This is a note to let you know that I've just added the patch titled mptcp: factor out __mptcp_close() without socket lock to the 5.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-factor-out-__mptcp_close-without-socket-lock.patch and it can be found in the queue-5.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 26d3e21ce1aab6cb19069c510fac8e7474445b18 Mon Sep 17 00:00:00 2001 From: Menglong Dong <imagedong@xxxxxxxxxxx> Date: Tue, 27 Sep 2022 12:31:57 -0700 Subject: mptcp: factor out __mptcp_close() without socket lock From: Menglong Dong <imagedong@xxxxxxxxxxx> commit 26d3e21ce1aab6cb19069c510fac8e7474445b18 upstream. Factor out __mptcp_close() from mptcp_close(). The caller of __mptcp_close() should hold the socket lock, and cancel mptcp work when __mptcp_close() returns true. This function will be used in the next commit. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Fixes: 6aeed9045071 ("mptcp: fix race on unaccepted mptcp sockets") Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Jiang Biao <benbjiang@xxxxxxxxxxx> Reviewed-by: Mengen Sun <mengensun@xxxxxxxxxxx> Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx> Signed-off-by: Menglong Dong <imagedong@xxxxxxxxxxx> Signed-off-by: Mat Martineau <mathew.j.martineau@xxxxxxxxxxxxxxx> Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/protocol.c | 14 ++++++++++++-- net/mptcp/protocol.h | 1 + 2 files changed, 13 insertions(+), 2 deletions(-) --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2832,13 +2832,12 @@ static void __mptcp_destroy_sock(struct sock_put(sk); } -static void mptcp_close(struct sock *sk, long timeout) +bool __mptcp_close(struct sock *sk, long timeout) { struct mptcp_subflow_context *subflow; struct mptcp_sock *msk = mptcp_sk(sk); bool do_cancel_work = false; - lock_sock(sk); sk->sk_shutdown = SHUTDOWN_MASK; if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) { @@ -2880,6 +2879,17 @@ cleanup: } else { mptcp_reset_timeout(msk, 0); } + + return do_cancel_work; +} + +static void mptcp_close(struct sock *sk, long timeout) +{ + bool do_cancel_work; + + lock_sock(sk); + + do_cancel_work = __mptcp_close(sk, timeout); release_sock(sk); if (do_cancel_work) mptcp_cancel_work(sk); --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -613,6 +613,7 @@ void mptcp_subflow_reset(struct sock *ss void mptcp_subflow_queue_clean(struct sock *ssk); void mptcp_sock_graft(struct sock *sk, struct socket *parent); struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk); +bool __mptcp_close(struct sock *sk, long timeout); bool mptcp_addresses_equal(const struct mptcp_addr_info *a, const struct mptcp_addr_info *b, bool use_port); Patches currently in stable-queue which might be from imagedong@xxxxxxxxxxx are queue-5.19/mptcp-factor-out-__mptcp_close-without-socket-lock.patch queue-5.19/mptcp-fix-unreleased-socket-in-accept-queue.patch