From 611709b0869e8b0cce2fbfbfc2da00693d27ac2f Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 13 Nov 2025 10:45:14 -0500 Subject: [PATCH] Drop queue-5.15/mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch Signed-off-by: Sasha Levin --- ...s-optimization-in-__mptcp_check_push.patch | 109 ------------------ queue-5.15/series | 1 - 2 files changed, 110 deletions(-) delete mode 100644 queue-5.15/mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch diff --git a/queue-5.15/mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch b/queue-5.15/mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch deleted file mode 100644 index 8fb91889dc..0000000000 --- a/queue-5.15/mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch +++ /dev/null @@ -1,109 +0,0 @@ -From stable+bounces-192087-greg=kroah.com@vger.kernel.org Mon Nov 3 05:15:58 2025 -From: Sasha Levin -Date: Sun, 2 Nov 2025 15:15:50 -0500 -Subject: mptcp: drop bogus optimization in __mptcp_check_push() -To: stable@vger.kernel.org -Cc: Paolo Abeni , Geliang Tang , Mat Martineau , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin -Message-ID: <20251102201550.3588174-1-sashal@kernel.org> - -From: Paolo Abeni - -[ Upstream commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b ] - -Accessing the transmit queue without owning the msk socket lock is -inherently racy, hence __mptcp_check_push() could actually quit early -even when there is pending data. - -That in turn could cause unexpected tx lock and timeout. - -Dropping the early check avoids the race, implicitly relaying on later -tests under the relevant lock. With such change, all the other -mptcp_send_head() call sites are now under the msk socket lock and we -can additionally drop the now unneeded annotation on the transmit head -pointer accesses. - -Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") -Cc: stable@vger.kernel.org -Signed-off-by: Paolo Abeni -Reviewed-by: Geliang Tang -Tested-by: Geliang Tang -Reviewed-by: Mat Martineau -Signed-off-by: Matthieu Baerts (NGI0) -Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org -Signed-off-by: Jakub Kicinski -[ split upstream __subflow_push_pending modification across __mptcp_push_pending and __mptcp_subflow_push_pending ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - net/mptcp/protocol.c | 13 +++++-------- - net/mptcp/protocol.h | 2 +- - 2 files changed, 6 insertions(+), 9 deletions(-) - ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -1137,7 +1137,7 @@ static void __mptcp_clean_una(struct soc - if (WARN_ON_ONCE(!msk->recovery)) - break; - -- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); -+ msk->first_pending = mptcp_send_next(sk); - } - - dfrag_clear(sk, dfrag); -@@ -1674,7 +1674,7 @@ void __mptcp_push_pending(struct sock *s - - mptcp_update_post_push(msk, dfrag, ret); - } -- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); -+ msk->first_pending = mptcp_send_next(sk); - } - - /* at this point we held the socket lock for the last subflow we used */ -@@ -1732,7 +1732,7 @@ static void __mptcp_subflow_push_pending - - mptcp_update_post_push(msk, dfrag, ret); - } -- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); -+ msk->first_pending = mptcp_send_next(sk); - } - - out: -@@ -1850,7 +1850,7 @@ static int mptcp_sendmsg(struct sock *sk - get_page(dfrag->page); - list_add_tail(&dfrag->list, &msk->rtx_queue); - if (!msk->first_pending) -- WRITE_ONCE(msk->first_pending, dfrag); -+ msk->first_pending = dfrag; - } - pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk, - dfrag->data_seq, dfrag->data_len, dfrag->already_sent, -@@ -2645,7 +2645,7 @@ static void __mptcp_clear_xmit(struct so - struct mptcp_sock *msk = mptcp_sk(sk); - struct mptcp_data_frag *dtmp, *dfrag; - -- WRITE_ONCE(msk->first_pending, NULL); -+ msk->first_pending = NULL; - list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list) - dfrag_clear(sk, dfrag); - } -@@ -3114,9 +3114,6 @@ void __mptcp_data_acked(struct sock *sk) - - void __mptcp_check_push(struct sock *sk, struct sock *ssk) - { -- if (!mptcp_send_head(sk)) -- return; -- - if (!sock_owned_by_user(sk)) { - struct sock *xmit_ssk = mptcp_subflow_get_send(mptcp_sk(sk)); - ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -325,7 +325,7 @@ static inline struct mptcp_data_frag *mp - { - const struct mptcp_sock *msk = mptcp_sk(sk); - -- return READ_ONCE(msk->first_pending); -+ return msk->first_pending; - } - - static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk) diff --git a/queue-5.15/series b/queue-5.15/series index ea7d4ea917..fc35736ecc 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -36,7 +36,6 @@ ravb-exclude-gptp-feature-support-for-rz-g2l.patch net-ravb-enforce-descriptor-type-ordering.patch can-gs_usb-increase-max-interface-to-u8_max.patch net-phy-dp83867-disable-eee-support-as-not-implemented.patch -mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch x86-resctrl-fix-miscount-of-bandwidth-event-when-reactivating-previously-unavailable-rmid.patch xhci-dbc-provide-sysfs-option-to-configure-dbc-descriptors.patch xhci-dbc-poll-at-different-rate-depending-on-data-transfer-activity.patch -- 2.47.3