mptcp: use tcp_build_frag()

mptcp_push_pending() is called even on orphaned
msk (and orphaned subflows), if there is outstanding
data at close() time.

To cope with the above MPTCP needs to handle explicitly
the allocation failure on xmit. The newly introduced
do_tcp_sendfrag() allows that, just plug it.

We can additionally drop a couple of sanity checks,
duplicate in the TCP code.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index eaa61e22749296be1195a31d11d13b8a004f4eb4..3c68cf912fb87cf8955b7dd0d9d20965cb914a12 100644 (file)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -992,17 +992,13 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
                psize = min_t(size_t, dfrag->data_len, avail_size);
        }
 
-       /* tell the TCP stack to delay the push so that we can safely
-        * access the skb after the sendpages call
-        */
-       ret = do_tcp_sendpages(ssk, page, offset, psize,
-                              msg->msg_flags | MSG_SENDPAGE_NOTLAST | MSG_DONTWAIT);
-       if (ret <= 0) {
-               if (!retransmission)
-                       iov_iter_revert(&msg->msg_iter, psize);
-               return ret;
+       tail = tcp_build_frag(ssk, psize, msg->msg_flags, page, offset, &psize);
+       if (!tail) {
+               tcp_remove_empty_skb(sk, tcp_write_queue_tail(ssk));
+               return -ENOMEM;
        }
 
+       ret = psize;
        frag_truesize += ret;
        if (!retransmission) {
                if (unlikely(ret < psize))
@@ -1026,20 +1022,15 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
                sk->sk_forward_alloc -= frag_truesize;
        }
 
-       /* if the tail skb extension is still the cached one, collapsing
-        * really happened. Note: we can't check for 'same skb' as the sk_buff
-        * hdr on tail can be transmitted, freed and re-allocated by the
-        * do_tcp_sendpages() call
+       /* if the tail skb is still the cached one, collapsing really happened.
         */
-       tail = tcp_write_queue_tail(ssk);
-       if (mpext && tail && mpext == skb_ext_find(tail, SKB_EXT_MPTCP)) {
+       if (skb == tail) {
                WARN_ON_ONCE(!can_collapse);
                mpext->data_len += ret;
                goto out;
        }
 
-       skb = tcp_write_queue_tail(ssk);
-       mpext = __skb_ext_set(skb, SKB_EXT_MPTCP, msk->cached_ext);
+       mpext = __skb_ext_set(tail, SKB_EXT_MPTCP, msk->cached_ext);
        msk->cached_ext = NULL;
 
        memset(mpext, 0, sizeof(*mpext));