[PATCH net 0/4] mptcp: misc fixes for v7.1-rc3

[PATCH net 0/4] mptcp: misc fixes for v7.1-rc3

[Matthieu Baerts (NGI0)]

Here are various unrelated fixes:

- Patch 1: increment the right MIB counter. A fix for v5.7.

- Patch 2: set the right MPTCP reset reason. A fix for v5.9.

- Patch 3: fix rx timestamp corruption when on MPTCP passive fastopen. A
  fix for v6.2.

- Patch 4: increase sockopt seq after having set TCP_MAXSEG to propagate
  it to newer subflows later. A fix for 6.17.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Matthieu Baerts (NGI0) (1):
      mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf

Paolo Abeni (1):
      mptcp: fix rx timestamp corruption on fastopen

Shardul Bankar (2):
      mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
      mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure

 net/mptcp/fastopen.c | 4 +++-
 net/mptcp/sockopt.c  | 4 ++++
 net/mptcp/subflow.c  | 4 ++--
 3 files changed, 9 insertions(+), 3 deletions(-)
---
base-commit: 85da3965df5e6f1e1c48d2c435e140c5b66625ef
change-id: 20260501-net-mptcp-misc-fixes-7-1-rc3-902fc2a5d499

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH net 1/4] mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure

[Matthieu Baerts (NGI0)]

From: Shardul Bankar <shardul.b@mpiricsoftware.com>

In subflow_finish_connect(), HMAC validation of the server's HMAC
in SYN/ACK + MP_JOIN increments MPTCP_MIB_JOINACKMAC ("HMAC was
wrong on ACK + MP_JOIN") on failure. The function processes the
SYN/ACK, not the ACK; the matching MPTCP_MIB_JOINSYNACKMAC counter
("HMAC was wrong on SYN/ACK + MP_JOIN") exists but is not
incremented anywhere in the tree.

The mirror site on the server, subflow_syn_recv_sock(), already
uses JOINACKMAC correctly for ACK HMAC failure. Use JOINSYNACKMAC
at the SYN/ACK validation site so each counter reflects the packet
whose HMAC actually failed.

Suggested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Fixes: fc518953bc9c ("mptcp: add and use MIB counter infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/subflow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index e2cb9d23e4a0..bda6862264ca 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -581,7 +581,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
 			 subflow->backup);
 
 		if (!subflow_thmac_valid(subflow)) {
-			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINACKMAC);
+			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKMAC);
 			subflow->reset_reason = MPTCP_RST_EMPTCP;
 			goto do_reset;
 		}

-- 
2.53.0

[PATCH net 2/4] mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure

[Matthieu Baerts (NGI0)]

From: Shardul Bankar <shardul.b@mpiricsoftware.com>

When HMAC validation fails on a received ACK + MP_JOIN in
subflow_syn_recv_sock(), the subflow is reset with reason
MPTCP_RST_EPROHIBIT ("Administratively prohibited"). This is
incorrect: HMAC validation failure is an MPTCP protocol-level
error, not an administrative policy denial.

The mirror site on the client, in subflow_finish_connect(), already
uses MPTCP_RST_EMPTCP ("MPTCP-specific error") for the same kind of
HMAC failure on the SYN/ACK + MP_JOIN. Use the same reason on the
server side for symmetry and accuracy.

Suggested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Fixes: 443041deb5ef ("mptcp: fix NULL pointer in can_accept_new_subflow")
Cc: stable@vger.kernel.org
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/subflow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index bda6862264ca..d562e149606f 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -908,7 +908,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
 
 			if (!subflow_hmac_valid(subflow_req, &mp_opt)) {
 				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
-				subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT);
+				subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
 				goto dispose_child;
 			}
 

-- 
2.53.0

[PATCH net 3/4] mptcp: fix rx timestamp corruption on fastopen

[Matthieu Baerts (NGI0)]

From: Paolo Abeni <pabeni@redhat.com>

The skb cb offset containing the timestamp presence flag is cleared
before loading such information. Cache such value before MPTCP CB
initialization.

Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/fastopen.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/fastopen.c b/net/mptcp/fastopen.c
index 82ec15bcfd7f..082c46c0f50e 100644
--- a/net/mptcp/fastopen.c
+++ b/net/mptcp/fastopen.c
@@ -12,6 +12,7 @@ void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subf
 	struct sock *sk, *ssk;
 	struct sk_buff *skb;
 	struct tcp_sock *tp;
+	bool has_rxtstamp;
 
 	/* on early fallback the subflow context is deleted by
 	 * subflow_syn_recv_sock()
@@ -40,12 +41,13 @@ void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subf
 	 */
 	tp->copied_seq += skb->len;
 	subflow->ssn_offset += skb->len;
+	has_rxtstamp = TCP_SKB_CB(skb)->has_rxtstamp;
 
 	/* Only the sequence delta is relevant */
 	MPTCP_SKB_CB(skb)->map_seq = -skb->len;
 	MPTCP_SKB_CB(skb)->end_seq = 0;
 	MPTCP_SKB_CB(skb)->offset = 0;
-	MPTCP_SKB_CB(skb)->has_rxtstamp = TCP_SKB_CB(skb)->has_rxtstamp;
+	MPTCP_SKB_CB(skb)->has_rxtstamp = has_rxtstamp;
 	MPTCP_SKB_CB(skb)->cant_coalesce = 1;
 
 	mptcp_data_lock(sk);

-- 
2.53.0

[PATCH net 4/4] mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf

[Matthieu Baerts (NGI0)]

mptcp_setsockopt_all_sf() was missing a call to sockopt_seq_inc(). This
is required not to cause missing synchronization for newer subflows
created later on.

This helper is called each time a socket option is set on subflows, and
future ones will need to inherit this option after their creation.

Fixes: 51c5fd09e1b4 ("mptcp: add TCP_MAXSEG sockopt support")
Cc: stable@vger.kernel.org
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/sockopt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index 0efe40be2fde..1cf608e7357b 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -812,6 +812,10 @@ static int mptcp_setsockopt_all_sf(struct mptcp_sock *msk, int level,
 		if (ret)
 			break;
 	}
+
+	if (!ret)
+		sockopt_seq_inc(msk);
+
 	return ret;
 }
 

-- 
2.53.0

Re: [PATCH net 4/4] mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf

[Matthieu Baerts]

Hello,

On 01/05/2026 21:35, Matthieu Baerts (NGI0) wrote:
> mptcp_setsockopt_all_sf() was missing a call to sockopt_seq_inc(). This
> is required not to cause missing synchronization for newer subflows
> created later on.
> 
> This helper is called each time a socket option is set on subflows, and
> future ones will need to inherit this option after their creation.

Regarding Sashiko's review, I think this can be ignored: the comments
are about existing code / architecture. In short, for the moment, most
places in sockopt.c assumes that if there is an error to set a socket
option with one subflow, the error will be visible when setting this
option on all of them. Maybe (not sure) this could be changed, but then
this can be done later, when modifying all the other places. Here I
think it is better to keep the same logic as what is done with the other
options.

https://sashiko.dev/#/patchset/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-0-b70118df778e%40kernel.org

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH net 0/4] mptcp: misc fixes for v7.1-rc3

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 01 May 2026 21:35:33 +0200 you wrote:
> Here are various unrelated fixes:
> 
> - Patch 1: increment the right MIB counter. A fix for v5.7.
> 
> - Patch 2: set the right MPTCP reset reason. A fix for v5.9.
> 
> - Patch 3: fix rx timestamp corruption when on MPTCP passive fastopen. A
>   fix for v6.2.
> 
> [...]

Here is the summary with links:
  - [net,1/4] mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    https://git.kernel.org/netdev/net/c/c4a99a921949
  - [net,2/4] mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    https://git.kernel.org/netdev/net/c/a6da02d4c00f
  - [net,3/4] mptcp: fix rx timestamp corruption on fastopen
    https://git.kernel.org/netdev/net/c/6254a16d6f0c
  - [net,4/4] mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
    https://git.kernel.org/netdev/net/c/70ece9d7021c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html