This is a note to let you know that I've just added the patch titled mptcp: fix potential wake-up event loss to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-fix-potential-wake-up-event-loss.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From b111d8fbd2cbc63e05f3adfbbe0d4df655dfcc5b Mon Sep 17 00:00:00 2001 From: Paolo Abeni <pabeni@xxxxxxxxxx> Date: Fri, 23 Feb 2024 17:14:16 +0100 Subject: mptcp: fix potential wake-up event loss From: Paolo Abeni <pabeni@xxxxxxxxxx> commit b111d8fbd2cbc63e05f3adfbbe0d4df655dfcc5b upstream. After the blamed commit below, the send buffer auto-tuning can happen after that the mptcp_propagate_sndbuf() completes - via the delegated action infrastructure. We must check for write space even after such change or we risk missing the wake-up event. Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-6-162e87e48497@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/protocol.h | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -772,6 +772,16 @@ static inline bool mptcp_data_fin_enable READ_ONCE(msk->write_seq) == READ_ONCE(msk->snd_nxt); } +static inline void mptcp_write_space(struct sock *sk) +{ + if (sk_stream_is_writeable(sk)) { + /* pairs with memory barrier in mptcp_poll */ + smp_mb(); + if (test_and_clear_bit(MPTCP_NOSPACE, &mptcp_sk(sk)->flags)) + sk_stream_write_space(sk); + } +} + static inline void __mptcp_sync_sndbuf(struct sock *sk) { struct mptcp_subflow_context *subflow; @@ -790,6 +800,7 @@ static inline void __mptcp_sync_sndbuf(s /* the msk max wmem limit is <nr_subflows> * tcp wmem[2] */ WRITE_ONCE(sk->sk_sndbuf, new_sndbuf); + mptcp_write_space(sk); } /* The called held both the msk socket and the subflow socket locks, @@ -820,16 +831,6 @@ static inline void mptcp_propagate_sndbu local_bh_enable(); } -static inline void mptcp_write_space(struct sock *sk) -{ - if (sk_stream_is_writeable(sk)) { - /* pairs with memory barrier in mptcp_poll */ - smp_mb(); - if (test_and_clear_bit(MPTCP_NOSPACE, &mptcp_sk(sk)->flags)) - sk_stream_write_space(sk); - } -} - void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags); #define MPTCP_TOKEN_MAX_RETRIES 4 Patches currently in stable-queue which might be from pabeni@xxxxxxxxxx are queue-6.6/mptcp-push-at-dss-boundaries.patch queue-6.6/mptcp-fix-snd_wnd-initialization-for-passive-socket.patch queue-6.6/mptcp-fix-potential-wake-up-event-loss.patch queue-6.6/mptcp-fix-possible-deadlock-in-subflow-diag.patch queue-6.6/veth-try-harder-when-allocating-queue-memory.patch queue-6.6/mptcp-avoid-printing-warning-once-on-client-side.patch queue-6.6/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_newlink.patch queue-6.6/net-hsr-use-correct-offset-for-hsr-tlv-values-in-sup.patch