Re: [PATCH 6.6.y 2/2] mptcp: prevent race between disconnect() and rtx

[Matthieu Baerts <matttbe@kernel.org>]

Hi Sasha,

On 17/09/2026 14:49, Sasha Levin wrote:
> From: Paolo Abeni <pabeni@redhat.com>
> 
> [ Upstream commit 85c580b0d8590520ae00a15c29e9fb9c99427a3e ]

Thank you for the backport!

> Sashiko noted that the two event can race, leading to inconsistent
> status. Prevent the race using the synchronous timer stop operation.
> 
> Cc: stable@vger.kernel.org
> Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> Link: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-6-df1de70348b6@kernel.org
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  net/mptcp/protocol.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
> index eb5ade30f1a31..8e67f3ef8cac6 100644
> --- a/net/mptcp/protocol.c
> +++ b/net/mptcp/protocol.c
> @@ -3302,6 +3302,7 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
>  
>  static int mptcp_disconnect(struct sock *sk, int flags)
>  {
> +	struct inet_connection_sock *icsk = inet_csk(sk);
>  	struct mptcp_sock *msk = mptcp_sk(sk);
>  
>  	/* We are on the fastopen error path. We can't call straight into the
> @@ -3314,8 +3315,13 @@ static int mptcp_disconnect(struct sock *sk, int flags)
>  	mptcp_check_listen_stop(sk);
>  	mptcp_set_state(sk, TCP_CLOSE);
>  
> -	mptcp_stop_rtx_timer(sk);
> -	mptcp_stop_tout_timer(sk);
> +	/* The later subflow close can not kick again the tout timer,
> +	 * as the msk is already in closed status.
> +	 */
> +	msk->timer_ival = icsk->icsk_rto_min;

Because commit ea4eb2adb0d3 ("mptcp: honour configured min/max RTO in
retransmit paths") is not in this version, this line should be adapted to:

  msk->timer_ival = TCP_RTO_MIN;

(Before commit ea4eb2adb0d3, icsk->icsk_rto_min is not initialised)

Just to avoid a deadlock, do you plan to send a v2 for that, or do you
prefer someone else doing so?

I can send a patch to fix v6.18 and v7.2. The patch has been dropped
from the v6.12 queue. I can send a fixed version for that one too.

Also, a more general question, when you resolve these conflicts, do you
expect an explicit Acked-by? I tend not to send them on backports, I
only react when I think something is wrong, but maybe that's not what
the stable team is expecting?

> +	sk_stop_timer_sync(sk, &sk->mptcp_retransmit_timer);
> +	icsk->icsk_mtup.probe_timestamp = 0;
> +	sk_stop_timer_sync(sk, &icsk->mptcp_tout_timer);
>  
>  	mptcp_pm_connection_closed(msk);
>  

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.