From: "Matthieu Baerts (NGI0)" <matttbe@xxxxxxxxxx> commit efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 upstream. When sending an MP_JOIN + SYN + ACK, it is possible to mark the subflow as 'backup' by setting the flag with the same name. Before this patch, the backup was set if the other peer set it in its MP_JOIN + SYN request. It is not correct: the backup flag should be set in the MPJ+SYN+ACK only if the host asks for it, and not mirroring what was done by the other peer. It is then required to have a dedicated bit for each direction, similar to what is done in the subflow context. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> [ Conflicts in subflow.c, because the context has changed in commit 4cf86ae84c71 ("mptcp: strict local address ID selection"), and in commit 967d3c27127e ("mptcp: fix data races on remote_id"), which are not in this version. These commits are unrelated to this modification. Same in protocol.h, with commit bab6b88e0560 ("mptcp: add allow_join_id0 in mptcp_out_options"). ] Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/options.c | 2 +- net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -708,7 +708,7 @@ bool mptcp_synack_options(const struct r return true; } else if (subflow_req->mp_join) { opts->suboptions = OPTION_MPTCP_MPJ_SYNACK; - opts->backup = subflow_req->backup; + opts->backup = subflow_req->request_bkup; opts->join_id = subflow_req->local_id; opts->thmac = subflow_req->thmac; opts->nonce = subflow_req->local_nonce; --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -261,7 +261,8 @@ struct mptcp_subflow_request_sock { struct tcp_request_sock sk; u16 mp_capable : 1, mp_join : 1, - backup : 1; + backup : 1, + request_bkup : 1; u8 local_id; u8 remote_id; u64 local_key; --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1395,6 +1395,7 @@ static void subflow_ulp_clone(const stru new_ctx->mp_join = 1; new_ctx->fully_established = 1; new_ctx->backup = subflow_req->backup; + new_ctx->request_bkup = subflow_req->request_bkup; new_ctx->local_id = subflow_req->local_id; new_ctx->remote_id = subflow_req->remote_id; new_ctx->token = subflow_req->token; Patches currently in stable-queue which might be from kroah.com@xxxxxxxxxxxxxxx are queue-5.10/mptcp-fix-nl-pm-announced-address-accounting.patch queue-5.10/mptcp-distinguish-rcv-vs-sent-backup-flag-in-requests.patch queue-5.10/mptcp-pm-fix-backup-support-in-signal-endpoints.patch queue-5.10/mptcp-mib-count-mpj-with-backup-flag.patch queue-5.10/mptcp-sched-check-both-directions-for-backup.patch queue-5.10/mptcp-export-local_address.patch