[PATCH net v2 2/2] mptcp: avoid wrapping blackhole timeout

[Yingjie Wang <x-professor@outlook.com>]

mptcp_active_should_disable() calculates the active-disable interval as
multiplier * blackhole_timeout * HZ. Since all operands are 32-bit, a
large blackhole_timeout can wrap the delay even on 64-bit kernels and
make active MPTCP available again while the blackhole is still present.

For example, with HZ=1000, a timeout of 6912213 seconds and the maximum
multiplier of 64 should produce 442,381,632,000 jiffies, but the current
calculation truncates it to 512 jiffies.

This issue was found using a static analysis tool. A loopback reproducer
induced 12 MPTCP blackholes and waited 1.2 seconds before opening another
connection. In the v1 arithmetic-only test, the unpatched kernel retried
MP_CAPABLE, while the fixed kernel used TCP fallback directly. The
reproducer required neither kernel modifications nor fault injection.

Compute the interval in u64 and cap it at MAX_JIFFY_OFFSET before adding
it to the saved timestamp. The multiplier remains limited to 64, while
the separate cap keeps the delay within the safe jiffies comparison range
on 32-bit systems. Preserve the existing sysctl input range and backoff
for representable intervals.

On the v2 kernel, the loopback blackhole reproducer completed all 12
clients and the probe used TCP fallback directly instead of retrying
MP_CAPABLE.

Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Cc: stable@vger.kernel.org
Reviewed-by: Gang Yan <yangang@kylinos.cn>
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
---
 net/mptcp/ctrl.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index 63c5747f0f63..0b10e94e7f43 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -487,6 +487,7 @@ bool mptcp_active_should_disable(struct sock *ssk)
 	unsigned long timeout;
 	int disable_times;
 	int multiplier;
+	u64 delay;
 
 	pernet = mptcp_get_pernet(net);
 	blackhole_timeout = READ_ONCE(pernet->blackhole_timeout);
@@ -501,12 +502,17 @@ bool mptcp_active_should_disable(struct sock *ssk)
 	/* Paired with smp_mb__before_atomic() in mptcp_active_disable() */
 	smp_rmb();
 
-	/* Limit timeout to max: 2^6 * initial timeout */
+	/* Limit the backoff multiplier to 64. */
 	multiplier = 1 << min(disable_times - 1, 6);
+	delay = (u64)multiplier * blackhole_timeout * HZ;
 
-	/* Paired with the WRITE_ONCE() in mptcp_active_disable(). */
+	/*
+	 * Cap the delay for safe jiffies comparisons on 32-bit systems.
+	 * The timestamp read is paired with WRITE_ONCE() in
+	 * mptcp_active_disable().
+	 */
 	timeout = READ_ONCE(pernet->active_disable_stamp) +
-		  multiplier * blackhole_timeout * HZ;
+		  min(delay, MAX_JIFFY_OFFSET);
 
 	return time_before(jiffies, timeout);
 }
-- 
2.43.0