Patch 1 correctly handles disconnect() failures that can happen in some specific cases: now the socket state is set as unconnected as expected. That fixes an issue introduced in v6.2. Patch 2 fixes a divide by zero bug in mptcp_recvmsg() with a fix similar to a recent one from Eric Dumazet for TCP introducing sk_wait_pending flag. It should address an issue present in MPTCP from almost the beginning, from v5.9. Patch 3 fixes a possible list corruption on passive MPJ even if the race seems very unlikely, better be safe than sorry. The possible issue is present from v5.17. Patch 4 consolidates fallback and non fallback state machines to avoid leaking some MPTCP sockets. The fix is likely needed for versions from v5.11. Patch 5 drops code that is no longer used after the introduction of patch 4/6. This is not really a fix but this patch can probably land in the -net tree as well not to leave unused code. Patch 6 ensures listeners are unhashed before updating their sk status to avoid possible deadlocks when diag info are going to be retrieved with a lock. Even if it should not be visible with the way we are currently getting diag info, the issue is present from v5.17. Signed-off-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx> --- Paolo Abeni (6): mptcp: handle correctly disconnect() failures mptcp: fix possible divide by zero in recvmsg() mptcp: fix possible list corruption on passive MPJ mptcp: consolidate fallback and non fallback state machine mptcp: drop legacy code around RX EOF mptcp: ensure listener is unhashed before updating the sk status net/mptcp/pm_netlink.c | 1 + net/mptcp/protocol.c | 160 ++++++++++++++++++++----------------------------- net/mptcp/protocol.h | 5 +- net/mptcp/subflow.c | 17 +++--- 4 files changed, 76 insertions(+), 107 deletions(-) --- base-commit: 9a43827e876c9a071826cc81783aa2222b020f1d change-id: 20230620-upstream-net-20230620-misc-fixes-for-v6-4-55ef43802324 Best regards, -- Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx>