This is a note to let you know that I've just added the patch titled mptcp: ensure subflow is unhashed before cleaning the backlog to the 6.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-ensure-subflow-is-unhashed-before-cleaning-the-backlog.patch and it can be found in the queue-6.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 3fffa15bfef48b0ad6424779c03e68ae8ace5acb Mon Sep 17 00:00:00 2001 From: Paolo Abeni <pabeni@xxxxxxxxxx> Date: Tue, 4 Jul 2023 22:44:33 +0200 Subject: mptcp: ensure subflow is unhashed before cleaning the backlog From: Paolo Abeni <pabeni@xxxxxxxxxx> commit 3fffa15bfef48b0ad6424779c03e68ae8ace5acb upstream. While tacking care of the mptcp-level listener I unintentionally moved the subflow level unhash after the subflow listener backlog cleanup. That could cause some nasty race and makes the code harder to read. Address the issue restoring the proper order of operations. Fixes: 57fc0f1ceaa4 ("mptcp: ensure listener is unhashed before updating the sk status") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> Reviewed-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx> Signed-off-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2908,10 +2908,10 @@ static void mptcp_check_listen_stop(stru return; lock_sock_nested(ssk, SINGLE_DEPTH_NESTING); + tcp_set_state(ssk, TCP_CLOSE); mptcp_subflow_queue_clean(sk, ssk); inet_csk_listen_stop(ssk); mptcp_event_pm_listener(ssk, MPTCP_EVENT_LISTENER_CLOSED); - tcp_set_state(ssk, TCP_CLOSE); release_sock(ssk); } Patches currently in stable-queue which might be from pabeni@xxxxxxxxxx are queue-6.4/mptcp-do-not-rely-on-implicit-state-check-in-mptcp_listen.patch queue-6.4/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch queue-6.4/udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch queue-6.4/mptcp-ensure-subflow-is-unhashed-before-cleaning-the-backlog.patch queue-6.4/net-fec-recycle-pages-for-transmitted-xdp-frames.patch queue-6.4/selftests-mptcp-connect-fail-if-nft-supposed-to-work.patch queue-6.4/net-lan743x-don-t-sleep-in-atomic-context.patch queue-6.4/octeontx2-pf-add-additional-check-for-mcam-rules.patch queue-6.4/net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch queue-6.4/selftests-mptcp-userspace_pm-report-errors-with-remove-tests.patch queue-6.4/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch queue-6.4/net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch queue-6.4/selftests-mptcp-userspace_pm-use-correct-server-port.patch queue-6.4/net-prevent-skb-corruption-on-frag-list-segmentation.patch queue-6.4/selftests-mptcp-sockopt-return-error-if-wrong-mark.patch queue-6.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch queue-6.4/selftests-mptcp-sockopt-use-iptables-legacy-if-available.patch queue-6.4/net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch