On 4/20/26 11:24 PM, Jakub Kicinski wrote:
AI says: Your patch "tcp: send a challenge ACK on SEG.ACK > SND.NXT" breaks an existing packetdrill selftest: selftests/net/packetdrill/tcp_ts_recent_invalid_ack.pkt Test output: tcp_ts_recent_invalid_ack.pkt:25: error handling packet: live packet field tcp_ack_seq: expected: 1001 (0x3e9) vs actual: 1 (0x1) script packet: 0.200125 . 1:1(0) ack 1001 <nop,nop,TS val 200 ecr 201> actual packet: 0.200119 . 1:1(0) ack 1 win 65535 <nop,nop,TS val 200 ecr 200> not ok 1 ipv4 not ok 2 ipv6 not ok 3 ipv4-mapped-ipv6 Root cause: The test `tcp_ts_recent_invalid_ack.pkt` sends a FIN+ACK with ACK=9999 (which exceeds SND.NXT=1) to verify that the kernel does not update ts_recent from an invalid packet. Before your patch, this packet was silently dropped. After your patch, the kernel now emits a challenge ACK (SEQ=1, ACK=1) in response to the ACK=9999 segment. The test script does not expect this challenge ACK, so when it subsequently tries to match the expected "ack 1001" response to the following data segment, it instead sees the challenge ACK "ack 1", causing a mismatch on all three address families (ipv4, ipv6, ipv4-mapped-ipv6). Fix: update `tcp_ts_recent_invalid_ack.pkt` to consume the new challenge ACK before checking the response to the subsequent data segment. For example, add after the bad FIN+ACK line: +0 > . 1:1(0) ack 1 so that the challenge ACK is explicitly expected and the rest of the script proceeds as before.
Thanks Jakub, you're right. Will fold the tcp_ts_recent_invalid_ack.pkt update into the kernel fix in v2 to keep bisect clean and makes the backport self-contained.
