[PATCH net-next 00/11] mptcp: misc. features for v7.3

[PATCH net-next 00/11] mptcp: misc. features for v7.3

[Matthieu Baerts (NGI0)]

This series contains a few independent new features, and small fixes for
net-next:

- Patch 1: Add WARN_ON_ONCE guards around extra_subflows to catch issues
  with this counter, similar to what is done with other PM counters.

- Patches 2-3: Follow-up patches to remove data_ack field from struct
  mptcp_ext -- now unused after recent fixes -- and makes a userspace PM
  helper static.

- Patch 4: Honour tcp_rto_{min_us,max_ms} sysctls for MPTCP-level
  retransmit timers like with DATA_FIN's and fallback timeout.

- Patches 5-6: Add per-event MIB counters for MPTCP_RST_EMPTCP resets to
  help to spot such situations in production.

- Patches 7-9: Small pcap-related improvements in the selftests.

- Patch 10: Fix compiler warning in the selftests.

- Patch 11: Avoid a buffer overflow when misusing the mptcp_diag tool
  from the selftests.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Geliang Tang (2):
      mptcp: remove unused data_ack from struct mptcp_ext
      selftests: mptcp: fix const qualifier warnings in strchr usage

Jiangshan Yi (1):
      selftests: mptcp: diag: fix stack buffer overflow in get_subflow_info()

Kalpan Jani (1):
      mptcp: honour configured min/max RTO in retransmit paths

Matthieu Baerts (NGI0) (4):
      mptcp: pm: userspace: make remove_addr_entry static
      selftests: mptcp: connect: test name in pcap file
      selftests: mptcp: simult_flow: test name in pcap file
      selftests: mptcp: pcap: drop most of the payload

Shardul Bankar (2):
      mptcp: add per-event MIB counters for MPTCP_RST_EMPTCP resets
      selftests: mptcp: check per-event MPTCP_RST_EMPTCP counters

Tao Cui (1):
      mptcp: pm: add WARN_ON_ONCE guards on extra_subflows underflow

 include/net/mptcp.h                                |  4 -
 include/trace/events/mptcp.h                       |  6 +-
 net/mptcp/mib.c                                    |  7 ++
 net/mptcp/mib.h                                    |  7 ++
 net/mptcp/pm.c                                     |  3 +-
 net/mptcp/pm_userspace.c                           |  7 +-
 net/mptcp/protocol.c                               | 23 +++++-
 net/mptcp/protocol.h                               |  5 +-
 net/mptcp/subflow.c                                | 10 +++
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |  4 +-
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |  8 +-
 tools/testing/selftests/net/mptcp/mptcp_diag.c     |  3 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 95 +++++++++++++++++++++-
 tools/testing/selftests/net/mptcp/simult_flows.sh  | 11 ++-
 14 files changed, 163 insertions(+), 30 deletions(-)
---
base-commit: ac155a26750a595703e7dadff84735456d75a479
change-id: 20260810-net-next-mptcp-misc-feat-7-3-b066d1e2d57a

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext

[Matthieu Baerts (NGI0)]

From: Geliang Tang <tanggeliang@kylinos.cn>

The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
To: Steven Rostedt <rostedt@goodmis.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: linux-trace-kernel@vger.kernel.org
---
 include/net/mptcp.h          | 4 ----
 include/trace/events/mptcp.h | 6 ++----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index 71b9fc5a5796..485d55b66ea6 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -19,10 +19,6 @@ struct seq_file;
 
 /* MPTCP sk_buff extension data */
 struct mptcp_ext {
-	union {
-		u64	data_ack;
-		u32	data_ack32;
-	};
 	u64		data_seq;
 	u32		subflow_seq;
 	u16		data_len;
diff --git a/include/trace/events/mptcp.h b/include/trace/events/mptcp.h
index 04521acba483..22882bd03459 100644
--- a/include/trace/events/mptcp.h
+++ b/include/trace/events/mptcp.h
@@ -75,7 +75,6 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 	TP_ARGS(mpext),
 
 	TP_STRUCT__entry(
-		__field(u64, data_ack)
 		__field(u64, data_seq)
 		__field(u32, subflow_seq)
 		__field(u16, data_len)
@@ -94,7 +93,6 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 	),
 
 	TP_fast_assign(
-		__entry->data_ack = mpext->ack64 ? mpext->data_ack : mpext->data_ack32;
 		__entry->data_seq = mpext->data_seq;
 		__entry->subflow_seq = mpext->subflow_seq;
 		__entry->data_len = mpext->data_len;
@@ -112,8 +110,8 @@ DECLARE_EVENT_CLASS(mptcp_dump_mpext,
 		__entry->infinite_map = mpext->infinite_map;
 	),
 
-	TP_printk("data_ack=%llu data_seq=%llu subflow_seq=%u data_len=%u csum=%x use_map=%u dsn64=%u data_fin=%u use_ack=%u ack64=%u mpc_map=%u frozen=%u reset_transient=%u reset_reason=%u csum_reqd=%u infinite_map=%u",
-		  __entry->data_ack, __entry->data_seq,
+	TP_printk("data_seq=%llu subflow_seq=%u data_len=%u csum=%x use_map=%u dsn64=%u data_fin=%u use_ack=%u ack64=%u mpc_map=%u frozen=%u reset_transient=%u reset_reason=%u csum_reqd=%u infinite_map=%u",
+		  __entry->data_seq,
 		  __entry->subflow_seq, __entry->data_len,
 		  __entry->csum, __entry->use_map,
 		  __entry->dsn64, __entry->data_fin,

-- 
2.53.0

Re: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated `opts.mptcp.ext_copy.csum` is left uninitialized. If MPTCP checksums are enabled, this uninitialized memory is written to the TCP header, leaking 2 bytes of kernel stack memory over the network.
--

--- Patch [2]: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext ---
commit 5596db7582bd748ad6320aef70bbdd448c28de36
Author: Geliang Tang <geliang@kernel.org>

mptcp: remove unused data_ack from struct mptcp_ext
    
The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().

> diff --git a/include/net/mptcp.h b/include/net/mptcp.h
> index 71b9fc5a57963..485d55b66ea67 100644
> --- a/include/net/mptcp.h
> +++ b/include/net/mptcp.h
> @@ -19,10 +19,6 @@ struct seq_file;
>  
>  /* MPTCP sk_buff extension data */
>  struct mptcp_ext {
> -	union {
> -		u64	data_ack;
> -		u32	data_ack32;
> -	};
>  	u64		data_seq;
>  	u32		subflow_seq;
>  	u16		data_len;

[Severity: Medium]
This is a pre-existing issue, but does this structure leave the csum field
uninitialized on the stack under certain conditions?

When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g.,
on a pure ACK), the stack-allocated opts structure in 
net/ipv4/tcp_output.c:__tcp_transmit_skb() is not fully zeroed:

    struct tcp_out_options opts;

If mpext is NULL, net/mptcp/options.c:mptcp_established_options_dss() only
clears the bitfield flags:

    /* Zero `use_ack` and `use_map` flags with one shot. */
    memset(&opts->ext_copy.flags, 0, sizeof(opts->ext_copy.flags));

This leaves opts->ext_copy.csum uninitialized. The code then passes this to
net/mptcp/options.c:mptcp_write_data_fin(), which populates fields like
data_fin and data_seq but fails to initialize the csum field.

Finally, in net/mptcp/options.c:mptcp_write_options(), it reads the
uninitialized csum when writing the TCP header:

    put_len_csum(mpext->data_len,
                 (mpext->data_len ? mptcp_make_csum(mpext) : 0),
                 ptr);

Could this uninitialized struct memory result in leaking 2 bytes of kernel
stack memory over the network when MPTCP checksums are enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org?part=2

Re: [PATCH net-next 00/11] mptcp: misc. features for v7.3

[Matthieu Baerts]

Hello,

On 12/08/2026 16:55, Matthieu Baerts (NGI0) wrote:
> This series contains a few independent new features, and small fixes for
> net-next:

I checked Sashiko [1] and Clashiko [2] reviews, and here below is a
brief summary. TL;DR: I don't think a v2 is needed, and follow-up
patches fixing pre-existing issues will be sent separately.

[1]
https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org
[2]
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org
> - Patch 1: Add WARN_ON_ONCE guards around extra_subflows to catch issues
>   with this counter, similar to what is done with other PM counters.

Pre-existing issues: fixes will be sent to net.

> - Patches 2-3: Follow-up patches to remove data_ack field from struct
>   mptcp_ext -- now unused after recent fixes -- and makes a userspace PM
>   helper static.

Pre-existing issue: a fix will be sent to net.

> - Patch 4: Honour tcp_rto_{min_us,max_ms} sysctls for MPTCP-level
>   retransmit timers like with DATA_FIN's and fallback timeout.

Not needed: suggesting adding extra checks if the TCP RTO max and min
sysctl are misconfigured (min > max). There is already a check in the
code to avoid a division by 0. The rest is similar to TCP.

> - Patches 5-6: Add per-event MIB counters for MPTCP_RST_EMPTCP resets to
>   help to spot such situations in production.

Patch 5: some imprecisions in the commit message, not worth a respin I
think. Plus a suggestion of adding an extra increment, but it is for a
different case, so no.

Patch 6: no need to handle the only test where the server initiates the
subflow → the goal is to check that globally these counters are not
unexpetedly incremented. Maybe MPJoinNotEstablished could be checked on
the other side as well, but this shouldn't happen with the current
selftests, and this addition can come in a follow-up patch.

> - Patches 7-9: Small pcap-related improvements in the selftests.

Patch 7: no need to differenciate the mptcp_connect_*.sh which are only
there for the CI. Someone doing the debugging and asking for pcaps will
use mptcp_connect.sh

> - Patch 10: Fix compiler warning in the selftests.

pre-existing, and not really an issue: the selftests don't try to trick
mptcp_connect

> - Patch 11: Avoid a buffer overflow when misusing the mptcp_diag tool
>   from the selftests.

Small typo in the commit message, not worth a respin I think. Plus yes
it is a fix, but not worth being backported: can be a bug when this tool
designed for the selftest is used manually with a wrong address (which
is written in the commit message). Plus pre-existing issues that are not
worth fixing in a follow-up patch for this selftest tool.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.