* [PATCH net v2 1/3] mptcp: avoid unneeded actions on subflow reset
2026-09-17 13:05 [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 Matthieu Baerts (NGI0)
@ 2026-09-17 13:05 ` Matthieu Baerts (NGI0)
2026-09-17 13:05 ` [PATCH net v2 2/3] mptcp: close race between scheduler and state change Matthieu Baerts (NGI0)
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Matthieu Baerts (NGI0) @ 2026-09-17 13:05 UTC (permalink / raw)
To: Mat Martineau, Geliang Tang, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman
Cc: netdev, mptcp, Matthieu Baerts (NGI0), stable, Xinyang Ge
From: Paolo Abeni <pabeni@redhat.com>
Once in a blue moon, the mptcp receive path can recursively call
mptcp_data_ready() via state change under unlucky error conditions, and
then try to hold the data lock again.
Break the recursion loop explicitly checking for the exceptional
condition.
Add a new flag instead of using an existing one like 'closing', to exit
early in subflow_state_change(), and explicitly flush the RX queue at
reset time.
This avoids unneeded processing to check for available data -- calling
get_mapping_status() and more on a dying subflow -- but also in error
reporting and worker scheduling.
Note that we must consume the currently peeked skb before invoking
mptcp_dss_corruption to avoid consuming it again after the eventual
reset has freed it.
Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption")
Cc: stable@vger.kernel.org
Reported-by: Xinyang Ge <xinyang@anthropic.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
v2:
- rewording to please Clashiko
- consume skb before dss_corruption, and purge queue during reset
---
net/mptcp/protocol.c | 4 ++--
net/mptcp/protocol.h | 3 ++-
net/mptcp/subflow.c | 11 +++++++++++
3 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 8dc25ef1542c..d9fc3be9d2db 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -856,12 +856,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
mptcp_dss_corruption(msk, ssk);
}
} else {
+ sk_eat_skb(ssk, skb);
+
if (unlikely(!fin)) {
DEBUG_NET_WARN_ON_ONCE(1);
mptcp_dss_corruption(msk, ssk);
}
-
- sk_eat_skb(ssk, skb);
}
WRITE_ONCE(tp->copied_seq, seq);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 2b4c27426477..0384d6a023f9 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -585,7 +585,8 @@ struct mptcp_subflow_context {
is_mptfo : 1, /* subflow is doing TFO */
close_event_done : 1, /* has done the post-closed part */
mpc_drop : 1, /* the MPC option has been dropped in a rtx */
- __unused : 9;
+ resetting : 1, /* subflow is resetting */
+ __unused : 8;
bool data_avail;
bool scheduled;
bool pm_listener; /* a listener managed by the kernel PM? */
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 01db7edce18a..f0a6725d2c37 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -438,6 +438,10 @@ void mptcp_subflow_reset(struct sock *ssk)
/* must hold: tcp_done() could drop last reference on parent */
sock_hold(sk);
+ subflow->resetting = 1;
+
+ /* No need to delay the actual close for to-be discarded data. */
+ __skb_queue_purge(&ssk->sk_receive_queue);
mptcp_send_active_reset_reason(ssk);
tcp_done(ssk);
if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags))
@@ -1883,6 +1887,13 @@ static void subflow_state_change(struct sock *sk)
__subflow_state_change(sk);
+ /* Rx queue processing is unneeded, error reporting will take place at
+ * __mptcp_close_ssk() time and subflow reset can't happen in case of
+ * fallback: subflow_sched_work_if_closed() would be a no-op.
+ */
+ if (subflow->resetting)
+ return;
+
/* as recvmsg() does not acquire the subflow socket for ssk selection
* a fin packet carrying a DSS can be unnoticed if we don't trigger
* the data available machinery here.
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net v2 2/3] mptcp: close race between scheduler and state change
2026-09-17 13:05 [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 Matthieu Baerts (NGI0)
2026-09-17 13:05 ` [PATCH net v2 1/3] mptcp: avoid unneeded actions on subflow reset Matthieu Baerts (NGI0)
@ 2026-09-17 13:05 ` Matthieu Baerts (NGI0)
2026-09-17 13:05 ` [PATCH net v2 3/3] mptcp: fix bad accounting in __mptcp_subflow_push_pending() Matthieu Baerts (NGI0)
2026-09-17 15:20 ` [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Matthieu Baerts (NGI0) @ 2026-09-17 13:05 UTC (permalink / raw)
To: Mat Martineau, Geliang Tang, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman
Cc: netdev, mptcp, Matthieu Baerts (NGI0), stable, Shardul Bankar,
Xinyang Ge
From: Paolo Abeni <pabeni@redhat.com>
The mptcp scheduler may race with subflow sockets state change: data
transmission on the selected socket may fail and a later release could
try to use mss_now reset to 0 for a divide operation.
Address the issue by explicitly checking for the critical scenario.
Fixes: c886d70286bf ("mptcp: do not queue data on closed subflows")
Cc: stable@vger.kernel.org
Reported-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Reported-by: Xinyang Ge <xinyang@anthropic.com>
Closes: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricsoftware.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
net/mptcp/protocol.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index d9fc3be9d2db..577d0134b9ec 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1664,7 +1664,9 @@ struct sock *mptcp_subflow_get_send(struct mptcp_sock *msk)
static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info *info)
{
- tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal);
+ if (info->mss_now)
+ tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle,
+ info->size_goal);
release_sock(ssk);
}
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net v2 3/3] mptcp: fix bad accounting in __mptcp_subflow_push_pending()
2026-09-17 13:05 [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 Matthieu Baerts (NGI0)
2026-09-17 13:05 ` [PATCH net v2 1/3] mptcp: avoid unneeded actions on subflow reset Matthieu Baerts (NGI0)
2026-09-17 13:05 ` [PATCH net v2 2/3] mptcp: close race between scheduler and state change Matthieu Baerts (NGI0)
@ 2026-09-17 13:05 ` Matthieu Baerts (NGI0)
2026-09-17 15:20 ` [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Matthieu Baerts (NGI0) @ 2026-09-17 13:05 UTC (permalink / raw)
To: Mat Martineau, Geliang Tang, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman
Cc: netdev, mptcp, Matthieu Baerts (NGI0), stable
From: Paolo Abeni <pabeni@redhat.com>
If __subflow_push_pending() errors out we should avoid updating the
copied byte counters, to avoid mismatch push call later on.
Fixes: 0fa1b3783a17 ("mptcp: use get_send wrapper")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
net/mptcp/protocol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 577d0134b9ec..e89a69ab927c 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1854,7 +1854,8 @@ static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk, bool
ret = __subflow_push_pending(sk, ssk, &info);
if (ret <= 0)
keep_pushing = false;
- copied += ret;
+ else
+ copied += ret;
}
mptcp_for_each_subflow(msk, subflow) {
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4
2026-09-17 13:05 [PATCH net v2 0/3] mptcp: misc fixes for v7.3-rc4 Matthieu Baerts (NGI0)
` (2 preceding siblings ...)
2026-09-17 13:05 ` [PATCH net v2 3/3] mptcp: fix bad accounting in __mptcp_subflow_push_pending() Matthieu Baerts (NGI0)
@ 2026-09-17 15:20 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-09-17 15:20 UTC (permalink / raw)
To: Matthieu Baerts
Cc: martineau, geliang, davem, edumazet, kuba, pabeni, horms, netdev,
mptcp, stable, xinyang, shardul.b
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 17 Sep 2026 15:05:56 +0200 you wrote:
> Here are two unrelated fixes:
>
> - Patch 1: avoid unneeded actions on subflow reset. A fix for another
> fix introduced in v6.12 and targeting a commit from v5.7.
>
> - Patch 2: close a possible race when scheduling a closing path. A fix
> for another fix introduced in v6.0 and targeting v5.10.
>
> [...]
Here is the summary with links:
- [net,v2,1/3] mptcp: avoid unneeded actions on subflow reset
https://git.kernel.org/netdev/net/c/2b0f561f21b2
- [net,v2,2/3] mptcp: close race between scheduler and state change
https://git.kernel.org/netdev/net/c/42064de57fb8
- [net,v2,3/3] mptcp: fix bad accounting in __mptcp_subflow_push_pending()
https://git.kernel.org/netdev/net/c/f3ef03357396
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread