Skip to contentSkip to conversation

FAILED: patch "[PATCH] mptcp: decrement subflows counter on failed passive join" failed to apply to 5.10-stable tree

PATCH New [email protected] 2 participants 3 messages Jul 29 – Aug 7

Subsystems (3)
Networking Stable branch Networking MPTCP
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x f3ca0ee2cc308e33896536789cbc5f3a12ca7b30
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072945-unsalted-ozone-c2bf@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f3ca0ee2cc308e33896536789cbc5f3a12ca7b30 Mon Sep 17 00:00:00 2001
From: Chenguang Zhao <[email protected]>
Date: Wed, 22 Jul 2026 00:14:38 +0200
Subject: [PATCH] mptcp: decrement subflows counter on failed passive join

mptcp_pm_allow_new_subflow() increments extra_subflows before __mptcp_finish_join() on the passive MP_JOIN path.

In case of race conditions, the subflow is dropped without calling mptcp_close_ssk(), so the counter is not rolled back.

Call mptcp_pm_close_subflow() when the join completion fails to decrement the subflows counter.

Fixes 10f6d46c943d ("mptcp: fix race between MP_JOIN and close")
Cc [email protected]
Signed-off-by Chenguang Zhao <[email protected]>
Reviewed-by Matthieu Baerts (NGI0) <[email protected]>
Signed-off-by Matthieu Baerts (NGI0) <[email protected]>
Link https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-1-6fb595bc86ef@kernel.org open here
Signed-off-by Jakub Kicinski <[email protected]>
net/mptcp/protocol.c +1 -0
index cb9515f505aa..b32f0cd262a7 100644
@@ -3907,6 +3907,7 @@ bool mptcp_finish_join(struct sock *ssk)
 	mptcp_data_unlock(parent);
 
 	if (!ret) {
+		mptcp_pm_close_subflow(msk);
 err_prohibited:
 		subflow->reset_reason = MPTCP_RST_EPROHIBIT;
 		return false;
maintainer
#1 lore raw

PATCH 1/2 mptcp: fix subflow accounting on close

From: Paolo Abeni <[email protected]>

[ Upstream commit 95d686517884a403412b000361cee2b08b2ed1e6 ]

If the PM closes a fully established MPJ subflow or the subflow creation errors out in it's early stage the subflows counter is not bumped accordingly.

This change adds the missing accounting, additionally taking care of updating accordingly the 'accept_subflow' flag.

Fixes a88c9e496937 ("mptcp: do not block subflows creation on errors")
Signed-off-by Paolo Abeni <[email protected]>
Signed-off-by Mat Martineau <[email protected]>
Signed-off-by Jakub Kicinski <[email protected]>

Stable-dep-of: f3ca0ee2cc30 ("mptcp: decrement subflows counter on failed passive join")

Signed-off-by Sasha Levin <[email protected]>
---
 net/mptcp/protocol.h | 14 ++++++++++++++
 net/mptcp/subflow.c  | 12 +++++++++---
 2 files changed, 23 insertions(+), 3 deletions(-)
net/mptcp/protocol.h +14 -0
index 313c8898b3b2c..ac064c44079d7 100644
@@ -498,6 +498,20 @@ void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk, u8 rm_id);
 int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct sock_common *skc);
 bool mptcp_pm_nl_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc);
 
+/* called under PM lock */
+static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk)
+{
+	if (--msk->pm.subflows < msk->pm.subflows_max)
+		WRITE_ONCE(msk->pm.accept_subflow, true);
+}
+
+static inline void mptcp_pm_close_subflow(struct mptcp_sock *msk)
+{
+	spin_lock_bh(&msk->pm.lock);
+	__mptcp_pm_close_subflow(msk);
+	spin_unlock_bh(&msk->pm.lock);
+}
+
 static inline struct mptcp_ext *mptcp_get_ext(struct sk_buff *skb)
 {
 	return (struct mptcp_ext *)skb_ext_find(skb, SKB_EXT_MPTCP);
net/mptcp/subflow.c +9 -3
index 9a8d0d877bd13..b13cd310882d3 100644
@@ -1122,18 +1122,18 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
 	struct sockaddr_storage addr;
 	int remote_id = remote->id;
 	int local_id = loc->id;
+	int err = -ENOTCONN;
 	struct socket *sf;
 	struct sock *ssk;
 	u32 remote_token;
 	int addrlen;
-	int err;
 
 	if (!mptcp_is_fully_established(sk))
-		return -ENOTCONN;
+		goto err_out;
 
 	err = mptcp_subflow_create_socket(sk, &sf);
 	if (err)
-		return err;
+		goto err_out;
 
 	ssk = sf->sk;
 	subflow = mptcp_subflow_ctx(ssk);

@@ -1187,6 +1187,12 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
 
 failed:
 	sock_release(sf);
+
+err_out:
+	/* we account subflows before the creation, and this failures will not
+	 * be caught by sk_state_change()
+	 */
+	mptcp_pm_close_subflow(msk);
 	return err;
 }
Signature · 1 line
2.53.0
maintainer
#2 lore raw

PATCH 2/2 mptcp: decrement subflows counter on failed passive join

From: Chenguang Zhao <[email protected]>

[ Upstream commit f3ca0ee2cc308e33896536789cbc5f3a12ca7b30 ]

mptcp_pm_allow_new_subflow() increments extra_subflows before __mptcp_finish_join() on the passive MP_JOIN path.

In case of race conditions, the subflow is dropped without calling mptcp_close_ssk(), so the counter is not rolled back.

Call mptcp_pm_close_subflow() when the join completion fails to decrement the subflows counter.

Fixes 10f6d46c943d ("mptcp: fix race between MP_JOIN and close")
Cc [email protected]
Signed-off-by Chenguang Zhao <[email protected]>
Reviewed-by Matthieu Baerts (NGI0) <[email protected]>
Signed-off-by Matthieu Baerts (NGI0) <[email protected]>
Link https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-1-6fb595bc86ef@kernel.org open here
Signed-off-by Jakub Kicinski <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
---
 net/mptcp/protocol.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +3 -1
index a9595eb2b5fee..2c6aef813473f 100644
@@ -2663,8 +2663,10 @@ bool mptcp_finish_join(struct sock *sk)
 	if (ret && !WARN_ON_ONCE(!list_empty(&subflow->node)))
 		list_add_tail(&subflow->node, &msk->join_list);
 	spin_unlock_bh(&msk->join_list_lock);
-	if (!ret)
+	if (!ret) {
+		mptcp_pm_close_subflow(msk);
 		return false;
+	}
 
 	/* attach to msk socket only after we are sure he will deal with us
 	 * at close time
Signature · 1 line
2.53.0