() with tso_segs() CC callbak
for CC algorithm to provides explicit tso segment number of each data
burst and overrides tcp_tso_autosize().

> diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
> --- a/net/ipv4/tcp_bbr.c
> +++ b/net/ipv4/tcp_bbr.c
[ ... ]
> @@ -297,11 +297,19 @@ static void bbr_set_pacing_rate(struct sock *sk, u32 bw, int gain)
>  }
>  
>  /* override sysctl_tcp_min_tso_segs */
> -__bpf_kfunc static u32 bbr_min_tso_segs(struct sock *sk)
> +static u32 bbr_min_tso_segs(struct sock *sk)
>  {
>  	return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2;
>  }
>  
> +__bpf_kfunc static u32 bbr_tso_segs(struct sock *sk, u32 mss_now)
> +{
> +	u32 min_tso;
> +
> +	min_tso = bbr_min_tso_segs(sk);
> +	return tcp_tso_autosize(sk, mss_now, min_tso);
> +}

[Severity: High]
Can a buggy BPF program trigger a divide-by-zero panic here?

Since bbr_tso_segs() is exposed as a BPF kfunc, the verifier does not
restrict the value ranges of scalar arguments like mss_now. If mss_now is 0,
it is passed directly to tcp_tso_autosize(), where it is used as a divisor:

tcp_tso_autosize()
    ...
    return max_t(u32, bytes / mss_now, min_tso_segs);

Does this need an explicit check for mss_now == 0 to prevent a local denial
of service?

> +
>  static u32 bbr_tso_segs_goal(struct sock *sk)
>  {
>  	struct tcp_sock *tp = tcp_sk(sk);
[ ... ]
> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
[ ... ]
> @@ -2269,6 +2269,7 @@ static u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
>  
>  	return max_t(u32, bytes / mss_now, min_tso_segs);
>  }
> +EXPORT_SYMBOL(tcp_tso_autosize);

[Severity: Medium]
Is there a way for out-of-tree BPF congestion controls to reuse the default
autosizing logic?

With the removal of min_tso_segs, BPF congestion control algorithms that
want a custom minimum TSO size must implement tso_segs and handle the
autosizing themselves. However, while tcp_tso_autosize() is exported to C
modules here, it does not appear to be registered as a BPF kfunc (e.g., via
BTF_KFUNCS_START).

Does this force BPF developers to either lose custom minimum TSO sizing
capabilities or duplicate the tcp_tso_autosize() logic within their BPF
programs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260614071756.239686-1-chia-yu.chang@nokia-bell-labs.com?part=1

Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

[Jakub Kicinski]

On Sun, 14 Jun 2026 09:17:56 +0200 chia-yu.chang@nokia-bell-labs.com
wrote:
> This patch replaces existing min_tso_segs() with tso_segs() CC callbak
> for CC algorithm to provides explicit tso segment number of each data
> burst and overrides tcp_tso_autosize().
> 
> No functional change.

Eric, Neal, looks good?

The min rtt thing in tcp_tso_autosize() helps a bit but if the sender
gets congested for a longer stretch min_rtts on new connections are
high and we're back to sending small TSO, keeping the sender overloaded.
Which is to say - I _hope_ this also solves some of Meta's problems :)

Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

[Jakub Kicinski]

On Mon, 15 Jun 2026 18:51:02 -0700 Jakub Kicinski wrote:
> On Sun, 14 Jun 2026 09:17:56 +0200 chia-yu.chang@nokia-bell-labs.com
> wrote:
> > This patch replaces existing min_tso_segs() with tso_segs() CC callbak
> > for CC algorithm to provides explicit tso segment number of each data
> > burst and overrides tcp_tso_autosize().
> > 
> > No functional change.  
> 
> Eric, Neal, looks good?
> 
> The min rtt thing in tcp_tso_autosize() helps a bit but if the sender
> gets congested for a longer stretch min_rtts on new connections are
> high and we're back to sending small TSO, keeping the sender overloaded.
> Which is to say - I _hope_ this also solves some of Meta's problems :)

Ugh, I didn't see the Sashiko report, it's only CCed to the author and
bpf@, not to netdev :/

The zero-check sounds legit. Let's revisit this after the merge window.

RE: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

[Chia-Yu Chang (Nokia)]

git send-email --to='jolsa@kernel.org' --to='yonghong.song@linux.dev' --to='song@kernel.org' --to='linux-kselftest@vger.kernel.org' --to='memxor@gmail.com' --to='shuah@kernel.org' --to='martin.lau@linux.dev' --to='ast@kernel.org' --to='daniel@iogearbox.net' --to='andrii@kernel.org' --to='eddyz87@gmail.com' --to='horms@kernel.org' --to='dsahern@kernel.org' --to='bpf@vger.kernel.org' --to='netdev@vger.kernel.org' --to='pabeni@redhat.com' --to='jhs@mojatatu.com' --to='kuba@kernel.org' --to='stephen@networkplumber.org' --to='davem@davemloft.net' --to='edumazet@google.com' --to='andrew+netdev@lunn.ch' --to='donald.hunter@gmail.com' --to='kuniyu@google.com' --to='ij@kernel.org' --to='ncardwell@google.com' --to='koen.de_schepper@nokia-bell-labs.com' --to='g.white@cablelabs.com' --to='ingemar.s.johansson@ericsson.com' --to='mirja.kuehlewind@ericsson.com' --to='cheshire@apple.com' --to='rs.ietf@gmx.at' --to='Jason_Livingood@comcast.com' --to='vidhi_goel@apple.com' ~/L4S_patches_20260613/linux_net_next_prague_series0/*.patch --from='chia-yu.chang@nokia-bell-labs.com' --smtp-server='mailrelay.int.nokia.com' --smtp-server-port=25


> -----Original Message-----
> From: Jakub Kicinski <kuba@kernel.org> 
> Sent: Tuesday, June 16, 2026 4:17 AM
> To: edumazet@google.com; ncardwell@google.com
> Cc: Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com>; jolsa@kernel.org; yonghong.song@linux.dev; song@kernel.org; linux-kselftest@vger.kernel.org; memxor@gmail.com; shuah@kernel.org; martin.lau@linux.dev; ast@kernel.org; daniel@iogearbox.net; andrii@kernel.org; eddyz87@gmail.com; horms@kernel.org; dsahern@kernel.org; bpf@vger.kernel.org; netdev@vger.kernel.org; pabeni@redhat.com; jhs@mojatatu.com; stephen@networkplumber.org; davem@davemloft.net; andrew+netdev@lunn.ch; donald.hunter@gmail.com; kuniyu@google.com; ij@kernel.org; Koen De Schepper (Nokia) <koen.de_schepper@nokia-bell-labs.com>; g.white@cablelabs.com; ingemar.s.johansson@ericsson.com; mirja.kuehlewind@ericsson.com; cheshire@apple.com; rs.ietf@gmx.at; Jason_Livingood@comcast.com; vidhi_goel@apple.com
> Subject: Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague
> 
> 
> CAUTION: This is an external email. Please be very careful when clicking links or opening attachments. See the URL nok.it/ext for additional information.
> 
> 
> 
> On Mon, 15 Jun 2026 18:51:02 -0700 Jakub Kicinski wrote:
> > On Sun, 14 Jun 2026 09:17:56 +0200 chia-yu.chang@nokia-bell-labs.com
> > wrote:
> > > This patch replaces existing min_tso_segs() with tso_segs() CC 
> > > callbak for CC algorithm to provides explicit tso segment number of 
> > > each data burst and overrides tcp_tso_autosize().
> > >
> > > No functional change.
> >
> > Eric, Neal, looks good?
> >
> > The min rtt thing in tcp_tso_autosize() helps a bit but if the sender 
> > gets congested for a longer stretch min_rtts on new connections are 
> > high and we're back to sending small TSO, keeping the sender overloaded.
> > Which is to say - I _hope_ this also solves some of Meta's problems :)
> 
> Ugh, I didn't see the Sashiko report, it's only CCed to the author and bpf@, not to netdev :/
> 
> The zero-check sounds legit. Let's revisit this after the merge window.

Thanks for the comment, I will take action after the merge window.

And, please correct me if I am wrong, the next eligible submission is expected from 30-June, right?
Thanks!

Chia-Yu

Re: [PATCH v2 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback for TCP Prague

[Jakub Kicinski]

On Tue, 16 Jun 2026 12:23:11 +0000 Chia-Yu Chang (Nokia) wrote:
> > On Mon, 15 Jun 2026 18:51:02 -0700 Jakub Kicinski wrote:  
> > > On Sun, 14 Jun 2026 09:17:56 +0200 chia-yu.chang@nokia-bell-labs.com
> > > Eric, Neal, looks good?
> > >
> > > The min rtt thing in tcp_tso_autosize() helps a bit but if the sender 
> > > gets congested for a longer stretch min_rtts on new connections are 
> > > high and we're back to sending small TSO, keeping the sender overloaded.
> > > Which is to say - I _hope_ this also solves some of Meta's problems :)  
> > 
> > Ugh, I didn't see the Sashiko report, it's only CCed to the author and bpf@, not to netdev :/
> > 
> > The zero-check sounds legit. Let's revisit this after the merge window.  
> 
> Thanks for the comment, I will take action after the merge window.
> 
> And, please correct me if I am wrong, the next eligible submission is expected from 30-June, right?

It usually opens Monday morning (PST) so Jun 29th