FAILED: patch "[PATCH] mptcp: do not drop partial packets" failed to apply to 6.18-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 50c2d91c5dfa0e465826ec1f8dbad9cdc254bd85
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026052835-evident-dutiful-f601@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 50c2d91c5dfa0e465826ec1f8dbad9cdc254bd85 Mon Sep 17 00:00:00 2001
From: Shardul Bankar <[email protected]>
Date: Fri, 15 May 2026 06:27:32 +0200
Subject: [PATCH] mptcp: do not drop partial packets
When a packet arrives with map_seq < ack_seq < end_seq, the beginning of the packet has already been acknowledged but the end contains new data. Currently the entire packet is dropped as "old data," forcing the sender to retransmit.
Instead, skip the already-acked bytes by adjusting the skb offset and enqueue only the new portion. Update bytes_received and ack_seq to reflect the new data consumed.
A previous attempt at this fix has been sent by Paolo Abeni [1], but had issues [2]: it also added a zero-window check and changed rcv_wnd_sent initialization, which caused test regressions. This version addresses only the partial packet handling without modifying receive window accounting.
net/mptcp/protocol.c +19 -5
@@ -397,12 +397,26 @@ static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb)return false; } -/* old data, keep it simple and drop the whole pkt, sender -* will retransmit as needed, if needed. +/* Completely old data? */ +if (!after64 (MPTCP_SKB_CB (skb)->end_seq, msk->ack_seq)) { +MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_DUPDATA ); +mptcp_drop (sk, skb); +return false; + } + +/* Partial packet: map_seq < ack_seq < end_seq. +* Skip the already-acked bytes and enqueue the new data. */ -MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_DUPDATA ); -mptcp_drop (sk, skb); -return false; + copy_len =MPTCP_SKB_CB (skb)->end_seq - msk->ack_seq; +MPTCP_SKB_CB (skb)->offset += msk->ack_seq -MPTCP_SKB_CB (skb)->map_seq; +MPTCP_SKB_CB (skb)->map_seq += msk->ack_seq - +MPTCP_SKB_CB (skb)->map_seq; + msk->bytes_received += copy_len; +WRITE_ONCE (msk->ack_seq, msk->ack_seq + copy_len); + +skb_set_owner_r (skb, sk); +__skb_queue_tail (&sk->sk_receive_queue, skb); +return true; }static void mptcp_stop_rtx_timer (struct sock *sk)
Sasha Levin
maintainerPATCH 1/3 mptcp: handle first subflow closing consistently
From: Paolo Abeni <[email protected]>
[ Upstream commit 0eeb372deebce6c25b9afc09e35d6c75a744299a ]
Currently, as soon as the PM closes a subflow, the msk stops accepting data from it, even if the TCP socket could be still formally open in the incoming direction, with the notable exception of the first subflow.
The root cause of such behavior is that code currently piggy back two separate semantic on the subflow->disposable bit: the subflow context must be released and that the subflow must stop accepting incoming data.
The first subflow is never disposed, so it also never stop accepting incoming data. Use a separate bit to mark the latter status and set such bit in __mptcp_close_ssk() for all subflows.
Beyond making per subflow behaviour more consistent this will also simplify the next patch.
Stable-dep-of: 50c2d91c5dfa ("mptcp: do not drop partial packets")
--- net/mptcp/protocol.c | 14 +++++++++----- net/mptcp/protocol.h | 3 ++- 2 files changed, 11 insertions(+), 6 deletions(-)
net/mptcp/protocol.c +9 -5
@@ -854,10 +854,10 @@ void mptcp_data_ready(struct sock *sk, struct sock *ssk)struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk);/* The peer can send data while we are shutting down this -* subflow at msk destruction time, but we must avoid enqueuing +* subflow at subflow destruction time, but we must avoid enqueuing * more data to the msk receive queue */ -if (unlikely (subflow->disposable)) +if (unlikely (subflow->closing))return ;mptcp_data_lock (sk);
@@ -2455,6 +2455,13 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,struct mptcp_sock *msk =mptcp_sk (sk);bool dispose_it, need_push = false; +/* Do not pass RX data to the msk, even if the subflow socket is not +* going to be freed (i.e. even for the first subflow on graceful +* subflow close. +*/ +lock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); + subflow->closing =1 ; +/* If the first subflow moved to a close state before accept, e.g. due * to an incoming reset or listener shutdown, the subflow socket is * already deleted by inet_child_forget() and the mptcp socket can't
@@ -2465,7 +2472,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,/* ensure later check in mptcp_worker() will dispose the msk */ sock_set_flag (sk,SOCK_DEAD );mptcp_set_close_tout (sk, tcp_jiffies32 - (mptcp_close_timeout (sk) +1 )); -lock_sock_nested (ssk,SINGLE_DEPTH_NESTING );mptcp_subflow_drop_ctx (ssk); goto out_release; }
@@ -2474,8 +2480,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,if (dispose_it)list_del (&subflow->node); -lock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); -if (subflow->send_fastclose && ssk->sk_state !=TCP_CLOSE )tcp_set_state (ssk,TCP_CLOSE );
net/mptcp/protocol.h +2 -1
@@ -537,12 +537,13 @@ struct mptcp_subflow_context { send_infinite_map : 1, remote_key_valid : 1, /* received the peer key from */ disposable : 1, /* ctx can be free at ulp release time */ + closing : 1, /* must not pass rx data to msk anymore */ stale : 1, /* unable to snd/rcv data, do not use for xmit */ valid_csum_seen : 1, /* at least one csum validated */ is_mptfo : 1, /* subflow is doing TFO */ close_event_done : 1, /* has done the post-closed part */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */ - __unused : 9; + __unused : 8;bool data_avail;bool scheduled;bool pm_listener;/* a listener managed by the kernel PM? */
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 mptcp: borrow forward memory from subflow
From: Paolo Abeni <[email protected]>
[ Upstream commit 9db5b3cec4ec1c0cd3239689f5c8653d691a1754 ]
In the MPTCP receive path, we release the subflow allocated fwd memory just to allocate it again shortly after for the msk.
That could increases the failures chances, especially when we will add backlog processing, with other actions could consume the just released memory before the msk socket has a chance to do the rcv allocation.
Replace the skb_orphan() call with an open-coded variant that explicitly borrows, the fwd memory from the subflow socket instead of releasing it.
The borrowed memory does not have PAGE_SIZE granularity; rounding to the page size will make the fwd allocated memory higher than what is strictly required and could make the incoming subflow fwd mem consistently negative. Instead, keep track of the accumulated frag and borrow the full page at subflow close time.
This allow removing the last drop in the TCP to MPTCP transition and the associated, now unused, MIB.
Stable-dep-of: 50c2d91c5dfa ("mptcp: do not drop partial packets")
--- net/mptcp/fastopen.c | 4 +++- net/mptcp/mib.c | 1 - net/mptcp/mib.h | 1 - net/mptcp/protocol.c | 23 +++++++++++++++-------- net/mptcp/protocol.h | 28 ++++++++++++++++++++++++++++ 5 files changed, 46 insertions(+), 11 deletions(-)
net/mptcp/fastopen.c +3 -1
@@ -33,7 +33,8 @@ void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subf/* dequeue the skb from sk receive queue */ __skb_unlink (skb, &ssk->sk_receive_queue);skb_ext_reset (skb); -skb_orphan (skb); + +mptcp_subflow_lend_fwdmem (subflow, skb);/* We copy the fastopen data, but that don't belong to the mptcp sequence * space, need to offset it in the subflow sequence, see mptcp_subflow_get_map_offset()
@@ -52,6 +53,7 @@ void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subfmptcp_data_lock (sk);DEBUG_NET_WARN_ON_ONCE (sock_owned_by_user_nocheck (sk)); +mptcp_borrow_fwdmem (sk, skb);skb_set_owner_r (skb, sk);__skb_queue_tail (&sk->sk_receive_queue, skb);mptcp_sk (sk)->bytes_received += skb->len;
net/mptcp/mib.c +0 -1
@@ -71,7 +71,6 @@ static const struct snmp_mib mptcp_snmp_list[] = {SNMP_MIB_ITEM ("MPFastcloseRx" ,MPTCP_MIB_MPFASTCLOSERX ),SNMP_MIB_ITEM ("MPRstTx" ,MPTCP_MIB_MPRSTTX ),SNMP_MIB_ITEM ("MPRstRx" ,MPTCP_MIB_MPRSTRX ), -SNMP_MIB_ITEM ("RcvPruned" ,MPTCP_MIB_RCVPRUNED ),SNMP_MIB_ITEM ("SubflowStale" ,MPTCP_MIB_SUBFLOWSTALE ),SNMP_MIB_ITEM ("SubflowRecover" ,MPTCP_MIB_SUBFLOWRECOVER ), SNMP_MIB_ITEM("SndWndShared", MPTCP_MIB_SNDWNDSHARED),
net/mptcp/mib.h +0 -1
@@ -70,7 +70,6 @@ enum linux_mptcp_mib_field {MPTCP_MIB_MPFASTCLOSERX ,/* Received a MP_FASTCLOSE */ MPTCP_MIB_MPRSTTX ,/* Transmit a MP_RST */ MPTCP_MIB_MPRSTRX ,/* Received a MP_RST */ -MPTCP_MIB_RCVPRUNED ,/* Incoming packet dropped due to memory limit */ MPTCP_MIB_SUBFLOWSTALE ,/* Subflows entered 'stale' status */ MPTCP_MIB_SUBFLOWRECOVER ,/* Subflows returned to active status after being stale */ MPTCP_MIB_SNDWNDSHARED, /* Subflow snd wnd is overridden by msk's one */
net/mptcp/protocol.c +15 -8
@@ -352,7 +352,7 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *msk, struct sk_buff *skb)static void mptcp_init_skb (struct sock *ssk,struct sk_buff *skb,int offset,int copy_len) { -const struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk); +struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk);bool has_rxtstamp =TCP_SKB_CB (skb)->has_rxtstamp;/* the skb map_seq accounts for the skb offset:
@@ -377,11 +377,7 @@ static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb)struct mptcp_sock *msk =mptcp_sk (sk);struct sk_buff *tail; -/* try to fetch required memory from subflow */ -if (!sk_rmem_schedule (sk, skb, skb->truesize)) { -MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_RCVPRUNED ); - goto drop; - } +mptcp_borrow_fwdmem (sk, skb);if (MPTCP_SKB_CB (skb)->map_seq == msk->ack_seq) {/* in sequence */
@@ -403,7 +399,6 @@ static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb)* will retransmit as needed, if needed. */ MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_DUPDATA ); -drop:mptcp_drop (sk, skb);return false; }
@@ -704,7 +699,7 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,size_t len = skb->len - offset;mptcp_init_skb (ssk, skb, offset, len); -skb_orphan (skb); +mptcp_subflow_lend_fwdmem (subflow, skb); ret =__mptcp_move_skb (sk, skb) || ret; seq += len;
@@ -2454,6 +2449,7 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, {struct mptcp_sock *msk =mptcp_sk (sk);bool dispose_it, need_push = false; +int fwd_remaining;/* Do not pass RX data to the msk, even if the subflow socket is not * going to be freed (i.e. even for the first subflow on graceful
@@ -2462,6 +2458,17 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,lock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); subflow->closing =1 ; +/* Borrow the fwd allocated page left-over; fwd memory for the subflow +* could be negative at this point, but will be reach zero soon - when +* the data allocated using such fragment will be freed. +*/ +if (subflow->lent_mem_frag) { + fwd_remaining =PAGE_SIZE - subflow->lent_mem_frag; +sk_forward_alloc_add (sk, fwd_remaining); +sk_forward_alloc_add (ssk, -fwd_remaining); + subflow->lent_mem_frag =0 ; + } +/* If the first subflow moved to a close state before accept, e.g. due * to an incoming reset or listener shutdown, the subflow socket is * already deleted by inet_child_forget() and the mptcp socket can't
net/mptcp/protocol.h +28 -0
@@ -548,6 +548,7 @@ struct mptcp_subflow_context {bool scheduled;bool pm_listener;/* a listener managed by the kernel PM? */ bool fully_established;/* path validated */ +u32 lent_mem_frag;u32 remote_nonce;u64 thmac;u32 local_nonce;
@@ -647,6 +648,33 @@ mptcp_send_active_reset_reason(struct sock *sk)tcp_send_active_reset (sk,GFP_ATOMIC , reason); } +/* Made the fwd mem carried by the given skb available to the msk, +* To be paired with a previous mptcp_subflow_lend_fwdmem() before freeing +* the skb or setting the skb ownership. +*/ +static inline void mptcp_borrow_fwdmem (struct sock *sk,struct sk_buff *skb) +{ +struct sock *ssk = skb->sk; + +/* The subflow just lend the skb fwd memory, and we know that the skb +* is only accounted on the incoming subflow rcvbuf. +*/ +DEBUG_NET_WARN_ON_ONCE (skb->destructor); + skb->sk =NULL ; +sk_forward_alloc_add (sk, skb->truesize); +atomic_sub (skb->truesize, &ssk->sk_rmem_alloc); +} + +static inline void +mptcp_subflow_lend_fwdmem (struct mptcp_subflow_context *subflow, +struct sk_buff *skb) +{ +int frag = (subflow->lent_mem_frag + skb->truesize) & (PAGE_SIZE -1 ); + + skb->destructor =NULL ; + subflow->lent_mem_frag = frag; +} +static inline u64 mptcp_subflow_get_map_offset (const struct mptcp_subflow_context *subflow) {
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 mptcp: do not drop partial packets
In reply to Sasha LevinFrom: Shardul Bankar <[email protected]>
[ Upstream commit 50c2d91c5dfa0e465826ec1f8dbad9cdc254bd85 ]
When a packet arrives with map_seq < ack_seq < end_seq, the beginning of the packet has already been acknowledged but the end contains new data. Currently the entire packet is dropped as "old data," forcing the sender to retransmit.
Instead, skip the already-acked bytes by adjusting the skb offset and enqueue only the new portion. Update bytes_received and ack_seq to reflect the new data consumed.
A previous attempt at this fix has been sent by Paolo Abeni [1], but had issues [2]: it also added a zero-window check and changed rcv_wnd_sent initialization, which caused test regressions. This version addresses only the partial packet handling without modifying receive window accounting.
--- net/mptcp/protocol.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
net/mptcp/protocol.c +19 -5
@@ -395,12 +395,26 @@ static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb)return false; } -/* old data, keep it simple and drop the whole pkt, sender -* will retransmit as needed, if needed. +/* Completely old data? */ +if (!after64 (MPTCP_SKB_CB (skb)->end_seq, msk->ack_seq)) { +MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_DUPDATA ); +mptcp_drop (sk, skb); +return false; + } + +/* Partial packet: map_seq < ack_seq < end_seq. +* Skip the already-acked bytes and enqueue the new data. */ -MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_DUPDATA ); -mptcp_drop (sk, skb); -return false; + copy_len =MPTCP_SKB_CB (skb)->end_seq - msk->ack_seq; +MPTCP_SKB_CB (skb)->offset += msk->ack_seq -MPTCP_SKB_CB (skb)->map_seq; +MPTCP_SKB_CB (skb)->map_seq += msk->ack_seq - +MPTCP_SKB_CB (skb)->map_seq; + msk->bytes_received += copy_len; +WRITE_ONCE (msk->ack_seq, msk->ack_seq + copy_len); + +skb_set_owner_r (skb, sk); +__skb_queue_tail (&sk->sk_receive_queue, skb); +return true; }static void mptcp_stop_rtx_timer (struct sock *sk)
Signature · 1 line
2.53.0