+++ /dev/null
-From stable+bounces-196774-greg=kroah.com@vger.kernel.org Mon Nov 24 18:39:05 2025
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Nov 2025 12:38:21 -0500
-Subject: mptcp: Fix proto fallback detection with BPF
-To: stable@vger.kernel.org
-Cc: Jiayuan Chen <jiayuan.chen@linux.dev>, Martin KaFai Lau <martin.lau@kernel.org>, Jakub Sitnicki <jakub@cloudflare.com>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20251124173821.4165452-1-sashal@kernel.org>
-
-From: Jiayuan Chen <jiayuan.chen@linux.dev>
-
-[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ]
-
-The sockmap feature allows bpf syscall from userspace, or based
-on bpf sockops, replacing the sk_prot of sockets during protocol stack
-processing with sockmap's custom read/write interfaces.
-'''
-tcp_rcv_state_process()
- syn_recv_sock()/subflow_syn_recv_sock()
- tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
- bpf_skops_established <== sockops
- bpf_sock_map_update(sk) <== call bpf helper
- tcp_bpf_update_proto() <== update sk_prot
-'''
-
-When the server has MPTCP enabled but the client sends a TCP SYN
-without MPTCP, subflow_syn_recv_sock() performs a fallback on the
-subflow, replacing the subflow sk's sk_prot with the native sk_prot.
-'''
-subflow_syn_recv_sock()
- subflow_ulp_fallback()
- subflow_drop_ctx()
- mptcp_subflow_ops_undo_override()
-'''
-
-Then, this subflow can be normally used by sockmap, which replaces the
-native sk_prot with sockmap's custom sk_prot. The issue occurs when the
-user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
-Here, it uses sk->sk_prot to compare with the native sk_prot, but this
-is incorrect when sockmap is used, as we may incorrectly set
-sk->sk_socket->ops.
-
-This fix uses the more generic sk_family for the comparison instead.
-
-Additionally, this also prevents a WARNING from occurring:
-
-result from ./scripts/decode_stacktrace.sh:
-------------[ cut here ]------------
-WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
-(net/mptcp/protocol.c:4005)
-Modules linked in:
-...
-
-PKRU: 55555554
-Call Trace:
-<TASK>
-do_accept (net/socket.c:1989)
-__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
-__x64_sys_accept (net/socket.c:2067)
-x64_sys_call (arch/x86/entry/syscall_64.c:41)
-do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
-entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
-RIP: 0033:0x7f87ac92b83d
-
----[ end trace 0000000000000000 ]---
-
-Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash")
-Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
-Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
-Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
-Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
-Cc: <stable@vger.kernel.org>
-Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
-[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ]
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/mptcp/protocol.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/net/mptcp/protocol.c
-+++ b/net/mptcp/protocol.c
-@@ -56,8 +56,9 @@ static struct socket *__mptcp_nmpc_socke
- static bool mptcp_is_tcpsk(struct sock *sk)
- {
- struct socket *sock = sk->sk_socket;
-+ unsigned short family = READ_ONCE(sk->sk_family);
-
-- if (unlikely(sk->sk_prot == &tcp_prot)) {
-+ if (unlikely(family == AF_INET)) {
- /* we are being invoked after mptcp_accept() has
- * accepted a non-mp-capable flow: sk is a tcp_sk,
- * not an mptcp one.
-@@ -68,7 +69,7 @@ static bool mptcp_is_tcpsk(struct sock *
- sock->ops = &inet_stream_ops;
- return true;
- #if IS_ENABLED(CONFIG_MPTCP_IPV6)
-- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) {
-+ } else if (unlikely(family == AF_INET6)) {
- sock->ops = &inet6_stream_ops;
- return true;
- #endif
alsa-usb-audio-fix-potential-overflow-of-pcm-transfer-buffer.patch
pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch
pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch
-mptcp-fix-proto-fallback-detection-with-bpf.patch
ata-libata-scsi-fix-system-suspend-for-a-security-locked-drive.patch
mptcp-introduce-mptcp_schedule_work.patch
mptcp-fix-race-condition-in-mptcp_schedule_work.patch
+++ /dev/null
-From stable+bounces-196772-greg=kroah.com@vger.kernel.org Mon Nov 24 18:24:35 2025
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Nov 2025 12:24:26 -0500
-Subject: mptcp: Fix proto fallback detection with BPF
-To: stable@vger.kernel.org
-Cc: Jiayuan Chen <jiayuan.chen@linux.dev>, Martin KaFai Lau <martin.lau@kernel.org>, Jakub Sitnicki <jakub@cloudflare.com>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20251124172426.4160679-1-sashal@kernel.org>
-
-From: Jiayuan Chen <jiayuan.chen@linux.dev>
-
-[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ]
-
-The sockmap feature allows bpf syscall from userspace, or based
-on bpf sockops, replacing the sk_prot of sockets during protocol stack
-processing with sockmap's custom read/write interfaces.
-'''
-tcp_rcv_state_process()
- syn_recv_sock()/subflow_syn_recv_sock()
- tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
- bpf_skops_established <== sockops
- bpf_sock_map_update(sk) <== call bpf helper
- tcp_bpf_update_proto() <== update sk_prot
-'''
-
-When the server has MPTCP enabled but the client sends a TCP SYN
-without MPTCP, subflow_syn_recv_sock() performs a fallback on the
-subflow, replacing the subflow sk's sk_prot with the native sk_prot.
-'''
-subflow_syn_recv_sock()
- subflow_ulp_fallback()
- subflow_drop_ctx()
- mptcp_subflow_ops_undo_override()
-'''
-
-Then, this subflow can be normally used by sockmap, which replaces the
-native sk_prot with sockmap's custom sk_prot. The issue occurs when the
-user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
-Here, it uses sk->sk_prot to compare with the native sk_prot, but this
-is incorrect when sockmap is used, as we may incorrectly set
-sk->sk_socket->ops.
-
-This fix uses the more generic sk_family for the comparison instead.
-
-Additionally, this also prevents a WARNING from occurring:
-
-result from ./scripts/decode_stacktrace.sh:
-------------[ cut here ]------------
-WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
-(net/mptcp/protocol.c:4005)
-Modules linked in:
-...
-
-PKRU: 55555554
-Call Trace:
-<TASK>
-do_accept (net/socket.c:1989)
-__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
-__x64_sys_accept (net/socket.c:2067)
-x64_sys_call (arch/x86/entry/syscall_64.c:41)
-do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
-entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
-RIP: 0033:0x7f87ac92b83d
-
----[ end trace 0000000000000000 ]---
-
-Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash")
-Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
-Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
-Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
-Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
-Cc: <stable@vger.kernel.org>
-Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
-[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ]
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/mptcp/protocol.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/net/mptcp/protocol.c
-+++ b/net/mptcp/protocol.c
-@@ -77,8 +77,9 @@ static u64 mptcp_wnd_end(const struct mp
- static bool mptcp_is_tcpsk(struct sock *sk)
- {
- struct socket *sock = sk->sk_socket;
-+ unsigned short family = READ_ONCE(sk->sk_family);
-
-- if (unlikely(sk->sk_prot == &tcp_prot)) {
-+ if (unlikely(family == AF_INET)) {
- /* we are being invoked after mptcp_accept() has
- * accepted a non-mp-capable flow: sk is a tcp_sk,
- * not an mptcp one.
-@@ -89,7 +90,7 @@ static bool mptcp_is_tcpsk(struct sock *
- sock->ops = &inet_stream_ops;
- return true;
- #if IS_ENABLED(CONFIG_MPTCP_IPV6)
-- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) {
-+ } else if (unlikely(family == AF_INET6)) {
- sock->ops = &inet6_stream_ops;
- return true;
- #endif
pmdomain-samsung-plug-potential-memleak-during-probe.patch
selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch
mptcp-disallow-mptcp-subflows-from-sockmap.patch
-mptcp-fix-proto-fallback-detection-with-bpf.patch
usb-deprecate-the-third-argument-of-usb_maxpacket.patch
input-remove-third-argument-of-usb_maxpacket.patch
input-pegasus-notetaker-fix-potential-out-of-bounds-access.patch
+++ /dev/null
-From stable+bounces-196771-greg=kroah.com@vger.kernel.org Mon Nov 24 18:18:14 2025
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Nov 2025 12:18:02 -0500
-Subject: mptcp: Fix proto fallback detection with BPF
-To: stable@vger.kernel.org
-Cc: Jiayuan Chen <jiayuan.chen@linux.dev>, Martin KaFai Lau <martin.lau@kernel.org>, Jakub Sitnicki <jakub@cloudflare.com>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20251124171802.4158681-1-sashal@kernel.org>
-
-From: Jiayuan Chen <jiayuan.chen@linux.dev>
-
-[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ]
-
-The sockmap feature allows bpf syscall from userspace, or based
-on bpf sockops, replacing the sk_prot of sockets during protocol stack
-processing with sockmap's custom read/write interfaces.
-'''
-tcp_rcv_state_process()
- syn_recv_sock()/subflow_syn_recv_sock()
- tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
- bpf_skops_established <== sockops
- bpf_sock_map_update(sk) <== call bpf helper
- tcp_bpf_update_proto() <== update sk_prot
-'''
-
-When the server has MPTCP enabled but the client sends a TCP SYN
-without MPTCP, subflow_syn_recv_sock() performs a fallback on the
-subflow, replacing the subflow sk's sk_prot with the native sk_prot.
-'''
-subflow_syn_recv_sock()
- subflow_ulp_fallback()
- subflow_drop_ctx()
- mptcp_subflow_ops_undo_override()
-'''
-
-Then, this subflow can be normally used by sockmap, which replaces the
-native sk_prot with sockmap's custom sk_prot. The issue occurs when the
-user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
-Here, it uses sk->sk_prot to compare with the native sk_prot, but this
-is incorrect when sockmap is used, as we may incorrectly set
-sk->sk_socket->ops.
-
-This fix uses the more generic sk_family for the comparison instead.
-
-Additionally, this also prevents a WARNING from occurring:
-
-result from ./scripts/decode_stacktrace.sh:
-------------[ cut here ]------------
-WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
-(net/mptcp/protocol.c:4005)
-Modules linked in:
-...
-
-PKRU: 55555554
-Call Trace:
-<TASK>
-do_accept (net/socket.c:1989)
-__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
-__x64_sys_accept (net/socket.c:2067)
-x64_sys_call (arch/x86/entry/syscall_64.c:41)
-do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
-entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
-RIP: 0033:0x7f87ac92b83d
-
----[ end trace 0000000000000000 ]---
-
-Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash")
-Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
-Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
-Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
-Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
-Cc: <stable@vger.kernel.org>
-Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
-[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ]
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/mptcp/protocol.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/net/mptcp/protocol.c
-+++ b/net/mptcp/protocol.c
-@@ -79,8 +79,9 @@ static u64 mptcp_wnd_end(const struct mp
- static bool mptcp_is_tcpsk(struct sock *sk)
- {
- struct socket *sock = sk->sk_socket;
-+ unsigned short family = READ_ONCE(sk->sk_family);
-
-- if (unlikely(sk->sk_prot == &tcp_prot)) {
-+ if (unlikely(family == AF_INET)) {
- /* we are being invoked after mptcp_accept() has
- * accepted a non-mp-capable flow: sk is a tcp_sk,
- * not an mptcp one.
-@@ -91,7 +92,7 @@ static bool mptcp_is_tcpsk(struct sock *
- sock->ops = &inet_stream_ops;
- return true;
- #if IS_ENABLED(CONFIG_MPTCP_IPV6)
-- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) {
-+ } else if (unlikely(family == AF_INET6)) {
- sock->ops = &inet6_stream_ops;
- return true;
- #endif
mm-mempool-fix-poisoning-order-0-pages-with-highmem.patch
dt-bindings-pinctrl-toshiba-visconti-fix-number-of-items-in-groups.patch
ata-libata-scsi-fix-system-suspend-for-a-security-locked-drive.patch
-mptcp-fix-proto-fallback-detection-with-bpf.patch
hid-amd_sfh-stop-sensor-before-starting.patch
selftests-mptcp-join-rm-set-backup-flag.patch
selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
