lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 21 Sep 2020 16:57:58 +0200
From:   Matthieu Baerts <>
To:     Mat Martineau <>,
        Matthieu Baerts <>,
        "David S. Miller" <>,
        Jakub Kicinski <>
Cc:     Paolo Abeni <>,,,
Subject: [PATCH net-next v3] mptcp: Wake up MPTCP worker when DATA_FIN found on a TCP FIN packet

From: Mat Martineau <>

When receiving a DATA_FIN MPTCP option on a TCP FIN packet, the DATA_FIN
information would be stored but the MPTCP worker did not get
scheduled. In turn, the MPTCP socket state would remain in
TCP_ESTABLISHED and no blocked operations would be awakened.

TCP FIN packets are seen by the MPTCP socket when moving skbs out of the
subflow receive queues, so schedule the MPTCP worker when a skb with
DATA_FIN but no data payload is moved from a subflow queue. Other cases
(DATA_FIN on a bare TCP ACK or on a packet with data payload) are
already handled.

Fixes: 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine")
Acked-by: Paolo Abeni <>
Signed-off-by: Mat Martineau <>
Signed-off-by: Matthieu Baerts <>

    This is a resend of v1 and v2 with the same code modification. The
    previous versions did not get delivered to but did go
    to other recipients. There is a known issue with the SMTP server on
    the Intel side. Sorry for the multiple versions.
    The only modifications compared to v1 and v2 are in the commit message:
    - Paolo's ACK is back: it was accidentaly dropped.
    - My SOB is at the end, being the new sender of this patch from Mat.

 net/mptcp/subflow.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 34d6230df017..31316cfeb4d0 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -733,7 +733,7 @@ static enum mapping_status get_mapping_status(struct sock *ssk,
 	if (mpext->data_fin == 1) {
 		if (data_len == 1) {
-			mptcp_update_rcv_data_fin(msk, mpext->data_seq);
+			bool updated = mptcp_update_rcv_data_fin(msk, mpext->data_seq);
 			pr_debug("DATA_FIN with no payload seq=%llu", mpext->data_seq);
 			if (subflow->map_valid) {
 				/* A DATA_FIN might arrive in a DSS
@@ -744,6 +744,9 @@ static enum mapping_status get_mapping_status(struct sock *ssk,
 				skb_ext_del(skb, SKB_EXT_MPTCP);
 				return MAPPING_OK;
 			} else {
+				if (updated && schedule_work(&msk->work))
+					sock_hold((struct sock *)msk);
 				return MAPPING_DATA_FIN;
 		} else {

Powered by blists - more mailing lists