This is a note to let you know that I've just added the patch titled mptcp: fix setsockopt(IP_TOS) subflow locking to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mptcp-fix-setsockopt-ip_tos-subflow-locking.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 7679d34f97b7a09fd565f5729f79fd61b7c55329 Mon Sep 17 00:00:00 2001 From: Paolo Abeni <pabeni@xxxxxxxxxx> Date: Tue, 14 Nov 2023 00:16:16 +0100 Subject: mptcp: fix setsockopt(IP_TOS) subflow locking From: Paolo Abeni <pabeni@xxxxxxxxxx> commit 7679d34f97b7a09fd565f5729f79fd61b7c55329 upstream. The MPTCP implementation of the IP_TOS socket option uses the lockless variant of the TOS manipulation helper and does not hold such lock at the helper invocation time. Add the required locking. Fixes: ffcacff87cd6 ("mptcp: Support for IP_TOS for MPTCP setsockopt()") Cc: stable@xxxxxxxxxxxxxxx Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/457 Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Signed-off-by: Matthieu Baerts <matttbe@xxxxxxxxxx> Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-4-7b9cd6a7b7f4@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/sockopt.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/mptcp/sockopt.c +++ b/net/mptcp/sockopt.c @@ -735,8 +735,11 @@ static int mptcp_setsockopt_v4_set_tos(s val = inet_sk(sk)->tos; mptcp_for_each_subflow(msk, subflow) { struct sock *ssk = mptcp_subflow_tcp_sock(subflow); + bool slow; + slow = lock_sock_fast(ssk); __ip_sock_set_tos(ssk, val); + unlock_sock_fast(ssk, slow); } release_sock(sk); Patches currently in stable-queue which might be from pabeni@xxxxxxxxxx are queue-6.1/mptcp-deal-with-large-gso-size.patch queue-6.1/atl1c-work-around-the-dma-rx-overflow-issue.patch queue-6.1/mptcp-fix-setsockopt-ip_tos-subflow-locking.patch queue-6.1/af_unix-fix-use-after-free-in-unix_stream_read_actor.patch queue-6.1/net-dsa-lan9303-consequently-nested-lock-physical-mdio.patch queue-6.1/net-ethtool-fix-documentation-of-ethtool_sprintf.patch queue-6.1/macvlan-don-t-propagate-promisc-change-to-lower-dev-.patch