[PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[Ren Wei]

From: Wyatt Feng <bronzed_45_vested@icloud.com>

Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
no data. In that case the child socket's receive queue is intentionally
left empty.

mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
the warning was non-fatal, left stale MPTFO state behind. The stale
flag could later trigger a state-confusion bug in
check_fully_established().

Only mark the subflow as MPTFO after confirming that a SYN-data skb is
present. Return quietly when the receive queue is empty.

Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
 net/mptcp/fastopen.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/fastopen.c b/net/mptcp/fastopen.c
index 082c46c0f50e..f717750906ff 100644
--- a/net/mptcp/fastopen.c
+++ b/net/mptcp/fastopen.c
@@ -24,12 +24,13 @@ void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subf
 	sk = subflow->conn;
 	tp = tcp_sk(ssk);
 
-	subflow->is_mptfo = 1;
-
+	/* A valid TFO cookie does not guarantee SYN data. */
 	skb = skb_peek(&ssk->sk_receive_queue);
-	if (WARN_ON_ONCE(!skb))
+	if (!skb)
 		return;
 
+	subflow->is_mptfo = 1;
+
 	/* dequeue the skb from sk receive queue */
 	__skb_unlink(skb, &ssk->sk_receive_queue);
 	skb_ext_reset(skb);
-- 
2.47.3

Re: [PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[Matthieu Baerts (NGI0)]

Hi Ren, Wyatt, Yuan,

> Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
> no data. In that case the child socket's receive queue is intentionally
> left empty.
>
> mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
> for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
> the warning was non-fatal, left stale MPTFO state behind. The stale
> flag could later trigger a state-confusion bug in
> check_fully_established().
>
> Only mark the subflow as MPTFO after confirming that a SYN-data skb is
> present. Return quietly when the receive queue is empty.

Thank you for the fix, it looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

@Netdev maintainers: this can be applied directly in net.


Sorry for the delay, I initially wanted to understand the reproducer,
then wrote a small packetdrill script, then I lost track of this patch.

As I mentioned to Yuan last week at NetdevConf, it would be great if the
PoC could first try to use Packetdrill when it is doable. For example,
in this case, this packetdrill script appears to be far more readable
than the .c files generated by AI:

  https://github.com/multipath-tcp/packetdrill/pull/202/changes

=> It is easy to read the syscalls, the injected packets (<) and the
expected ones (>) with an output similar to the one from tcpdump.

Note that for MPTCP, this fork should be used:

  https://github.com/multipath-tcp/packetdrill

Otherwise, the official repo can be used:

  https://github.com/google/packetdrill

-- 
Matthieu Baerts (NGI0) <matttbe@kernel.org>

Re: [PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[Yuan Tan]

On Wed, Jul 22, 2026 at 4:07 AM Matthieu Baerts (NGI0)
<matttbe@kernel.org> wrote:
>
> Hi Ren, Wyatt, Yuan,
>
> > Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
> > no data. In that case the child socket's receive queue is intentionally
> > left empty.
> >
> > mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
> > for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
> > the warning was non-fatal, left stale MPTFO state behind. The stale
> > flag could later trigger a state-confusion bug in
> > check_fully_established().
> >
> > Only mark the subflow as MPTFO after confirming that a SYN-data skb is
> > present. Return quietly when the receive queue is empty.
>
> Thank you for the fix, it looks good to me:
>
> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
>
> @Netdev maintainers: this can be applied directly in net.
>
>
> Sorry for the delay, I initially wanted to understand the reproducer,
> then wrote a small packetdrill script, then I lost track of this patch.
>
> As I mentioned to Yuan last week at NetdevConf, it would be great if the
> PoC could first try to use Packetdrill when it is doable. For example,
> in this case, this packetdrill script appears to be far more readable
> than the .c files generated by AI:
>
>   https://github.com/multipath-tcp/packetdrill/pull/202/changes
>
> => It is easy to read the syscalls, the injected packets (<) and the
> expected ones (>) with an output similar to the one from tcpdump.
>
> Note that for MPTCP, this fork should be used:
>
>   https://github.com/multipath-tcp/packetdrill
>
> Otherwise, the official repo can be used:
>
>   https://github.com/google/packetdrill
>
> --
> Matthieu Baerts (NGI0) <matttbe@kernel.org>

Thank you very much for your review. After receiving your suggestions,
I asked Wyatt to prepare a packetdrill version of the PoC for this
bug, but it is not ready yet. I apologize for taking up some of your
time on this review.

For future patches, whenever possible, we will include a packetdrill
PoC in the cover letter and send it to the public mailing list. We
will also use a new Reported-by: Vega tag instead of the tag we are
currently using.

Re: [PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[Jakub Kicinski]

On Wed, 22 Jul 2026 13:07:42 +0200 Matthieu Baerts (NGI0) wrote:
> @Netdev maintainers: this can be applied directly in net.

Too late, please take it.

Re: [PATCH mptcp_net-next 1/1] mptcp: fastopen: only mark MPTFO subflows with SYN data

[Matthieu Baerts]

On 22/07/2026 16:22, Jakub Kicinski wrote:
> On Wed, 22 Jul 2026 13:07:42 +0200 Matthieu Baerts (NGI0) wrote:
>> @Netdev maintainers: this can be applied directly in net.
> 
> Too late, please take it.

No problem, I did take it, and I will send it with the next batch.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.