linux-yocto/net
Paolo Abeni c476d62758 mptcp: plug races between subflow fail and subflow creation
commit def5b7b264 upstream.

We have races similar to the one addressed by the previous patch between
subflow failing and additional subflow creation. They are just harder to
trigger.

The solution is similar. Use a separate flag to track the condition
'socket state prevent any additional subflow creation' protected by the
fallback lock.

The socket fallback makes such flag true, and also receiving or sending
an MP_FAIL option.

The field 'allow_infinite_fallback' is now always touched under the
relevant lock, we can drop the ONCE annotation on write.

Fixes: 478d770008 ("mptcp: send out MP_FAIL when data checksum fails")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-2-391aff963322@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Conflicts in subflow.c, because commit f1f26512a9 ("mptcp: use plain
  bool instead of custom binary enum") and commit 46a5d3abed
  ("mptcp: fix typos in comments") are not in this version. Both are
  causing conflicts in the context, and the same modifications can still
  be applied. Same in protocol.h with commit b8dc6d6ce9 ("mptcp: fix
  rcv buffer auto-tuning"). Conflicts in protocol.c because commit
  ee2708aeda ("mptcp: use get_retrans wrapper") is not in this version
  and refactor the code in __mptcp_retrans(), but the modification can
  still be applied, just not at the same indentation level. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:26:12 +02:00
..
6lowpan
9p 9p/net: fix improper handling of bogus negative read/write replies 2025-05-02 07:47:04 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-17 13:34:38 +01:00
8021q net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime 2025-07-24 08:51:53 +02:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-15 12:04:47 +02:00
atm atm: clip: Fix NULL pointer dereference in vcc_sendmsg() 2025-07-17 18:32:06 +02:00
ax25 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 2025-02-21 13:49:56 +01:00
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-03-28 21:59:01 +01:00
bluetooth Bluetooth: HCI: Set extended advertising data synchronously 2025-07-24 08:51:55 +02:00
bpf bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() 2025-03-07 16:56:37 +01:00
bpfilter
bridge net: bridge: Do not offload IGMP/MLD messages 2025-07-24 08:51:53 +02:00
caif caif: reduce stack size, again 2025-08-15 12:04:56 +02:00
can can: bcm: add missing rcu read protection for procfs content 2025-06-04 14:40:20 +02:00
ceph
core neighbour: add support for NUD_PERMANENT proxy entries 2025-08-28 16:25:57 +02:00
dcb
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:17:17 +01:00
devlink
dns_resolver
dsa net: dsa: tag_brcm: legacy: fix pskb_may_pull length 2025-06-27 11:07:17 +01:00
ethernet
ethtool net: ethtool: Don't call .cleanup_data when prepare_data fails 2025-04-25 10:43:25 +02:00
hsr net, hsr: reject HSR frame if skb can't hold tag 2025-08-28 16:26:09 +02:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:54:41 +01:00
ife
ipv4 net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
ipv6 net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
iucv s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() 2024-12-14 19:53:50 +01:00
kcm
key
l2tp
l3mdev
lapb
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:40:21 +02:00
mac80211 wifi: mac80211: update radar_required in channel context after channel switch 2025-08-28 16:25:57 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:17:11 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:25:55 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:07:39 +01:00
mptcp mptcp: plug races between subflow fail and subflow creation 2025-08-28 16:26:12 +02:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:25:58 +02:00
netfilter netfilter: ctnetlink: fix refcount leak on table dump 2025-08-28 16:25:51 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:07:25 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:25:48 +02:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:30:01 +01:00
nfc NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:07:29 +01:00
nsh
openvswitch net: openvswitch: Fix the dead loop of MPLS parse 2025-06-27 11:07:12 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-15 12:05:11 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-07-24 08:51:48 +02:00
psample
qrtr
rds
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-14 19:53:33 +01:00
rose rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-10 15:59:48 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:32:06 +02:00
sched net/sched: ets: use old 'nbands' while purging unused classes 2025-08-28 16:26:11 +02:00
sctp sctp: Do not wake readers in __sctp_write_space() 2025-06-27 11:07:33 +01:00
smc net/smc: use the correct ndev to find pnetid by pnetid table 2025-06-04 14:40:06 +02:00
strparser strparser: Add read_sock callback 2025-03-07 16:56:37 +01:00
sunrpc SUNRPC: rpcbind should never reset the port to the value '0' 2025-06-04 14:40:03 +02:00
switchdev net: switchdev: Convert blocking notification chain to a raw one 2025-03-28 21:58:49 +01:00
tipc tipc: Fix use-after-free in tipc_conn_close(). 2025-07-17 18:32:05 +02:00
tls tls: separate no-async decryption request handling from async 2025-08-28 16:26:12 +02:00
unix af_unix: Don't set -ECONNRESET for consumed OOB skb. 2025-07-06 10:58:00 +02:00
vmw_vsock vsock/virtio: Validate length in packet header before skb_put() 2025-08-28 16:26:07 +02:00
wireless wifi: cfg80211: reject HTC bit for management frames 2025-08-28 16:25:55 +02:00
x25
xdp xsk: fix an integer overflow in xp_create_and_assign_umem() 2025-03-28 21:59:01 +01:00
xfrm xfrm: interface: fix use-after-free after changing collect_md xfrm interface 2025-08-15 12:04:46 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile af_unix: Remove CONFIG_UNIX_SCM. 2025-06-04 14:40:23 +02:00
socket.c
sysctl_net.c