Merge branch 'mptcp-misc-fixes-for-v7-3-rc4'

Matthieu Baerts says:

====================
mptcp: misc fixes for v7.3-rc4

Here are two unrelated fixes:

- Patch 1: avoid unneeded actions on subflow reset. A fix for another
  fix introduced in v6.12 and targeting a commit from v5.7.

- Patch 2: close a possible race when scheduling a closing path. A fix
  for another fix introduced in v6.0 and targeting v5.10.

- Patch 3: fix bad accounting when __subflow_push_pending returns an
  error. A fix for v6.6.
====================

Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-09-17 08:14:38 -07:00
commit 3b95a04eb5
3 changed files with 20 additions and 5 deletions

View File

@ -856,12 +856,12 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
mptcp_dss_corruption(msk, ssk);
}
} else {
sk_eat_skb(ssk, skb);
if (unlikely(!fin)) {
DEBUG_NET_WARN_ON_ONCE(1);
mptcp_dss_corruption(msk, ssk);
}
sk_eat_skb(ssk, skb);
}
WRITE_ONCE(tp->copied_seq, seq);
@ -1664,7 +1664,9 @@ struct sock *mptcp_subflow_get_send(struct mptcp_sock *msk)
static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info *info)
{
tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal);
if (info->mss_now)
tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle,
info->size_goal);
release_sock(ssk);
}
@ -1852,7 +1854,8 @@ static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk, bool
ret = __subflow_push_pending(sk, ssk, &info);
if (ret <= 0)
keep_pushing = false;
copied += ret;
else
copied += ret;
}
mptcp_for_each_subflow(msk, subflow) {

View File

@ -585,7 +585,8 @@ struct mptcp_subflow_context {
is_mptfo : 1, /* subflow is doing TFO */
close_event_done : 1, /* has done the post-closed part */
mpc_drop : 1, /* the MPC option has been dropped in a rtx */
__unused : 9;
resetting : 1, /* subflow is resetting */
__unused : 8;
bool data_avail;
bool scheduled;
bool pm_listener; /* a listener managed by the kernel PM? */

View File

@ -438,6 +438,10 @@ void mptcp_subflow_reset(struct sock *ssk)
/* must hold: tcp_done() could drop last reference on parent */
sock_hold(sk);
subflow->resetting = 1;
/* No need to delay the actual close for to-be discarded data. */
__skb_queue_purge(&ssk->sk_receive_queue);
mptcp_send_active_reset_reason(ssk);
tcp_done(ssk);
if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags))
@ -1883,6 +1887,13 @@ static void subflow_state_change(struct sock *sk)
__subflow_state_change(sk);
/* Rx queue processing is unneeded, error reporting will take place at
* __mptcp_close_ssk() time and subflow reset can't happen in case of
* fallback: subflow_sched_work_if_closed() would be a no-op.
*/
if (subflow->resetting)
return;
/* as recvmsg() does not acquire the subflow socket for ssk selection
* a fin packet carrying a DSS can be unnoticed if we don't trigger
* the data available machinery here.