With TCP Fast Open on an MPTCP listener, if the server application writes data while the passive subflow is still in SYN_RECV (after consuming the client's SYN data but before the MP_CAPABLE third ACK arrives), __mptcp_subflow_active() refuses transmission and the data is queued into the msk write queue. When the MPC third ACK arrives, the subflow transitions to TCP_ESTABLISHED and is marked fully established in check_fully_established(), but because the third ACK carries no DSS data, the queued bytes remain stranded until the peer sends more data. Fix this in check_fully_established() by checking if the subflow was doing passive TFO (subflow->is_mptfo). Under mptcp_data_lock(), flush queued bytes via __mptcp_check_push() and clear is_mptfo. Reported-by: Petar Sakic Closes: https://lore.kernel.org/netdev/CAFPPu1gU2Y-D+d4i3F0MoNkYK+e1U+=X3qf6QycjfKBw+8snPg@mail.gmail.com/ Fixes: fb7084501a61 ("mptcp: add support for TCP_FASTOPEN sockopt") Signed-off-by: T S Rameshkumar --- v2 -> v3: - Move the push and is_mptfo reset directly into check_fully_established() under mptcp_data_lock(), avoiding any potential race in subflow_state_change() which could clear is_mptfo before check_fully_established() processes the 3rd ACK. v1 -> v2: - Use __mptcp_check_push() under mptcp_data_lock() instead of mptcp_push_pending(). net/mptcp/options.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index ce0de02f5..b865ee6af 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -1042,6 +1042,15 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, mptcp_data_lock((struct sock *)msk); __mptcp_subflow_fully_established(msk, subflow, mp_opt); + /* Passive TFO: the application may have written data while the + * subflow was still in SYN_RECV; __mptcp_subflow_active() refused + * it then and nothing else spools the msk write queue when the + * MPC third ack (no DSS) arrives. Push it now. + */ + if (subflow->is_mptfo) { + subflow->is_mptfo = 0; + __mptcp_check_push((struct sock *)msk, ssk); + } mptcp_data_unlock((struct sock *)msk); check_notify: -- 2.34.1