[PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[Eric Dumazet]

From: Kyle Zeng <kylebot@openai.com>

ack_update_msk() samples snd_nxt before taking the data lock, but reads
snd_una after taking it. Concurrent transmission and ACK processing can
therefore leave the sampled upper bound behind snd_una. Active-open
completion also exposes a reversed interval when it initializes snd_una
to IDSN + 1 while the socket-owned state synchronization is deferred.

A peer-supplied 64-bit Data ACK half a sequence space away can pass both
wraparound comparisons against such an interval. The resulting snd_una
can make __mptcp_retrans() inflate a fragment's already_sent field. Later
ACKs can then underflow data_len and cause out-of-bounds page fragments
to be passed to TCP.

Read snd_nxt after acquiring the data lock and reject reversed intervals
before checking the received Data ACK. This keeps the interval shorter
than half the sequence space, so the existing upper-bound check cannot
accept an advance beyond snd_nxt. Preserve the existing handling of old
ACKs and keep the transmit fields under their existing socket locking.

Fixes: 7439d687b79c ("mptcp: avoid a few atomic ops in the rx path")
Fixes: 3f83d8a77eee ("mptcp: fix more tx path fields initialization")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 net/mptcp/options.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 64aa7a516a23..02e785a14b8a 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -1122,9 +1122,9 @@ static void ack_update_msk(struct mptcp_sock *msk,
 			   struct sock *ssk,
 			   struct mptcp_options_received *mp_opt)
 {
-	u64 new_wnd_end, new_snd_una, snd_nxt = READ_ONCE(msk->snd_nxt);
+	u64 new_wnd_end, new_snd_una, old_snd_una;
 	struct sock *sk = (struct sock *)msk;
-	u64 old_snd_una;
+	u64 snd_nxt;
 
 	mptcp_data_lock(sk);
 
@@ -1133,10 +1133,14 @@ static void ack_update_msk(struct mptcp_sock *msk,
 	 * more dangerous than missing an ack
 	 */
 	old_snd_una = msk->snd_una;
+	snd_nxt = READ_ONCE(msk->snd_nxt);
 	new_snd_una = mptcp_expand_seq(old_snd_una, mp_opt->data_ack, mp_opt->ack64);
 
-	/* ACK for data not even sent yet? Ignore.*/
-	if (unlikely(after64(new_snd_una, snd_nxt)))
+	/* The active-open state sync can defer the snd_nxt update. Do not
+	 * accept an ACK against a reversed interval, or beyond snd_nxt.
+	 */
+	if (unlikely(before64(snd_nxt, old_snd_una) ||
+		     after64(new_snd_una, snd_nxt)))
 		new_snd_una = old_snd_una;
 
 	new_wnd_end = new_snd_una + tcp_sk(ssk)->snd_wnd;
-- 
2.53.0

Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[Matthieu Baerts]

Hi Eric,

(+cc MPTCP list)

On 04/11/2026 14:07, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> ack_update_msk() samples snd_nxt before taking the data lock, but reads
> snd_una after taking it. Concurrent transmission and ACK processing can
> therefore leave the sampled upper bound behind snd_una. Active-open
> completion also exposes a reversed interval when it initializes snd_una
> to IDSN + 1 while the socket-owned state synchronization is deferred.
> 
> A peer-supplied 64-bit Data ACK half a sequence space away can pass both
> wraparound comparisons against such an interval. The resulting snd_una
> can make __mptcp_retrans() inflate a fragment's already_sent field. Later
> ACKs can then underflow data_len and cause out-of-bounds page fragments
> to be passed to TCP.
> 
> Read snd_nxt after acquiring the data lock and reject reversed intervals
> before checking the received Data ACK. This keeps the interval shorter
> than half the sequence space, so the existing upper-bound check cannot
> accept an advance beyond snd_nxt. Preserve the existing handling of old
> ACKs and keep the transmit fields under their existing socket locking.

Sorry, I missed this patch (the MPTCP CI didn't get it).

It looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

While at it:

Cc: stable@vger.kernel.org

@Net Maintainers: this patch can be applied to the net tree directly,
thank you! (Or did I miss my review window?)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[Jakub Kicinski]

On Tue, 10 Nov 2026 20:10:37 +0100 Matthieu Baerts wrote:
> @Net Maintainers: this patch can be applied to the net tree directly,
> thank you! (Or did I miss my review window?)

Next time just look at patchwork state instead of asking.

Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  4 Nov 2026 14:07:47 +0100 you wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> ack_update_msk() samples snd_nxt before taking the data lock, but reads
> snd_una after taking it. Concurrent transmission and ACK processing can
> therefore leave the sampled upper bound behind snd_una. Active-open
> completion also exposes a reversed interval when it initializes snd_una
> to IDSN + 1 while the socket-owned state synchronization is deferred.
> 
> [...]

Here is the summary with links:
  - [net] mptcp: reject DATA_ACKs against a reversed send interval
    https://git.kernel.org/netdev/net/c/d75e5cd72995

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[Matthieu Baerts]

On 10/11/2026 20:33, Jakub Kicinski wrote:
> On Tue, 10 Nov 2026 20:10:37 +0100 Matthieu Baerts wrote:
>> @Net Maintainers: this patch can be applied to the net tree directly,
>> thank you! (Or did I miss my review window?)
> 
> Next time just look at patchwork state instead of asking.

Sorry, it was in awaiting-upstream one and not listed in suie (which
makes sense): I wasn't sure if I had to do something else to get it back
in suie or if it meant I had to take it in our tree first. It looks like
not, so that's understood now!

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.