mptcp: Fix conflicts between MPTCP and sockmap

The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces.
'''
tcp_rcv_state_process()
syn_recv_sock()/subflow_syn_recv_sock()

    tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
      bpf_skops_established       <== sockops
        bpf_sock_map_update(sk)   <== call bpf helper
          tcp_bpf_update_proto()  <== update sk_prot

'''

When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. '''
subflow_syn_recv_sock()
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''

Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops.

This fix uses the more generic sk_family for the comparison instead.

Additionally, this also prevents a WARNING from occurring:

result from ./scripts/decode_stacktrace.sh:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
(net/mptcp/protocol.c:4005)
Modules linked in:

...

PKRU: 55555554

Call Trace:
<TASK>

do_accept (net/socket.c:1989)
__sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067)
x64_sys_call (arch/x86/entry/syscall_64.c:41)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

RIP: 0033:0x7f87ac92b83d

---[ end trace 0000000000000000 ]---

Fixes cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections")

please remove the 'net,' prefix from the title. And maybe good to mention 'sockmap', e.g.

mptcp: fix proto fallback detection with sockmap

Cc <[email protected]>

Signed-off-by Jiayuan Chen <[email protected]>

Reviewed-by Jakub Sitnicki <[email protected]>

Reviewed-by Matthieu Baerts (NGI0) <[email protected]>

Add test cases to verify that when MPTCP falls back to plain TCP sockets, they can properly work with sockmap.

Additionally, add test cases to ensure that sockmap correctly rejects MPTCP sockets as expected.

tools/testing/selftests/bpf/prog_tests/mptcp.c +29 -0

  #include "cgroup_helpers.h"
  #include "network_helpers.h"
+#include "socket_helpers.h"
  #include "mptcp_sock.skel.h"
  #include "mptcpify.skel.h"
  #include "mptcp_subflow.skel.h"
+#include "mptcp_sockmap.skel.h"
 
  #define NS_TEST "mptcp_ns"
  #define ADDR_1	"10.0.1.1"

@@ -436,6 +439,142 @@ static void test_subflow(void)
  	close(cgroup_fd);
  }
 
+/* Test sockmap on MPTCP server handling non-mp-capable clients. */
+static void test_sockmap_with_mptcp_fallback(struct mptcp_sockmap *skel)
+{
+	int listen_fd = -1, client_fd1 = -1, client_fd2 = -1;
+	int server_fd1 = -1, server_fd2 = -1, sent, recvd;
+	char snd[9] = "123456789";
+	char rcv[10];
+
+	/* start server with MPTCP enabled */
+	listen_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
+	if (!ASSERT_OK_FD(listen_fd, "sockmap-fb:start_mptcp_server"))
+		return;
+
+	skel->bss->trace_port = ntohs(get_socket_local_port(listen_fd));
+	skel->bss->sk_index = 0;
+	/* create client without MPTCP enabled */
+	client_fd1 = connect_to_fd_opts(listen_fd, NULL);
+	if (!ASSERT_OK_FD(client_fd1, "sockmap-fb:connect_to_fd"))
+		goto end;
+
+	server_fd1 = xaccept_nonblock(listen_fd, NULL, NULL);
+	skel->bss->sk_index = 1;
+	client_fd2 = connect_to_fd_opts(listen_fd, NULL);
+	if (!ASSERT_OK_FD(client_fd2, "sockmap-fb:connect_to_fd"))
+		goto end;
+
+	server_fd2 = xaccept_nonblock(listen_fd, NULL, NULL);

tools/testing/selftests/bpf/prog_tests/mptcp.c +3 -0

+	server_fd = xaccept_nonblock(listen_fd, NULL, NULL);
+	err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map),
+				  &zero, &server_fd, BPF_NOEXIST);

tools/testing/selftests/bpf/prog_tests/mptcp.c

Quoted 12 lines

tools/testing/selftests/bpf/prog_tests/mptcp.c +0 -0

 index f8eb7f9d4fd2..b976fe626343 100644
 --- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
 +++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
 @@ -6,11 +6,14 @@
 #include <netinet/in.h>
 #include <test_progs.h>
 #include <unistd.h>
 +#include <error.h>

I changed to errno.h to be specific. I think you only need the values of an errno here.

Quoted 42 lines

#include "cgroup_helpers.h"
#include "network_helpers.h"
+#include "socket_helpers.h"
#include "mptcp_sock.skel.h"
#include "mptcpify.skel.h"
#include "mptcp_subflow.skel.h"
+#include "mptcp_sockmap.skel.h"

Quoted 1 line

#define NS_TEST "mptcp_ns"

#define ADDR_1 "10.0.1.1"
@@ -436,6 +439,142 @@ static void test_subflow(void) close(cgroup_fd);
}

Quoted 1 line

+/* Test sockmap on MPTCP server handling non-mp-capable clients. */

+static void test_sockmap_with_mptcp_fallback(struct mptcp_sockmap *skel) +{
+ int listen_fd = -1, client_fd1 = -1, client_fd2 = -1;
+ int server_fd1 = -1, server_fd2 = -1, sent, recvd;
+ char snd[9] = "123456789";
+ char rcv[10];
+
+ /* start server with MPTCP enabled */
+ listen_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
+ if (!ASSERT_OK_FD(listen_fd, "sockmap-fb:start_mptcp_server"))
+ return;
+
+ skel->bss->trace_port = ntohs(get_socket_local_port(listen_fd));
+ skel->bss->sk_index = 0;
+ /* create client without MPTCP enabled */
+ client_fd1 = connect_to_fd_opts(listen_fd, NULL);
+ if (!ASSERT_OK_FD(client_fd1, "sockmap-fb:connect_to_fd"))
+ goto end;
+
+ server_fd1 = xaccept_nonblock(listen_fd, NULL, NULL);
+ skel->bss->sk_index = 1;
+ client_fd2 = connect_to_fd_opts(listen_fd, NULL);
+ if (!ASSERT_OK_FD(client_fd2, "sockmap-fb:connect_to_fd"))
+ goto end;
+
+ server_fd2 = xaccept_nonblock(listen_fd, NULL, NULL);
+ /* test normal redirect behavior: data sent by client_fd1 can be
+ * received by client_fd2

Quoted 9 lines

+ */
+ skel->bss->redirect_idx = 1;
+ sent = xsend(client_fd1, snd, sizeof(snd), 0);
+ if (!ASSERT_EQ(sent, sizeof(snd), "sockmap-fb:xsend(client_fd1)"))
+ goto end;
+
+ /* try to recv more bytes to avoid truncation check */
+ recvd = recv_timeout(client_fd2, rcv, sizeof(rcv), MSG_DONTWAIT, 2);

I removed the socket_helpers.h usage. The _nonblock, _timeout, and MSG_DONTWAIT are unnecessary. I replaced them with the regular accept, send, and recv. All fds from network_helpers.c have a default 3s timeout instead of 30s in xaccept_nonblock. This matches how most of the selftests/bpf are doing it as well.

I also touched up the commit message in patch 2 based on Matt's comment.

Applied. Thanks.

tools/testing/selftests/bpf/prog_tests/mptcp.c line 9

Quoted 10 lines

tools/ renamed from tools/testing/selftests/bpf/prog_tests/mptcp.c +0 -0

testing/selftests/bpf/prog_tests/mptcp.c
index f8eb7f9d4fd2..b976fe626343 100644

tools/testing/selftests/bpf/prog_tests/mptcp.c +1 -0

@@ -6,11 +6,14 @@
   #include <netinet/in.h>
   #include <test_progs.h>
   #include <unistd.h>
+#include <error.h>

I changed to errno.h to be specific. I think you only need the values of an errno here.

Quoted 39 lines

tools/testing/selftests/bpf/prog_tests/mptcp.c +2 -0

   #include "cgroup_helpers.h"
   #include "network_helpers.h"
+#include "socket_helpers.h"
   #include "mptcp_sock.skel.h"
   #include "mptcpify.skel.h"
   #include "mptcp_subflow.skel.h"
+#include "mptcp_sockmap.skel.h"
     #define NS_TEST "mptcp_ns"
   #define ADDR_1    "10.0.1.1"

@@ -436,6 +439,142 @@ static void test_subflow(void)
       close(cgroup_fd);
   }

  +/* Test sockmap on MPTCP server handling non-mp-capable clients. */

tools/testing/selftests/bpf/prog_tests/mptcp.c +26 -0

+static void test_sockmap_with_mptcp_fallback(struct mptcp_sockmap *skel)
+{
+    int listen_fd = -1, client_fd1 = -1, client_fd2 = -1;
+    int server_fd1 = -1, server_fd2 = -1, sent, recvd;
+    char snd[9] = "123456789";
+    char rcv[10];
+
+    /* start server with MPTCP enabled */
+    listen_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
+    if (!ASSERT_OK_FD(listen_fd, "sockmap-fb:start_mptcp_server"))
+        return;
+
+    skel->bss->trace_port = ntohs(get_socket_local_port(listen_fd));
+    skel->bss->sk_index = 0;
+    /* create client without MPTCP enabled */
+    client_fd1 = connect_to_fd_opts(listen_fd, NULL);
+    if (!ASSERT_OK_FD(client_fd1, "sockmap-fb:connect_to_fd"))
+        goto end;
+
+    server_fd1 = xaccept_nonblock(listen_fd, NULL, NULL);
+    skel->bss->sk_index = 1;
+    client_fd2 = connect_to_fd_opts(listen_fd, NULL);
+    if (!ASSERT_OK_FD(client_fd2, "sockmap-fb:connect_to_fd"))
+        goto end;
+
+    server_fd2 = xaccept_nonblock(listen_fd, NULL, NULL);

tools/testing/selftests/bpf/prog_tests/mptcp.c static void test_subflow(void) · line 478

Quoted 10 lines

tools/testing/selftests/bpf/prog_tests/mptcp.c +10 -0

+    /* test normal redirect behavior: data sent by client_fd1 can be
+     * received by client_fd2
+     */
+    skel->bss->redirect_idx = 1;
+    sent = xsend(client_fd1, snd, sizeof(snd), 0);
+    if (!ASSERT_EQ(sent, sizeof(snd), "sockmap-fb:xsend(client_fd1)"))
+        goto end;
+
+    /* try to recv more bytes to avoid truncation check */
+    recvd = recv_timeout(client_fd2, rcv, sizeof(rcv), MSG_DONTWAIT, 2);

I removed the socket_helpers.h usage. The _nonblock, _timeout, and MSG_DONTWAIT are unnecessary. I replaced them with the regular accept, send, and recv. All fds from network_helpers.c have a default 3s timeout instead of 30s in xaccept_nonblock. This matches how most of the selftests/bpf are doing it as well.

I also touched up the commit message in patch 2 based on Matt's comment.

Applied. Thanks.

Quoted 3 lines

+    server_fd = xaccept_nonblock(listen_fd, NULL, NULL); +    err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map), +                  &zero, &server_fd, BPF_NOEXIST);

Overall, we encountered a warning [1] that can be triggered by running the selftest I provided.

sockmap works by replacing sk_data_ready, recvmsg, sendmsg operations and implementing fast socket-level forwarding logic:
1. Users can obtain file descriptors through userspace socket()/accept() interfaces, then call BPF syscall to perform these replacements.
2. Users can also use the bpf_sock_hash_update helper (in sockops programs) to replace handlers when TCP connections enter ESTABLISHED state (BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB/BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB)

However, when combined with MPTCP, an issue arises: MPTCP creates subflow sk's and performs TCP handshakes, so the BPF program obtains subflow sk's and may incorrectly replace their sk_prot. We need to reject such operations. In patch 1, we set psock_update_sk_prot to NULL in the subflow's custom sk_prot.

Additionally, if the server's listening socket has MPTCP enabled and the client's TCP also uses MPTCP, we should allow the combination of subflow and sockmap. This is because the latest Golang programs have enabled MPTCP for listening sockets by default [2]. For programs already using sockmap, upgrading Golang should not cause sockmap functionality to fail.

Patch 2 prevents the WARNING from occurring.

I think this series can be applied directly in 'net', if that's OK for both of you.

Quoted 2 lines · On Tue, 11 Nov 2025 11:35:04 +0100 Matthieu Baerts wrote:

I think this series can be applied directly in 'net', if that's OK for both of you.

Also no preference here, Martin mentioned he will take it via bpf tomorrow.

Please let us know on the off chance that you have anything that may conflict queued up. These will likely need a week of travel before they reach net in this case.