Netdev List
 help / color / mirror / Atom feed
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
To: Mat Martineau <martineau@kernel.org>,
	Geliang Tang <geliang@kernel.org>,
	 "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	 Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,  Simon Horman <horms@kernel.org>
Cc: Eric Dumazet <edumaze@google.com>,
	netdev@vger.kernel.org,  mptcp@lists.linux.dev,
	linux-kernel@vger.kernel.org,
	 "Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	stable@vger.kernel.org
Subject: [PATCH net 4/5] mptcp: reset rcv wnd on disconnect
Date: Mon, 11 May 2026 17:46:30 +0200	[thread overview]
Message-ID: <20260511-net-mptcp-misc-fixes-7-1-rc4-v1-4-5ee57cb2b7eb@kernel.org> (raw)
In-Reply-To: <20260511-net-mptcp-misc-fixes-7-1-rc4-v1-0-5ee57cb2b7eb@kernel.org>

From: Paolo Abeni <pabeni@redhat.com>

If the MPTCP socket fallback to TCP before the MP handshake completion,
the IASN remain 0, and the rcv_wnd_sent field is not explicitly
initialized, just incremented over time with the data transfer.

At disconnect time such value is not cleared. If the next connection falls
back to TCP before the MP handshake completion, the data transfer will
keep incrementing the receive window end sequence starting from the last
value used in the previous connection: the announced window will be
unrelated from the actual receiver buffer size and likely too big.

Address the issue zeroing the field at disconnect time.

Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/protocol.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 859df49e16dc..a72a6ad6ee8b 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3487,6 +3487,7 @@ static int mptcp_disconnect(struct sock *sk, int flags)
 
 	/* for fallback's sake */
 	WRITE_ONCE(msk->ack_seq, 0);
+	atomic64_set(&msk->rcv_wnd_sent, 0);
 
 	WRITE_ONCE(sk->sk_shutdown, 0);
 	sk_error_report(sk);

-- 
2.53.0


  parent reply	other threads:[~2026-05-11 15:47 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-11 15:46 [PATCH net 0/5] mptcp: misc fixes for v7.1-rc4 Matthieu Baerts (NGI0)
2026-05-11 15:46 ` [PATCH net 1/5] mptcp: do not drop partial packets Matthieu Baerts (NGI0)
2026-05-11 15:46 ` [PATCH net 2/5] mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Matthieu Baerts (NGI0)
2026-05-11 15:46 ` [PATCH net 3/5] selftests: mptcp: join: cover ADD_ADDR tx drop and list progress Matthieu Baerts (NGI0)
2026-05-11 16:52   ` Breno Leitao
2026-05-11 15:46 ` Matthieu Baerts (NGI0) [this message]
2026-05-11 15:46 ` [PATCH net 5/5] mptcp: update window_clamp on subflows when SO_RCVBUF is set Matthieu Baerts (NGI0)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260511-net-mptcp-misc-fixes-7-1-rc4-v1-4-5ee57cb2b7eb@kernel.org \
    --to=matttbe@kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumaze@google.com \
    --cc=edumazet@google.com \
    --cc=geliang@kernel.org \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=martineau@kernel.org \
    --cc=mptcp@lists.linux.dev \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox