From: "Matthieu Baerts (NGI0)" <matttbe@xxxxxxxxxx> commit c07cc3ed895f9bfe0c53b5ed6be710c133b4271c upstream. Taking the first one on the list doesn't work in some cases, e.g. if the initial subflow is being removed. Pick another one instead of not sending anything. Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> [ Conflicts in pm_netlink.c, because the code has been refactored in commit f5360e9b314c ("mptcp: introduce and use mptcp_pm_send_ack()") which is difficult to backport in this version. The same adaptations have been applied: iterating over all subflows, and send the ACK on the first active subflow. ] Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mptcp/pm_netlink.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -693,16 +693,18 @@ void mptcp_pm_nl_addr_send_ack(struct mp return; __mptcp_flush_join_list(msk); - subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node); - if (subflow) { - struct sock *ssk = mptcp_subflow_tcp_sock(subflow); + mptcp_for_each_subflow(msk, subflow) { + if (__mptcp_subflow_active(subflow)) { + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); - spin_unlock_bh(&msk->pm.lock); - pr_debug("send ack for %s\n", - mptcp_pm_should_add_signal(msk) ? "add_addr" : "rm_addr"); + spin_unlock_bh(&msk->pm.lock); + pr_debug("send ack for %s\n", + mptcp_pm_should_add_signal(msk) ? "add_addr" : "rm_addr"); - mptcp_subflow_send_ack(ssk); - spin_lock_bh(&msk->pm.lock); + mptcp_subflow_send_ack(ssk); + spin_lock_bh(&msk->pm.lock); + break; + } } } Patches currently in stable-queue which might be from matttbe@xxxxxxxxxx are queue-5.15/mptcp-pm-avoid-possible-uaf-when-selecting-endp.patch queue-5.15/mptcp-pm-only-decrement-add_addr_accepted-for-mpj-req.patch queue-5.15/mptcp-pm-fullmesh-select-the-right-id-later.patch queue-5.15/mptcp-pm-skip-connecting-to-already-established-sf.patch queue-5.15/mptcp-pm-re-using-id-of-unused-flushed-subflows.patch queue-5.15/mptcp-pm-add_addr-0-is-not-a-new-address.patch queue-5.15/mptcp-constify-a-bunch-of-of-helpers.patch queue-5.15/mptcp-pm-do-not-remove-already-closed-subflows.patch queue-5.15/mptcp-pr_debug-add-missing-n-at-the-end.patch queue-5.15/mptcp-pm-check-add_addr_accept_max-before-accepting-new-add_addr.patch queue-5.15/mptcp-close-subflow-when-receiving-tcp-fin.patch queue-5.15/mptcp-avoid-duplicated-sub_closed-events.patch queue-5.15/mptcp-pm-send-ack-on-an-active-subflow.patch