[PATCH mptcp-net v2] mptcp: fix subflow bitfield misuse

[PATCH mptcp-net v2] mptcp: fix subflow bitfield misuse

[Paolo Abeni]

The subflow status bitfield is protected by the subflow socket
lock, with one notable exception: the `close_event_done` bit
is actually under the msk socket lock protection.

Flipping the latter bit may corrupt other entries in the same
bitfield.

Move the  `close_event_done` outside the bitfield in a 32bit
hole.

Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
v1 -> v2:
  - place close_event_done in the reset area, drop the chunk in
    mptcp_close_ssk
---
 net/mptcp/protocol.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 4bf04f9ecbd9..d18272fee2be 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -598,14 +598,16 @@ struct mptcp_subflow_context {
 		closing : 1,	    /* must not pass rx data to msk anymore */
 		valid_csum_seen : 1,        /* at least one csum validated */
 		is_mptfo : 1,	    /* subflow is doing TFO */
-		close_event_done : 1,       /* has done the post-closed part */
 		mpc_drop : 1,	    /* the MPC option has been dropped in a rtx */
 		resetting : 1,	    /* subflow is resetting */
-		__unused : 8;
+		__unused : 9;
 	bool	data_avail;
 	bool	scheduled;
 	bool	pm_listener;	    /* a listener managed by the kernel PM? */
 	bool	fully_established;  /* path validated */
+	bool	close_event_done;   /* netlink event generated,
+				     * protected by msk socket lock
+				     */
 	u32	lent_mem_frag;
 	u32	remote_nonce;
 	u32	local_nonce;
-- 
2.55.0

Re: [PATCH mptcp-net v2] mptcp: fix subflow bitfield misuse

[MPTCP CI]

Hi Paolo,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/35853276088

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/aaacd43ef1cc
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1172144


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-net v2] mptcp: fix subflow bitfield misuse

[Matthieu Baerts]

Hi Paolo,

On 23/09/2026 12:47, Paolo Abeni wrote:
> The subflow status bitfield is protected by the subflow socket
> lock, with one notable exception: the `close_event_done` bit
> is actually under the msk socket lock protection.
> 
> Flipping the latter bit may corrupt other entries in the same
> bitfield.

Thank you for the fix!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

> Move the  `close_event_done` outside the bitfield in a 32bit
> hole.
> 
> Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
> v1 -> v2:
>   - place close_event_done in the reset area, drop the chunk in
>     mptcp_close_ssk
> ---
>  net/mptcp/protocol.h | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
> index 4bf04f9ecbd9..d18272fee2be 100644
> --- a/net/mptcp/protocol.h
> +++ b/net/mptcp/protocol.h
> @@ -598,14 +598,16 @@ struct mptcp_subflow_context {
>  		closing : 1,	    /* must not pass rx data to msk anymore */
>  		valid_csum_seen : 1,        /* at least one csum validated */
>  		is_mptfo : 1,	    /* subflow is doing TFO */
> -		close_event_done : 1,       /* has done the post-closed part */
>  		mpc_drop : 1,	    /* the MPC option has been dropped in a rtx */
>  		resetting : 1,	    /* subflow is resetting */
> -		__unused : 8;
> +		__unused : 9;
>  	bool	data_avail;
>  	bool	scheduled;
>  	bool	pm_listener;	    /* a listener managed by the kernel PM? */
>  	bool	fully_established;  /* path validated */
> +	bool	close_event_done;   /* netlink event generated,

Small detail: I kept "has done the post-closed part", because it is not
just about the netlink event, but also not to call __mptcp_close_ssk() a
second time for example.

Now in our tree:

New patches for t/upstream-net and t/upstream:
- b0fee7fb1388: mptcp: fix subflow bitfield misuse
- Results: 791d82ad3995..1fbd5c79d0b0 (export-net)
- Results: 1ca5a862adc9..cc3d41a12d90 (export)

Tests are now in progress:

- export-net:
https://github.com/multipath-tcp/mptcp_net-next/commit/e8ca111352cd94ad7f8409694086020cd54589dc/checks
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/d36866855349a0689ae2ff0b426fe1476f987238/checks

> +				     * protected by msk socket lock
> +				     */
>  	u32	lent_mem_frag;
>  	u32	remote_nonce;
>  	u32	local_nonce;

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.