From 3bafbb8d2e86cdd86c700d0f78186c1f53e03d73 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 4 Feb 2026 11:01:10 +0100 Subject: [PATCH] 6.18-stable patches added patches: mptcp-avoid-dup-sub_closed-events-after-disconnect.patch --- ...p-sub_closed-events-after-disconnect.patch | 56 +++++++++++++++++++ queue-6.18/series | 1 + 2 files changed, 57 insertions(+) create mode 100644 queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch diff --git a/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch b/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch new file mode 100644 index 0000000000..d587163645 --- /dev/null +++ b/queue-6.18/mptcp-avoid-dup-sub_closed-events-after-disconnect.patch @@ -0,0 +1,56 @@ +From stable+bounces-213291-greg=kroah.com@vger.kernel.org Tue Feb 3 18:40:05 2026 +From: Sasha Levin +Date: Tue, 3 Feb 2026 12:37:17 -0500 +Subject: mptcp: avoid dup SUB_CLOSED events after disconnect +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Marco Angaroni , Geliang Tang , Jakub Kicinski , Sasha Levin +Message-ID: <20260203173717.1335686-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit 280d654324e33f8e6e3641f76764694c7b64c5db ] + +In case of subflow disconnect(), which can also happen with the first +subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset +will reset most fields from the mptcp_subflow_context structure, +including close_event_done. Then, when another subflow is closed, yet +another SUB_CLOSED event for the disconnected initial subflow is sent. +Because of the previous reset, there are no source address and +destination port. + +A solution is then to also check the subflow's local id: it shouldn't be +negative anyway. + +Another solution would be not to reset subflow->close_event_done at +disconnect time, but when reused. But then, probably the whole reset +could be done when being reused. Let's not change this logic, similar +to TCP with tcp_disconnect(). + +Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events") +Cc: stable@vger.kernel.org +Reported-by: Marco Angaroni +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/603 +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-1-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2534,8 +2534,8 @@ out: + void mptcp_close_ssk(struct sock *sk, struct sock *ssk, + struct mptcp_subflow_context *subflow) + { +- /* The first subflow can already be closed and still in the list */ +- if (subflow->close_event_done) ++ /* The first subflow can already be closed or disconnected */ ++ if (subflow->close_event_done || READ_ONCE(subflow->local_id) < 0) + return; + + subflow->close_event_done = true; diff --git a/queue-6.18/series b/queue-6.18/series index 83c392e774..3899977086 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -119,3 +119,4 @@ revert-drm-nouveau-disp-set-drm_mode_config_funcs.atomic_-check-commit.patch net-sched-act_ife-convert-comma-to-semicolon.patch sched_ext-don-t-kick-cpus-running-higher-classes.patch sched_ext-fix-scx_kick_wait-to-work-reliably.patch +mptcp-avoid-dup-sub_closed-events-after-disconnect.patch -- 2.47.3