From: Gang Yan Date: Tue, 2 Jun 2026 12:14:16 +0000 (+1000) Subject: mptcp: check desc->count in read_sock X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=c378b1a6f8dd3e02eb08661f4d5d50f236eead03;p=thirdparty%2Fkernel%2Flinux.git mptcp: check desc->count in read_sock __tcp_read_sock() checks desc->count after each skb is consumed and breaks the loop when it reaches 0. The MPTCP variant lacks this check. This is a functional bug, other subsystems also rely on this check: TLS strparser sets desc->count to 0 once a full TLS record is assembled and depends on this break to stop reading. Add the same desc->count check to __mptcp_read_sock(), mirroring __tcp_read_sock(). Fixes: 250d9766a984 ("mptcp: implement .read_sock") Cc: stable@vger.kernel.org Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-9-856831229976@kernel.org Signed-off-by: Jakub Kicinski --- diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7fac5fac2097..cb9515f505aa 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -4428,6 +4428,8 @@ static int __mptcp_read_sock(struct sock *sk, read_descriptor_t *desc, } mptcp_eat_recv_skb(sk, skb); + if (!desc->count) + break; } if (noack)