Re: [PATCH 6.18 214/275] mptcp: sync the msk->sndbuf at accept() time

Re: [PATCH 6.18 214/275] mptcp: sync the msk->sndbuf at accept() time

[Matthieu Baerts]

Hi Greg, Gang,

On 04/05/2026 15:52, Greg Kroah-Hartman wrote:
> 6.18-stable review patch.  If anyone has any objections, please let me know.

Please drop this patch, it looks like it is introducing regressions on
v6.18:


$ ./diag.sh
  TAP version 13
  1..1
  # 01 no msk on netns creation                          [ OK ]
  # 02 listen match for dport 10000                      [ OK ]
  # 03 listen match for sport 10000                      [ OK ]
  # 04 listen match for saddr and sport                  [ OK ]
  # 05 all listen sockets                                [ OK ]
  [    3.976840] Oops: general protection fault, probably for non-canonical address 0x656e6769736e75f8: 0000 [#1] SMP NOPTI
  [    3.977019] CPU: 0 UID: 0 PID: 221 Comm: mptcp_connect Tainted: G                 N  6.18.26 #1 PREEMPT(voluntary) 
  [    3.977251] Tainted: [N]=TEST
  [    3.977690] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
  [    3.978293] RIP: 0010:mptcp_stream_accept (net/mptcp/protocol.h:966 (discriminator 2))
  [    3.978761] Code: f7 e8 d8 32 06 00 48 8b 1b 4c 39 fb 75 98 4c 89 ef e8 f8 99 ff ff 48 8b 93 d8 00 00 00 8b 8a 38 02 00 00 48 8b 92 c8 04 00 00 <3b> 8a d0 00 00 00 74 08 4c 89 ef e8 94 a4 ff ff 49 8b 95 a8 06 00
  All code
  ========
     0:	f7 e8                	imul   %eax
     2:	d8 32                	fdivs  (%rdx)
     4:	06                   	(bad)
     5:	00 48 8b             	add    %cl,-0x75(%rax)
     8:	1b 4c 39 fb          	sbb    -0x5(%rcx,%rdi,1),%ecx
     c:	75 98                	jne    0xffffffffffffffa6
     e:	4c 89 ef             	mov    %r13,%rdi
    11:	e8 f8 99 ff ff       	call   0xffffffffffff9a0e
    16:	48 8b 93 d8 00 00 00 	mov    0xd8(%rbx),%rdx
    1d:	8b 8a 38 02 00 00    	mov    0x238(%rdx),%ecx
    23:	48 8b 92 c8 04 00 00 	mov    0x4c8(%rdx),%rdx
    2a:*	3b 8a d0 00 00 00    	cmp    0xd0(%rdx),%ecx		<-- trapping instruction
    30:	74 08                	je     0x3a
    32:	4c 89 ef             	mov    %r13,%rdi
    35:	e8 94 a4 ff ff       	call   0xffffffffffffa4ce
    3a:	49                   	rex.WB
    3b:	8b                   	.byte 0x8b
    3c:	95                   	xchg   %eax,%ebp
    3d:	a8 06                	test   $0x6,%al
  	...
  
  Code starting with the faulting instruction
  ===========================================
     0:	3b 8a d0 00 00 00    	cmp    0xd0(%rdx),%ecx
     6:	74 08                	je     0x10
     8:	4c 89 ef             	mov    %r13,%rdi
     b:	e8 94 a4 ff ff       	call   0xffffffffffffa4a4
    10:	49                   	rex.WB
    11:	8b                   	.byte 0x8b
    12:	95                   	xchg   %eax,%ebp
    13:	a8 06                	test   $0x6,%al
  	...
  [    3.979083] RSP: 0018:ffffc9000048fda0 EFLAGS: 00010246
  [    3.979167] RAX: 0000000080000000 RBX: ffff888108c48e30 RCX: 0000000081da17f0
  [    3.979262] RDX: 656e6769736e7528 RSI: 00000000fffffe00 RDI: ffff888108c487c0
  [    3.979357] RBP: ffff888108c50940 R08: 0000000000000001 R09: ffffffff81c36d02
  [    3.979451] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88810481f740
  [    3.980273] R13: ffff888108c487c0 R14: ffff888108c50b90 R15: ffff888108c48e30
  [    3.980830] FS:  00007fdb510f6bc0(0000) GS:ffff8881b8f1c000(0000) knlGS:0000000000000000
  [    3.981059] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [    3.981241] CR2: 00007fdb5125dce0 CR3: 0000000103e1a006 CR4: 0000000000370ef0
  [    3.981428] Call Trace:
  [    3.981544]  <TASK>
  [    3.981637]  do_accept (net/socket.c:1989)
  [    3.981745]  __sys_accept4 (net/socket.c:2030 (discriminator 1))
  [    3.981861]  __x64_sys_accept (net/socket.c:2070 (discriminator 1))
  [    3.981977]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1))
  [    3.982091]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)


@Gang: could you eventually have a look, please?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH 6.18 214/275] mptcp: sync the msk->sndbuf at accept() time

[Matthieu Baerts]

On 05/05/2026 19:16, Matthieu Baerts wrote:
> Hi Greg, Gang,
> 
> On 04/05/2026 15:52, Greg Kroah-Hartman wrote:
>> 6.18-stable review patch.  If anyone has any objections, please let me know.
> 
> Please drop this patch, it looks like it is introducing regressions on
> v6.18:

(...)

> @Gang: could you eventually have a look, please?
FYI, I quickly checked, and I noticed that 'subflow' is different on
v6.18 due to the "mptcp_for_each_subflow(msk, subflow)" removed in
68c7c3867145 ("mptcp: fix memcg accounting for passive sockets").

Moving __mptcp_propagate_sndbuf() a couple of lines above, before the
for-loop, should fix the issue. I can eventually look at sending a patch
with the fix.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH 6.18 214/275] mptcp: sync the msk->sndbuf at accept() time

[Sasha Levin]

On Tue, May 05, 2026 at 07:50:47PM +0200, Matthieu Baerts wrote:
> FYI, I quickly checked, and I noticed that 'subflow' is different on
> v6.18 due to the "mptcp_for_each_subflow(msk, subflow)" removed in
> 68c7c3867145 ("mptcp: fix memcg accounting for passive sockets").
>
> Moving __mptcp_propagate_sndbuf() a couple of lines above, before the
> for-loop, should fix the issue. I can eventually look at sending a patch
> with the fix.

Dropped from the 6.18 queue, thanks.

Happy to take a corrected 6.18-specific backport whenever you have one.

--
Thanks,
Sasha

Re: [PATCH 6.18 214/275] mptcp: sync the msk->sndbuf at accept() time

[gang.yan]

May 6, 2026 at 1:50 AM, "Matthieu Baerts" <matttbe@kernel.org mailto:matttbe@kernel.org?to=%22Matthieu%20Baerts%22%20%3Cmatttbe%40kernel.org%3E > wrote:


> 
> On 05/05/2026 19:16, Matthieu Baerts wrote:
> 
> > 
> > Hi Greg, Gang,
> >  
> >  On 04/05/2026 15:52, Greg Kroah-Hartman wrote:
> > 
> > > 
> > > 6.18-stable review patch. If anyone has any objections, please let me know.
> > > 
> >  
> >  Please drop this patch, it looks like it is introducing regressions on
> >  v6.18:
> > 
> (...)
> 
> > 
> > @Gang: could you eventually have a look, please?
> > 
> FYI, I quickly checked, and I noticed that 'subflow' is different on
> v6.18 due to the "mptcp_for_each_subflow(msk, subflow)" removed in
> 68c7c3867145 ("mptcp: fix memcg accounting for passive sockets").
> 
> Moving __mptcp_propagate_sndbuf() a couple of lines above, before the
> for-loop, should fix the issue. I can eventually look at sending a patch
> with the fix.
> 
Hi Matt,

Thanks for the quick check and fix! Much appreciated.

Cherrs,
Gang
> Cheers,
> Matt
> -- 
> Sponsored by the NGI0 Core fund.
>