[PATCH net-next 00/11] mptcp: misc. features for v7.3

[PATCH net-next 00/11] mptcp: misc. features for v7.3

[Matthieu Baerts (NGI0)]

This series contains a few independent new features, and small fixes for
net-next:

- Patch 1: Add WARN_ON_ONCE guards around extra_subflows to catch issues
  with this counter, similar to what is done with other PM counters.

- Patches 2-3: Follow-up patches to remove data_ack field from struct
  mptcp_ext -- now unused after recent fixes -- and makes a userspace PM
  helper static.

- Patch 4: Honour tcp_rto_{min_us,max_ms} sysctls for MPTCP-level
  retransmit timers like with DATA_FIN's and fallback timeout.

- Patches 5-6: Add per-event MIB counters for MPTCP_RST_EMPTCP resets to
  help to spot such situations in production.

- Patches 7-9: Small pcap-related improvements in the selftests.

- Patch 10: Fix compiler warning in the selftests.

- Patch 11: Avoid a buffer overflow when misusing the mptcp_diag tool
  from the selftests.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Geliang Tang (2):
      mptcp: remove unused data_ack from struct mptcp_ext
      selftests: mptcp: fix const qualifier warnings in strchr usage

Jiangshan Yi (1):
      selftests: mptcp: diag: fix stack buffer overflow in get_subflow_info()

Kalpan Jani (1):
      mptcp: honour configured min/max RTO in retransmit paths

Matthieu Baerts (NGI0) (4):
      mptcp: pm: userspace: make remove_addr_entry static
      selftests: mptcp: connect: test name in pcap file
      selftests: mptcp: simult_flow: test name in pcap file
      selftests: mptcp: pcap: drop most of the payload

Shardul Bankar (2):
      mptcp: add per-event MIB counters for MPTCP_RST_EMPTCP resets
      selftests: mptcp: check per-event MPTCP_RST_EMPTCP counters

Tao Cui (1):
      mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow

 include/net/mptcp.h                                |  4 -
 include/trace/events/mptcp.h                       |  6 +-
 net/mptcp/mib.c                                    |  7 ++
 net/mptcp/mib.h                                    |  7 ++
 net/mptcp/pm.c                                     |  3 +-
 net/mptcp/pm_userspace.c                           |  7 +-
 net/mptcp/protocol.c                               | 23 +++++-
 net/mptcp/protocol.h                               |  5 +-
 net/mptcp/subflow.c                                | 10 +++
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |  4 +-
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |  8 +-
 tools/testing/selftests/net/mptcp/mptcp_diag.c     |  3 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 95 +++++++++++++++++++++-
 tools/testing/selftests/net/mptcp/simult_flows.sh  | 11 ++-
 14 files changed, 163 insertions(+), 30 deletions(-)
---
base-commit: ac155a26750a595703e7dadff84735456d75a479
change-id: 20260810-net-next-mptcp-misc-feat-7-3-b066d1e2d57a

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext

[Matthieu Baerts (NGI0)]

From: Geliang Tang <tanggeliang@kylinos.cn>

The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
To: Steven Rostedt <rostedt@goodmis.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: linux-trace-kernel@vger.kernel.org
---
 include/net/mptcp.h          | 4 ----
 include/trace/events/mptcp.h | 6 ++----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index 71b9fc5a5796..485d55b66ea6 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -19,10 +19,6 @@ struct seq_file;
 
 /* MPTCP sk_buff extension data */
 struct mptcp_ext {
-	union {
-		u64	data_ack;
-		u32	data_ack32;
-	};
 	u64		data_seq;
 	u32		subflow_seq;
 	u16		data_len;
diff --git a/include/trace/events/mptcp.h b/include/trace/events/mptcp.h
index 04521acba483..22882bd03459 100644
--- a/include/trace/events/mptcp.h
+++ b/include/trace/events/mptcp.h
@@ -75,7 +75,6 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 	TP_ARGS(mpext),
 
 	TP_STRUCT__entry(
-		__field(u64, data_ack)
 		__field(u64, data_seq)
 		__field(u32, subflow_seq)
 		__field(u16, data_len)
@@ -94,7 +93,6 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 	),
 
 	TP_fast_assign(
-		__entry->data_ack = mpext->ack64 ? mpext->data_ack : mpext->data_ack32;
 		__entry->data_seq = mpext->data_seq;
 		__entry->subflow_seq = mpext->subflow_seq;
 		__entry->data_len = mpext->data_len;
@@ -112,8 +110,8 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 		__entry->infinite_map = mpext->infinite_map;
 	),
 
-	TP_printk("data_ack=%llu data_seq=%llu subflow_seq=%u data_len=%u csum=%x use_map=%u dsn64=%u data_fin=%u use_ack=%u ack64=%u mpc_map=%u frozen=%u reset_transient=%u reset_reason=%u csum_reqd=%u infinite_map=%u",
-		  __entry->data_ack, __entry->data_seq,
+	TP_printk("data_seq=%llu subflow_seq=%u data_len=%u csum=%x use_map=%u dsn64=%u data_fin=%u use_ack=%u ack64=%u mpc_map=%u frozen=%u reset_transient=%u reset_reason=%u csum_reqd=%u infinite_map=%u",
+		  __entry->data_seq,
 		  __entry->subflow_seq, __entry->data_len,
 		  __entry->csum, __entry->use_map,
 		  __entry->dsn64, __entry->data_fin,

-- 
2.53.0

Re: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated `opts.mptcp.ext_copy.csum` is left uninitialized. If MPTCP checksums are enabled, this uninitialized memory is written to the TCP header, leaking 2 bytes of kernel stack memory over the network.
--

--- Patch [2]: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext ---
commit 5596db7582bd748ad6320aef70bbdd448c28de36
Author: Geliang Tang <geliang@kernel.org>

mptcp: remove unused data_ack from struct mptcp_ext
    
The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().

> diff --git a/include/net/mptcp.h b/include/net/mptcp.h
> index 71b9fc5a57963..485d55b66ea67 100644
> --- a/include/net/mptcp.h
> +++ b/include/net/mptcp.h
> @@ -19,10 +19,6 @@ struct seq_file;
>  
>  /* MPTCP sk_buff extension data */
>  struct mptcp_ext {
> -	union {
> -		u64	data_ack;
> -		u32	data_ack32;
> -	};
>  	u64		data_seq;
>  	u32		subflow_seq;
>  	u16		data_len;

[Severity: Medium]
This is a pre-existing issue, but does this structure leave the csum field
uninitialized on the stack under certain conditions?

When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g.,
on a pure ACK), the stack-allocated opts structure in 
net/ipv4/tcp_output.c:__tcp_transmit_skb() is not fully zeroed:

    struct tcp_out_options opts;

If mpext is NULL, net/mptcp/options.c:mptcp_established_options_dss() only
clears the bitfield flags:

    /* Zero `use_ack` and `use_map` flags with one shot. */
    memset(&opts->ext_copy.flags, 0, sizeof(opts->ext_copy.flags));

This leaves opts->ext_copy.csum uninitialized. The code then passes this to
net/mptcp/options.c:mptcp_write_data_fin(), which populates fields like
data_fin and data_seq but fails to initialize the csum field.

Finally, in net/mptcp/options.c:mptcp_write_options(), it reads the
uninitialized csum when writing the TCP header:

    put_len_csum(mpext->data_len,
                 (mpext->data_len ? mptcp_make_csum(mpext) : 0),
                 ptr);

Could this uninitialized struct memory result in leaking 2 bytes of kernel
stack memory over the network when MPTCP checksums are enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org?part=2