* [PATCH 6.6.y 0/3] mptcp: pm: only set fullmesh for subflow endp (and more) [not found] <2025020428-unashamed-delicate-248c@gregkh> @ 2025-02-09 17:41 ` Matthieu Baerts (NGI0) 2025-02-09 17:41 ` [PATCH 6.6.y 1/3] mptcp: pm: only set fullmesh for subflow endp Matthieu Baerts (NGI0) ` (2 subsequent siblings) 3 siblings, 0 replies; 7+ messages in thread From: Matthieu Baerts (NGI0) @ 2025-02-09 17:41 UTC (permalink / raw) To: mptcp, stable, gregkh; +Cc: Matthieu Baerts (NGI0) The commit 1bb0d1348546 ("mptcp: pm: only set fullmesh for subflow endp") could not be backported to this kernel version without conflicts. Here is an updated version adapted for this kernel version. While at it, I also added the backport of the commit 56b824eb49d6 ("mptcp: prevent excessive coalescing on receive") that we asked to delay. There was no conflicts. There is also an additional fix for the selftests, specific to v6.6. Matthieu Baerts (NGI0) (2): mptcp: pm: only set fullmesh for subflow endp selftests: mptcp: join: fix AF_INET6 variable Paolo Abeni (1): mptcp: prevent excessive coalescing on receive net/mptcp/pm_netlink.c | 3 ++- net/mptcp/protocol.c | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) -- 2.47.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 6.6.y 1/3] mptcp: pm: only set fullmesh for subflow endp [not found] <2025020428-unashamed-delicate-248c@gregkh> 2025-02-09 17:41 ` [PATCH 6.6.y 0/3] mptcp: pm: only set fullmesh for subflow endp (and more) Matthieu Baerts (NGI0) @ 2025-02-09 17:41 ` Matthieu Baerts (NGI0) 2025-02-13 13:13 ` Patch "mptcp: pm: only set fullmesh for subflow endp" has been added to the 6.6-stable tree gregkh 2025-02-09 17:41 ` [PATCH 6.6.y 2/3] mptcp: prevent excessive coalescing on receive Matthieu Baerts (NGI0) 2025-02-09 17:41 ` [PATCH 6.6.y 3/3] selftests: mptcp: join: fix AF_INET6 variable Matthieu Baerts (NGI0) 3 siblings, 1 reply; 7+ messages in thread From: Matthieu Baerts (NGI0) @ 2025-02-09 17:41 UTC (permalink / raw) To: mptcp, stable, gregkh Cc: Matthieu Baerts (NGI0), syzbot+cd16e79c1e45f3fe0377, Mat Martineau, Jakub Kicinski commit 1bb0d1348546ad059f55c93def34e67cb2a034a6 upstream. With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 'subflow' endpoints, to recreate more or less subflows using the linked address. Unfortunately, the set_flags() hook was a bit more permissive, and allowed 'implicit' endpoints to get the 'fullmesh' flag while it is not allowed before. That's what syzbot found, triggering the following warning: WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 __mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Modules linked in: CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 <0f> 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48 RSP: 0018:ffffc9000d307240 EFLAGS: 00010293 RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0 R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d FS: 00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5fe8785d29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5fe8975fa0 RCX: 00007f5fe8785d29 RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007 RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 00000000000011f4 </TASK> Here, syzbot managed to set the 'fullmesh' flag on an 'implicit' and used -- according to 'id_avail_bitmap' -- endpoint, causing the PM to try decrement the local_addr_used counter which is only incremented for the 'subflow' endpoint. Note that 'no type' endpoints -- not 'subflow', 'signal', 'implicit' -- are fine, because their ID will not be marked as used in the 'id_avail' bitmap, and setting 'fullmesh' can help forcing the creation of subflow when receiving an ADD_ADDR. Fixes: 73c762c1f07d ("mptcp: set fullmesh flag in pm_netlink") Cc: stable@vger.kernel.org Reported-by: syzbot+cd16e79c1e45f3fe0377@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6786ac51.050a0220.216c54.00a6.GAE@google.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/540 Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20250123-net-mptcp-syzbot-issues-v1-2-af73258a726f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ Conflicts in pm_netlink.c, because the code has been moved around in commit 6a42477fe449 ("mptcp: update set_flags interfaces"), but the same fix can still be applied at the original place. ] Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> --- net/mptcp/pm_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 2cf4393e48dc..2b63c5492eed 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -2069,7 +2069,8 @@ int mptcp_pm_nl_set_flags(struct net *net, struct mptcp_pm_addr_entry *addr, u8 return -EINVAL; } if ((addr->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) && - (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) { + (entry->flags & (MPTCP_PM_ADDR_FLAG_SIGNAL | + MPTCP_PM_ADDR_FLAG_IMPLICIT))) { spin_unlock_bh(&pernet->lock); return -EINVAL; } -- 2.47.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Patch "mptcp: pm: only set fullmesh for subflow endp" has been added to the 6.6-stable tree 2025-02-09 17:41 ` [PATCH 6.6.y 1/3] mptcp: pm: only set fullmesh for subflow endp Matthieu Baerts (NGI0) @ 2025-02-13 13:13 ` gregkh 0 siblings, 0 replies; 7+ messages in thread From: gregkh @ 2025-02-13 13:13 UTC (permalink / raw) To: gregkh, kuba, martineau, matttbe, mptcp, syzbot+cd16e79c1e45f3fe0377 Cc: stable-commits This is a note to let you know that I've just added the patch titled mptcp: pm: only set fullmesh for subflow endp to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-pm-only-set-fullmesh-for-subflow-endp.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. From stable+bounces-114455-greg=kroah.com@vger.kernel.org Sun Feb 9 18:42:14 2025 From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> Date: Sun, 9 Feb 2025 18:41:55 +0100 Subject: mptcp: pm: only set fullmesh for subflow endp To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, syzbot+cd16e79c1e45f3fe0377@syzkaller.appspotmail.com, Mat Martineau <martineau@kernel.org>, Jakub Kicinski <kuba@kernel.org> Message-ID: <20250209174153.3388802-6-matttbe@kernel.org> From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> commit 1bb0d1348546ad059f55c93def34e67cb2a034a6 upstream. With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 'subflow' endpoints, to recreate more or less subflows using the linked address. Unfortunately, the set_flags() hook was a bit more permissive, and allowed 'implicit' endpoints to get the 'fullmesh' flag while it is not allowed before. That's what syzbot found, triggering the following warning: WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 __mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Modules linked in: CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 <0f> 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48 RSP: 0018:ffffc9000d307240 EFLAGS: 00010293 RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0 R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d FS: 00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5fe8785d29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5fe8975fa0 RCX: 00007f5fe8785d29 RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007 RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 00000000000011f4 </TASK> Here, syzbot managed to set the 'fullmesh' flag on an 'implicit' and used -- according to 'id_avail_bitmap' -- endpoint, causing the PM to try decrement the local_addr_used counter which is only incremented for the 'subflow' endpoint. Note that 'no type' endpoints -- not 'subflow', 'signal', 'implicit' -- are fine, because their ID will not be marked as used in the 'id_avail' bitmap, and setting 'fullmesh' can help forcing the creation of subflow when receiving an ADD_ADDR. Fixes: 73c762c1f07d ("mptcp: set fullmesh flag in pm_netlink") Cc: stable@vger.kernel.org Reported-by: syzbot+cd16e79c1e45f3fe0377@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6786ac51.050a0220.216c54.00a6.GAE@google.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/540 Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20250123-net-mptcp-syzbot-issues-v1-2-af73258a726f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ Conflicts in pm_netlink.c, because the code has been moved around in commit 6a42477fe449 ("mptcp: update set_flags interfaces"), but the same fix can still be applied at the original place. ] Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/mptcp/pm_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -2069,7 +2069,8 @@ int mptcp_pm_nl_set_flags(struct net *ne return -EINVAL; } if ((addr->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) && - (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) { + (entry->flags & (MPTCP_PM_ADDR_FLAG_SIGNAL | + MPTCP_PM_ADDR_FLAG_IMPLICIT))) { spin_unlock_bh(&pernet->lock); return -EINVAL; } Patches currently in stable-queue which might be from matttbe@kernel.org are queue-6.6/mm-kmemleak-fix-upper-boundary-check-for-physical-address-objects.patch queue-6.6/mptcp-prevent-excessive-coalescing-on-receive.patch queue-6.6/selftests-mptcp-connect-f-no-reconnect.patch queue-6.6/selftests-mptcp-join-fix-af_inet6-variable.patch queue-6.6/mptcp-pm-only-set-fullmesh-for-subflow-endp.patch ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 6.6.y 2/3] mptcp: prevent excessive coalescing on receive [not found] <2025020428-unashamed-delicate-248c@gregkh> 2025-02-09 17:41 ` [PATCH 6.6.y 0/3] mptcp: pm: only set fullmesh for subflow endp (and more) Matthieu Baerts (NGI0) 2025-02-09 17:41 ` [PATCH 6.6.y 1/3] mptcp: pm: only set fullmesh for subflow endp Matthieu Baerts (NGI0) @ 2025-02-09 17:41 ` Matthieu Baerts (NGI0) 2025-02-13 13:13 ` Patch "mptcp: prevent excessive coalescing on receive" has been added to the 6.6-stable tree gregkh 2025-02-09 17:41 ` [PATCH 6.6.y 3/3] selftests: mptcp: join: fix AF_INET6 variable Matthieu Baerts (NGI0) 3 siblings, 1 reply; 7+ messages in thread From: Matthieu Baerts (NGI0) @ 2025-02-09 17:41 UTC (permalink / raw) To: mptcp, stable, gregkh Cc: Paolo Abeni, Mat Martineau, Matthieu Baerts (NGI0), Jakub Kicinski From: Paolo Abeni <pabeni@redhat.com> commit 56b824eb49d6258aa0bad09a406ceac3f643cdae upstream. Currently the skb size after coalescing is only limited by the skb layout (the skb must not carry frag_list). A single coalesced skb covering several MSS can potentially fill completely the receive buffer. In such a case, the snd win will zero until the receive buffer will be empty again, affecting tput badly. Fixes: 8268ed4c9d19 ("mptcp: introduce and use mptcp_try_coalesce()") Cc: stable@vger.kernel.org # please delay 2 weeks after 6.13-final release Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20241230-net-mptcp-rbuf-fixes-v1-3-8608af434ceb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> --- net/mptcp/protocol.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 5143214695dc..140c3ffcb86b 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -138,6 +138,7 @@ static bool mptcp_try_coalesce(struct sock *sk, struct sk_buff *to, int delta; if (MPTCP_SKB_CB(from)->offset || + ((to->len + from->len) > (sk->sk_rcvbuf >> 3)) || !skb_try_coalesce(to, from, &fragstolen, &delta)) return false; -- 2.47.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Patch "mptcp: prevent excessive coalescing on receive" has been added to the 6.6-stable tree 2025-02-09 17:41 ` [PATCH 6.6.y 2/3] mptcp: prevent excessive coalescing on receive Matthieu Baerts (NGI0) @ 2025-02-13 13:13 ` gregkh 0 siblings, 0 replies; 7+ messages in thread From: gregkh @ 2025-02-13 13:13 UTC (permalink / raw) To: gregkh, kuba, martineau, matttbe, mptcp, pabeni; +Cc: stable-commits This is a note to let you know that I've just added the patch titled mptcp: prevent excessive coalescing on receive to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-prevent-excessive-coalescing-on-receive.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. From stable+bounces-114456-greg=kroah.com@vger.kernel.org Sun Feb 9 18:42:14 2025 From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> Date: Sun, 9 Feb 2025 18:41:56 +0100 Subject: mptcp: prevent excessive coalescing on receive To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: Paolo Abeni <pabeni@redhat.com>, Mat Martineau <martineau@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org> Message-ID: <20250209174153.3388802-7-matttbe@kernel.org> From: Paolo Abeni <pabeni@redhat.com> commit 56b824eb49d6258aa0bad09a406ceac3f643cdae upstream. Currently the skb size after coalescing is only limited by the skb layout (the skb must not carry frag_list). A single coalesced skb covering several MSS can potentially fill completely the receive buffer. In such a case, the snd win will zero until the receive buffer will be empty again, affecting tput badly. Fixes: 8268ed4c9d19 ("mptcp: introduce and use mptcp_try_coalesce()") Cc: stable@vger.kernel.org # please delay 2 weeks after 6.13-final release Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20241230-net-mptcp-rbuf-fixes-v1-3-8608af434ceb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/mptcp/protocol.c | 1 + 1 file changed, 1 insertion(+) --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -138,6 +138,7 @@ static bool mptcp_try_coalesce(struct so int delta; if (MPTCP_SKB_CB(from)->offset || + ((to->len + from->len) > (sk->sk_rcvbuf >> 3)) || !skb_try_coalesce(to, from, &fragstolen, &delta)) return false; Patches currently in stable-queue which might be from matttbe@kernel.org are queue-6.6/mm-kmemleak-fix-upper-boundary-check-for-physical-address-objects.patch queue-6.6/mptcp-prevent-excessive-coalescing-on-receive.patch queue-6.6/selftests-mptcp-connect-f-no-reconnect.patch queue-6.6/selftests-mptcp-join-fix-af_inet6-variable.patch queue-6.6/mptcp-pm-only-set-fullmesh-for-subflow-endp.patch ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 6.6.y 3/3] selftests: mptcp: join: fix AF_INET6 variable [not found] <2025020428-unashamed-delicate-248c@gregkh> ` (2 preceding siblings ...) 2025-02-09 17:41 ` [PATCH 6.6.y 2/3] mptcp: prevent excessive coalescing on receive Matthieu Baerts (NGI0) @ 2025-02-09 17:41 ` Matthieu Baerts (NGI0) 2025-02-13 13:13 ` Patch "selftests: mptcp: join: fix AF_INET6 variable" has been added to the 6.6-stable tree gregkh 3 siblings, 1 reply; 7+ messages in thread From: Matthieu Baerts (NGI0) @ 2025-02-09 17:41 UTC (permalink / raw) To: mptcp, stable, gregkh; +Cc: Matthieu Baerts (NGI0) The Fixes commit is a backport renaming a variable, from AF_INET6 to MPTCP_LIB_AF_INET6. The commit has been applied without conflicts, except that it missed one extra variable that was in v6.6, but not in the version linked to the Fixes commit. This variable has then been renamed too to avoid these errors: LISTENER_CREATED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected LISTENER_CLOSED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected Fixes: a17d1419126b ("selftests: mptcp: declare event macros in mptcp_lib") Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh index 17ace5627ce3..497dc187387f 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -2941,7 +2941,7 @@ verify_listener_events() type=$(mptcp_lib_evts_get_info type "$evt" "$e_type") family=$(mptcp_lib_evts_get_info family "$evt" "$e_type") sport=$(mptcp_lib_evts_get_info sport "$evt" "$e_type") - if [ $family ] && [ $family = $AF_INET6 ]; then + if [ $family ] && [ $family = $MPTCP_LIB_AF_INET6 ]; then saddr=$(mptcp_lib_evts_get_info saddr6 "$evt" "$e_type") else saddr=$(mptcp_lib_evts_get_info saddr4 "$evt" "$e_type") -- 2.47.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Patch "selftests: mptcp: join: fix AF_INET6 variable" has been added to the 6.6-stable tree 2025-02-09 17:41 ` [PATCH 6.6.y 3/3] selftests: mptcp: join: fix AF_INET6 variable Matthieu Baerts (NGI0) @ 2025-02-13 13:13 ` gregkh 0 siblings, 0 replies; 7+ messages in thread From: gregkh @ 2025-02-13 13:13 UTC (permalink / raw) To: gregkh, matttbe, mptcp; +Cc: stable-commits This is a note to let you know that I've just added the patch titled selftests: mptcp: join: fix AF_INET6 variable to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: selftests-mptcp-join-fix-af_inet6-variable.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. From stable+bounces-114457-greg=kroah.com@vger.kernel.org Sun Feb 9 18:42:17 2025 From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> Date: Sun, 9 Feb 2025 18:41:57 +0100 Subject: selftests: mptcp: join: fix AF_INET6 variable To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> Message-ID: <20250209174153.3388802-8-matttbe@kernel.org> From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org> The Fixes commit is a backport renaming a variable, from AF_INET6 to MPTCP_LIB_AF_INET6. The commit has been applied without conflicts, except that it missed one extra variable that was in v6.6, but not in the version linked to the Fixes commit. This variable has then been renamed too to avoid these errors: LISTENER_CREATED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected LISTENER_CLOSED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected Fixes: a17d1419126b ("selftests: mptcp: declare event macros in mptcp_lib") Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -2941,7 +2941,7 @@ verify_listener_events() type=$(mptcp_lib_evts_get_info type "$evt" "$e_type") family=$(mptcp_lib_evts_get_info family "$evt" "$e_type") sport=$(mptcp_lib_evts_get_info sport "$evt" "$e_type") - if [ $family ] && [ $family = $AF_INET6 ]; then + if [ $family ] && [ $family = $MPTCP_LIB_AF_INET6 ]; then saddr=$(mptcp_lib_evts_get_info saddr6 "$evt" "$e_type") else saddr=$(mptcp_lib_evts_get_info saddr4 "$evt" "$e_type") Patches currently in stable-queue which might be from matttbe@kernel.org are queue-6.6/mm-kmemleak-fix-upper-boundary-check-for-physical-address-objects.patch queue-6.6/mptcp-prevent-excessive-coalescing-on-receive.patch queue-6.6/selftests-mptcp-connect-f-no-reconnect.patch queue-6.6/selftests-mptcp-join-fix-af_inet6-variable.patch queue-6.6/mptcp-pm-only-set-fullmesh-for-subflow-endp.patch ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-02-13 13:14 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <2025020428-unashamed-delicate-248c@gregkh>
2025-02-09 17:41 ` [PATCH 6.6.y 0/3] mptcp: pm: only set fullmesh for subflow endp (and more) Matthieu Baerts (NGI0)
2025-02-09 17:41 ` [PATCH 6.6.y 1/3] mptcp: pm: only set fullmesh for subflow endp Matthieu Baerts (NGI0)
2025-02-13 13:13 ` Patch "mptcp: pm: only set fullmesh for subflow endp" has been added to the 6.6-stable tree gregkh
2025-02-09 17:41 ` [PATCH 6.6.y 2/3] mptcp: prevent excessive coalescing on receive Matthieu Baerts (NGI0)
2025-02-13 13:13 ` Patch "mptcp: prevent excessive coalescing on receive" has been added to the 6.6-stable tree gregkh
2025-02-09 17:41 ` [PATCH 6.6.y 3/3] selftests: mptcp: join: fix AF_INET6 variable Matthieu Baerts (NGI0)
2025-02-13 13:13 ` Patch "selftests: mptcp: join: fix AF_INET6 variable" has been added to the 6.6-stable tree gregkh
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox