From 5f009b83d2e3d6939ebd392a6aa804dca1533837 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 20 May 2026 18:15:24 +0200 Subject: [PATCH] 6.12-stable patches added patches: mptcp-pm-add_addr-rtx-fix-potential-data-race.patch mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch --- ...add_addr-rtx-fix-potential-data-race.patch | 56 +++++++++++++++ ...rtx-resched-blocked-add_addr-quicker.patch | 53 ++++++++++++++ ...l-correctly-retransmit-add_addr-id-0.patch | 71 +++++++++++++++++++ queue-6.12/series | 3 + 4 files changed, 183 insertions(+) create mode 100644 queue-6.12/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch create mode 100644 queue-6.12/mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch create mode 100644 queue-6.12/mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch diff --git a/queue-6.12/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch b/queue-6.12/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch new file mode 100644 index 0000000000..e41eec450a --- /dev/null +++ b/queue-6.12/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch @@ -0,0 +1,56 @@ +From stable+bounces-249294-greg=kroah.com@vger.kernel.org Mon May 18 15:49:30 2026 +From: Sasha Levin +Date: Mon, 18 May 2026 09:46:19 -0400 +Subject: mptcp: pm: ADD_ADDR rtx: fix potential data-race +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Jakub Kicinski , Sasha Levin +Message-ID: <20260518134619.1137523-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit 5cd6e0ad79d2615264f63929f8b457ad97ae550d ] + +This mptcp_pm_add_timer() helper is executed as a timer callback in +softirq context. To avoid any data races, the socket lock needs to be +held with bh_lock_sock(). + +If the socket is in use, retry again soon after, similar to what is done +with the keepalive timer. + +Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-3-fca8091060a4@kernel.org +Signed-off-by: Jakub Kicinski +[ applied hunk to `net/mptcp/pm_netlink.c` instead of `net/mptcp/pm.c` ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -307,6 +307,13 @@ static void mptcp_pm_add_timer(struct ti + if (!entry->addr.id) + return; + ++ bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ /* Try again later. */ ++ sk_reset_timer(sk, timer, jiffies + HZ / 20); ++ goto out; ++ } ++ + if (mptcp_pm_should_add_signal_addr(msk)) { + sk_reset_timer(sk, timer, jiffies + TCP_RTO_MAX / 8); + goto out; +@@ -335,6 +342,7 @@ static void mptcp_pm_add_timer(struct ti + mptcp_pm_subflow_established(msk); + + out: ++ bh_unlock_sock(sk); + __sock_put(sk); + } + diff --git a/queue-6.12/mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch b/queue-6.12/mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch new file mode 100644 index 0000000000..bc81f98097 --- /dev/null +++ b/queue-6.12/mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch @@ -0,0 +1,53 @@ +From stable+bounces-249436-greg=kroah.com@vger.kernel.org Tue May 19 03:27:39 2026 +From: Sasha Levin +Date: Mon, 18 May 2026 21:23:11 -0400 +Subject: mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Jakub Kicinski , Sasha Levin +Message-ID: <20260519012311.2020532-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit 3cf12492891c4b5ff54dda404a2de4ec54c9e1b5 ] + +When an ADD_ADDR needs to be retransmitted and another one has already +been prepared -- e.g. multiple ADD_ADDRs have been sent in a row and +need to be retransmitted later -- this additional retransmission will +need to wait. + +In this case, the timer was reset to TCP_RTO_MAX / 8, which is ~15 +seconds. This delay is unnecessary long: it should just be rescheduled +at the next opportunity, e.g. after the retransmission timeout. + +Without this modification, some issues can be seen from time to time in +the selftests when multiple ADD_ADDRs are sent, and the host takes time +to process them, e.g. the "signal addresses, ADD_ADDR timeout" MPTCP +Join selftest, especially with a debug kernel config. + +Note that on older kernels, 'timeout' is not available. It should be +enough to replace it by one second (HZ). + +Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-6-fca8091060a4@kernel.org +Signed-off-by: Jakub Kicinski +[ replaced `TCP_RTO_MAX / 8` with `HZ` ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -315,7 +315,7 @@ static void mptcp_pm_add_timer(struct ti + } + + if (mptcp_pm_should_add_signal_addr(msk)) { +- sk_reset_timer(sk, timer, jiffies + TCP_RTO_MAX / 8); ++ sk_reset_timer(sk, timer, jiffies + HZ); + goto out; + } + diff --git a/queue-6.12/mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch b/queue-6.12/mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch new file mode 100644 index 0000000000..d6556b3bb4 --- /dev/null +++ b/queue-6.12/mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch @@ -0,0 +1,71 @@ +From stable+bounces-249277-greg=kroah.com@vger.kernel.org Mon May 18 15:10:35 2026 +From: Sasha Levin +Date: Mon, 18 May 2026 09:05:24 -0400 +Subject: mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Jakub Kicinski , Sasha Levin +Message-ID: <20260518130524.983282-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit b12014d2d36eaed4e4bec5f1ac7e91110eeb100d ] + +When adding the ADD_ADDR to the list, the address including the IP, port +and ID are copied. On the other hand, when the endpoint corresponds to +the one from the initial subflow, the ID is set to 0, as specified by +the MPTCP protocol. + +The issue is that the ID was reset after having copied the ID in the +ADD_ADDR entry. So the retransmission was done, but using a different ID +than the initial one. + +Fixes: 8b8ed1b429f8 ("mptcp: pm: reuse ID 0 after delete and re-add") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-1-fca8091060a4@kernel.org +Signed-off-by: Jakub Kicinski +[ applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -590,6 +590,8 @@ static void mptcp_pm_create_subflow_or_s + + /* check first for announce */ + if (msk->pm.add_addr_signaled < add_addr_signal_max) { ++ u8 endp_id; ++ + /* due to racing events on both ends we can reach here while + * previous add address is still running: if we invoke now + * mptcp_pm_announce_addr(), that will fail and the +@@ -603,19 +605,20 @@ static void mptcp_pm_create_subflow_or_s + if (!select_signal_address(pernet, msk, &local)) + goto subflow; + ++ /* Special case for ID0: set the correct ID */ ++ endp_id = local.addr.id; ++ if (endp_id == msk->mpc_endpoint_id) ++ local.addr.id = 0; ++ + /* If the alloc fails, we are on memory pressure, not worth + * continuing, and trying to create subflows. + */ + if (!mptcp_pm_alloc_anno_list(msk, &local.addr)) + return; + +- __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); ++ __clear_bit(endp_id, msk->pm.id_avail_bitmap); + msk->pm.add_addr_signaled++; + +- /* Special case for ID0: set the correct ID */ +- if (local.addr.id == msk->mpc_endpoint_id) +- local.addr.id = 0; +- + mptcp_pm_announce_addr(msk, &local.addr, false); + mptcp_pm_nl_addr_send_ack(msk); + diff --git a/queue-6.12/series b/queue-6.12/series index 2d368041ed..5b07ea1db2 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -661,3 +661,6 @@ f2fs-fix-incorrect-file-address-mapping-when-inline-inode-is-unwritten.patch f2fs-fix-false-alarm-of-lockdep-on-cp_global_sem-lock.patch spi-sifive-simplify-clock-handling-with-devm_clk_get_enabled.patch spi-sifive-fix-controller-deregistration.patch +mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch +mptcp-pm-add_addr-rtx-fix-potential-data-race.patch +mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch -- 2.47.3