6.18-stable patches

added patches:
	mptcp-avoid-dup-sub_closed-events-after-disconnect.patch

diff --git a/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch b/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch
new file mode 100644 (file)
index 0000000..d587163
--- /dev/null
+++ b/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch
@@ -0,0 +1,56 @@
+From stable+bounces-213291-greg=kroah.com@vger.kernel.org Tue Feb  3 18:40:05 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue,  3 Feb 2026 12:37:17 -0500
+Subject: mptcp: avoid dup SUB_CLOSED events after disconnect
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Marco Angaroni <marco.angaroni@italtel.com>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260203173717.1335686-1-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit 280d654324e33f8e6e3641f76764694c7b64c5db ]
+
+In case of subflow disconnect(), which can also happen with the first
+subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset
+will reset most fields from the mptcp_subflow_context structure,
+including close_event_done. Then, when another subflow is closed, yet
+another SUB_CLOSED event for the disconnected initial subflow is sent.
+Because of the previous reset, there are no source address and
+destination port.
+
+A solution is then to also check the subflow's local id: it shouldn't be
+negative anyway.
+
+Another solution would be not to reset subflow->close_event_done at
+disconnect time, but when reused. But then, probably the whole reset
+could be done when being reused. Let's not change this logic, similar
+to TCP with tcp_disconnect().
+
+Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
+Cc: stable@vger.kernel.org
+Reported-by: Marco Angaroni <marco.angaroni@italtel.com>
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/603
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-1-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2534,8 +2534,8 @@ out:
+ void mptcp_close_ssk(struct sock *sk, struct sock *ssk,
+                    struct mptcp_subflow_context *subflow)
+ {
+-      /* The first subflow can already be closed and still in the list */
+-      if (subflow->close_event_done)
++      /* The first subflow can already be closed or disconnected */
++      if (subflow->close_event_done || READ_ONCE(subflow->local_id) < 0)
+               return;
+ 
+       subflow->close_event_done = true;

diff --git a/queue-6.18/series b/queue-6.18/series
index 83c392e7743469cb3d855c73eaeabfaabc43fb81..3899977086e3fd5c3e8b698aeaade98dcf6bde6a 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -119,3 +119,4 @@ revert-drm-nouveau-disp-set-drm_mode_config_funcs.atomic_-check-commit.patch
 net-sched-act_ife-convert-comma-to-semicolon.patch
 sched_ext-don-t-kick-cpus-running-higher-classes.patch
 sched_ext-fix-scx_kick_wait-to-work-reliably.patch
+mptcp-avoid-dup-sub_closed-events-after-disconnect.patch