From: Sasha Levin Date: Tue, 5 May 2026 20:29:30 +0000 (-0400) Subject: drop 1 patch based on RC review feedback X-Git-Tag: v6.12.86~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83ab144dded31ee1759419e45297777594d682e3;p=thirdparty%2Fkernel%2Fstable-queue.git drop 1 patch based on RC review feedback Dropped patches: - "mptcp: sync the msk->sndbuf at accept() time" Queues: 6.18 Reason: MPTCP maintainer Matthieu Baerts reported a general protection fault in mptcp_stream_accept during the mptcp_connect selftest. On 6.18, the inline mptcp_for_each_subflow(msk, subflow) loop in mptcp_stream_accept clobbers the local 'subflow' variable before the newly-added __mptcp_propagate_sndbuf(newsk, mptcp_subflow_tcp_sock(subflow)) call, causing a bogus dereference. Upstream/7.0 use the mptcp_graft_subflows() helper (commit 68c7c3867145) and are unaffected. Report: https://lore.kernel.org/stable/1bbeee9b-b69b-4be9-84ee-ddadda4793ef@kernel.org/ Signed-off-by: Sasha Levin --- diff --git a/queue-6.18/mptcp-sync-the-msk-sndbuf-at-accept-time.patch b/queue-6.18/mptcp-sync-the-msk-sndbuf-at-accept-time.patch deleted file mode 100644 index 03774879d9..0000000000 --- a/queue-6.18/mptcp-sync-the-msk-sndbuf-at-accept-time.patch +++ /dev/null @@ -1,62 +0,0 @@ -From fcf04b14334641f4b0b8647824480935e9416d52 Mon Sep 17 00:00:00 2001 -From: Gang Yan -Date: Mon, 20 Apr 2026 18:19:23 +0200 -Subject: mptcp: sync the msk->sndbuf at accept() time - -From: Gang Yan - -commit fcf04b14334641f4b0b8647824480935e9416d52 upstream. - -On passive MPTCP connections, the msk sndbuf is not updated correctly. - -The root cause is an order issue in the accept path: - -- tcp_check_req() -> subflow_syn_recv_sock() -> mptcp_sk_clone_init() - calls __mptcp_propagate_sndbuf() to copy the ssk sndbuf into msk - -- Later, tcp_child_process() -> tcp_init_transfer() -> - tcp_sndbuf_expand() grows the ssk sndbuf. - -So __mptcp_propagate_sndbuf() runs before the ssk sndbuf has been -expanded and the msk ends up with a much smaller sndbuf than the -subflow: - - MPTCP: msk->sndbuf:20480, msk->first->sndbuf:2626560 - -Fix this by moving the __mptcp_propagate_sndbuf() call from -mptcp_sk_clone_init() -- the ssk sndbuf is not yet finalized there -- to -__mptcp_propagate_sndbuf() at accept() time, when the ssk sndbuf has -been fully expanded by tcp_sndbuf_expand(). - -Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") -Cc: stable@vger.kernel.org -Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/602 -Signed-off-by: Gang Yan -Acked-by: Paolo Abeni -Reviewed-by: Matthieu Baerts (NGI0) -Signed-off-by: Matthieu Baerts (NGI0) -Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-1-e3523e3aeb44@kernel.org -Signed-off-by: Paolo Abeni -Signed-off-by: Greg Kroah-Hartman ---- - net/mptcp/protocol.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -3428,7 +3428,6 @@ struct sock *mptcp_sk_clone_init(const s - * uses the correct data - */ - mptcp_copy_inaddrs(nsk, ssk); -- __mptcp_propagate_sndbuf(nsk, ssk); - - mptcp_rcv_space_init(msk, ssk); - msk->rcvq_space.time = mptcp_stamp(); -@@ -4038,6 +4037,7 @@ static int mptcp_stream_accept(struct so - } - - mptcp_rps_record_subflows(msk); -+ __mptcp_propagate_sndbuf(newsk, mptcp_subflow_tcp_sock(subflow)); - - /* Do late cleanup for the first subflow as necessary. Also - * deal with bad peers not doing a complete shutdown. diff --git a/queue-6.18/series b/queue-6.18/series index a0eb5aeb34..58c7b30f46 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -211,7 +211,6 @@ x86-shstk-prevent-deadlock-during-shstk-sigreturn.patch wifi-rtl8xxxu-fix-potential-use-of-uninitialized-value.patch tcp-call-sk_data_ready-after-listener-migration.patch taskstats-set-version-in-tgid-exit-notifications.patch -mptcp-sync-the-msk-sndbuf-at-accept-time.patch mfd-core-preserve-of-node-when-acpi-handle-is-present.patch apparmor-use-target-task-s-context-in-apparmor_getprocattr.patch bluetooth-hci_event-fix-potential-uaf-in-ssp-passkey-handlers.patch