--- /dev/null
+From 14e9fea30b68fc75b2b3d97396a7e6adb544bd2a Mon Sep 17 00:00:00 2001
+From: Tao Cui <cuitao@kylinos.cn>
+Date: Tue, 2 Jun 2026 22:14:12 +1000
+Subject: mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
+
+From: Tao Cui <cuitao@kylinos.cn>
+
+commit 14e9fea30b68fc75b2b3d97396a7e6adb544bd2a upstream.
+
+The userspace PM increments extra_subflows after __mptcp_subflow_connect()
+succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow()
+on failure to roll back the pre-increment done by the kernel PM's fill_*()
+helpers. Because the userspace PM hasn't incremented yet at that point,
+this decrement is spurious and causes extra_subflows to underflow.
+
+Fix it by aligning the userspace PM with the kernel PM: increment
+extra_subflows before calling __mptcp_subflow_connect(), so the existing
+error path in subflow.c correctly rolls it back on failure. Also simplify
+the error handling by taking pm.lock only when needed for cleanup.
+
+Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tao Cui <cuitao@kylinos.cn>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/pm_userspace.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/net/mptcp/pm_userspace.c
++++ b/net/mptcp/pm_userspace.c
+@@ -402,16 +402,19 @@ int mptcp_pm_nl_subflow_create_doit(stru
+ local.flags = entry.flags;
+ local.ifindex = entry.ifindex;
+
++ spin_lock_bh(&msk->pm.lock);
++ msk->pm.subflows++;
++ spin_unlock_bh(&msk->pm.lock);
++
+ lock_sock(sk);
+ err = __mptcp_subflow_connect(sk, &local, &addr_r);
+ release_sock(sk);
+
+- spin_lock_bh(&msk->pm.lock);
+- if (err)
++ if (err) {
++ spin_lock_bh(&msk->pm.lock);
+ mptcp_userspace_pm_delete_local_addr(msk, &entry);
+- else
+- msk->pm.subflows++;
+- spin_unlock_bh(&msk->pm.lock);
++ spin_unlock_bh(&msk->pm.lock);
++ }
+
+ create_err:
+ sock_put(sk);
--- /dev/null
+From petrm@nvidia.com Tue Jun 16 18:57:13 2026
+From: Petr Machata <petrm@nvidia.com>
+Date: Fri, 15 May 2026 15:53:53 +0200
+Subject: Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
+To: Sasha Levin <sashal@kernel.org>
+Cc: Petr Machata <petrm@nvidia.com>, <stable@vger.kernel.org>, Wojtek Wasko <wwasko@nvidia.com>, Mahesh Bandewar <maheshb@google.com>, Shuah Khan <shuah@kernel.org>, Richard Cochran <richardcochran@gmail.com>, Yong Wang <yongwang@nvidia.com>
+Message-ID: <2e4d2f2b9efa7b0b32476947f63506cfe9568d1d.1778851656.git.petrm@nvidia.com>
+
+From: Petr Machata <petrm@nvidia.com>
+
+This reverts commit fa361565a7275cc43c6ca1abec9ec4fcc9ec51f1, which is
+commit 3d07b691ee707c00afaf365440975e81bb96cd9b upstream.
+
+The cited commit allows testptp to set a configurable clock_id. That is
+done via a PTP_SYS_OFFSET_EXTENDED ioctl call, whose argument is struct
+ptp_sys_offset_extended, where the clock_id is set. However, this Linux
+version does not support the ptp_sys_offset_extended.clockid field, and
+the test case cannot be built against this tree's own UAPI headers.
+
+The reverted commit was introduced to resolve a missing dependency of
+commit c6dc458227a3 ("testptp: Add option to open PHC in readonly mode"),
+which is 76868642e427 upstream. My suspicion is that the only conflict
+between the two is the getopt string, and there is otherwise no direct
+dependency between the two.
+
+This patch therefore reverts the cited commit, with hand-resolving the
+getopt string to include 'r' (as introduced by c6dc458227a3), but not
+'y' (introduced by 06954f715deb).
+
+Reported-by: Yong Wang <yongwang@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ptp/testptp.c | 62 ++--------------------------------
+ 1 file changed, 5 insertions(+), 57 deletions(-)
+
+--- a/tools/testing/selftests/ptp/testptp.c
++++ b/tools/testing/selftests/ptp/testptp.c
+@@ -147,7 +147,6 @@ static void usage(char *progname)
+ " -T val set the ptp clock time to 'val' seconds\n"
+ " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n"
+ " -X get a ptp clock cross timestamp\n"
+- " -y val pre/post tstamp timebase to use {realtime|monotonic|monotonic-raw}\n"
+ " -z test combinations of rising/falling external time stamp flags\n",
+ progname, PTP_MAX_SAMPLES);
+ }
+@@ -192,7 +191,6 @@ int main(int argc, char *argv[])
+ int readonly = 0;
+ int settime = 0;
+ int channel = -1;
+- clockid_t ext_clockid = CLOCK_REALTIME;
+
+ int64_t t1, t2, tp;
+ int64_t interval, offset;
+@@ -202,7 +200,7 @@ int main(int argc, char *argv[])
+
+ progname = strrchr(argv[0], '/');
+ progname = progname ? 1+progname : argv[0];
+- while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xy:z"))) {
++ while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xz"))) {
+ switch (c) {
+ case 'c':
+ capabilities = 1;
+@@ -285,21 +283,6 @@ int main(int argc, char *argv[])
+ case 'X':
+ getcross = 1;
+ break;
+- case 'y':
+- if (!strcasecmp(optarg, "realtime"))
+- ext_clockid = CLOCK_REALTIME;
+- else if (!strcasecmp(optarg, "monotonic"))
+- ext_clockid = CLOCK_MONOTONIC;
+- else if (!strcasecmp(optarg, "monotonic-raw"))
+- ext_clockid = CLOCK_MONOTONIC_RAW;
+- else {
+- fprintf(stderr,
+- "type needs to be realtime, monotonic or monotonic-raw; was given %s\n",
+- optarg);
+- return -1;
+- }
+- break;
+-
+ case 'z':
+ flagtest = 1;
+ break;
+@@ -592,7 +575,6 @@ int main(int argc, char *argv[])
+ }
+
+ soe->n_samples = getextended;
+- soe->clockid = ext_clockid;
+
+ if (ioctl(fd, PTP_SYS_OFFSET_EXTENDED, soe)) {
+ perror("PTP_SYS_OFFSET_EXTENDED");
+@@ -601,46 +583,12 @@ int main(int argc, char *argv[])
+ getextended);
+
+ for (i = 0; i < getextended; i++) {
+- switch (ext_clockid) {
+- case CLOCK_REALTIME:
+- printf("sample #%2d: real time before: %lld.%09u\n",
+- i, soe->ts[i][0].sec,
+- soe->ts[i][0].nsec);
+- break;
+- case CLOCK_MONOTONIC:
+- printf("sample #%2d: monotonic time before: %lld.%09u\n",
+- i, soe->ts[i][0].sec,
+- soe->ts[i][0].nsec);
+- break;
+- case CLOCK_MONOTONIC_RAW:
+- printf("sample #%2d: monotonic-raw time before: %lld.%09u\n",
+- i, soe->ts[i][0].sec,
+- soe->ts[i][0].nsec);
+- break;
+- default:
+- break;
+- }
++ printf("sample #%2d: system time before: %lld.%09u\n",
++ i, soe->ts[i][0].sec, soe->ts[i][0].nsec);
+ printf(" phc time: %lld.%09u\n",
+ soe->ts[i][1].sec, soe->ts[i][1].nsec);
+- switch (ext_clockid) {
+- case CLOCK_REALTIME:
+- printf(" real time after: %lld.%09u\n",
+- soe->ts[i][2].sec,
+- soe->ts[i][2].nsec);
+- break;
+- case CLOCK_MONOTONIC:
+- printf(" monotonic time after: %lld.%09u\n",
+- soe->ts[i][2].sec,
+- soe->ts[i][2].nsec);
+- break;
+- case CLOCK_MONOTONIC_RAW:
+- printf(" monotonic-raw time after: %lld.%09u\n",
+- soe->ts[i][2].sec,
+- soe->ts[i][2].nsec);
+- break;
+- default:
+- break;
+- }
++ printf(" system time after: %lld.%09u\n",
++ soe->ts[i][2].sec, soe->ts[i][2].nsec);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
