Patch "tcp: ensure PMTU updates are processed during fastopen" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tcp: ensure PMTU updates are processed during fastopen

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit abcf892aa695e18bd8c3c1ddc842023044077bc8
Author: Jakub Kicinski <kuba@xxxxxxxxxx>
Date:   Mon Mar 21 09:59:57 2022 -0700

    tcp: ensure PMTU updates are processed during fastopen
    
    [ Upstream commit ed0c99dc0f499ff8b6e75b5ae6092ab42be1ad39 ]
    
    tp->rx_opt.mss_clamp is not populated, yet, during TFO send so we
    rise it to the local MSS. tp->mss_cache is not updated, however:
    
    tcp_v6_connect():
      tp->rx_opt.mss_clamp = IPV6_MIN_MTU - headers;
      tcp_connect():
         tcp_connect_init():
           tp->mss_cache = min(mtu, tp->rx_opt.mss_clamp)
         tcp_send_syn_data():
           tp->rx_opt.mss_clamp = tp->advmss
    
    After recent fixes to ICMPv6 PTB handling we started dropping
    PMTU updates higher than tp->mss_cache. Because of the stale
    tp->mss_cache value PMTU updates during TFO are always dropped.
    
    Thanks to Wei for helping zero in on the problem and the fix!
    
    Fixes: c7bb4b89033b ("ipv6: tcp: drop silly ICMPv6 packet too big messages")
    Reported-by: Andre Nash <alnash@xxxxxx>
    Reported-by: Neil Spring <ntspring@xxxxxx>
    Reviewed-by: Wei Wang <weiwan@xxxxxxxxxx>
    Acked-by: Yuchung Cheng <ycheng@xxxxxxxxxx>
    Acked-by: Martin KaFai Lau <kafai@xxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220321165957.1769954-1-kuba@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 0492f6942778..369752f5f676 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3734,6 +3734,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
  */
 static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
 {
+	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct tcp_fastopen_request *fo = tp->fastopen_req;
 	int space, err = 0;
@@ -3748,8 +3749,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
 	 * private TCP options. The cost is reduced data space in SYN :(
 	 */
 	tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp);
+	/* Sync mss_cache after updating the mss_clamp */
+	tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
 
-	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
+	space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) -
 		MAX_TCP_OPTION_SPACE;
 
 	space = min_t(size_t, space, fo->size);