This is a note to let you know that I've just added the patch titled mptcp: fix bogus receive window shrinkage with multiple subflows to the 6.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-fix-bogus-receive-window-shrinkage-with-multiple-subflows.patch and it can be found in the queue-6.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 6bec041147a2a64a490d1f813e8a004443061b38 Mon Sep 17 00:00:00 2001 From: Paolo Abeni <pabeni@xxxxxxxxxx> Date: Sat, 16 Sep 2023 12:52:45 +0200 Subject: mptcp: fix bogus receive window shrinkage with multiple subflows From: Paolo Abeni <pabeni@xxxxxxxxxx> commit 6bec041147a2a64a490d1f813e8a004443061b38 upstream. In case multiple subflows race to update the mptcp-level receive window, the subflow losing the race should use the window value provided by the "winning" subflow to update it's own tcp-level rcv_wnd. To such goal, the current code bogusly uses the mptcp-level rcv_wnd value as observed before the update attempt. On unlucky circumstances that may lead to TCP-level window shrinkage, and stall the other end. Address the issue feeding to the rcv wnd update the correct value. Fixes: f3589be0c420 ("mptcp: never shrink offered window") Cc: stable@xxxxxxxxxxxxxxx Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/427 Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Signed-off-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/options.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -1269,12 +1269,13 @@ static void mptcp_set_rwin(struct tcp_so if (rcv_wnd == rcv_wnd_old) break; - if (before64(rcv_wnd_new, rcv_wnd)) { + + rcv_wnd_old = rcv_wnd; + if (before64(rcv_wnd_new, rcv_wnd_old)) { MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDCONFLICTUPDATE); goto raise_win; } MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDCONFLICT); - rcv_wnd_old = rcv_wnd; } return; } Patches currently in stable-queue which might be from pabeni@xxxxxxxxxx are queue-6.5/bnxt_en-flush-xdp-for-bnxt_poll_nitroa0-s-napi.patch queue-6.5/mptcp-fix-bogus-receive-window-shrinkage-with-multiple-subflows.patch queue-6.5/net-hns3-add-cmdq-check-for-vf-periodic-service-task.patch queue-6.5/igc-expose-tx-usecs-coalesce-setting-to-user.patch queue-6.5/octeontx2-pf-do-xdp_do_flush-after-redirects.patch queue-6.5/net-hns3-add-5ms-delay-before-clear-firmware-reset-i.patch queue-6.5/team-fix-null-ptr-deref-when-team-device-type-is-cha.patch queue-6.5/mptcp-move-__mptcp_error_report-in-protocol.c.patch queue-6.5/net-hns3-only-enable-unicast-promisc-when-mac-table-.patch queue-6.5/net-hns3-fix-gre-checksum-offload-issue.patch queue-6.5/net-ena-flush-xdp-packets-on-error.patch queue-6.5/net-hns3-fix-fail-to-delete-tc-flower-rules-during-r.patch queue-6.5/net-bridge-use-dev_stats_inc.patch queue-6.5/mptcp-process-pending-subflow-error-on-close.patch