diff options
| author | Chenguang Zhao <zhaochenguang@kylinos.cn> | 2026-07-22 00:14:38 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-23 10:50:38 -0700 |
| commit | f3ca0ee2cc308e33896536789cbc5f3a12ca7b30 (patch) | |
| tree | 6ed6a04506189cba88aff8d4f7850f89386a1c7d | |
| parent | 234e5e898b713bc0b3a631b6f002897f43d046c8 (diff) | |
| download | linux-f3ca0ee2cc308e33896536789cbc5f3a12ca7b30.tar.gz linux-f3ca0ee2cc308e33896536789cbc5f3a12ca7b30.tar.bz2 linux-f3ca0ee2cc308e33896536789cbc5f3a12ca7b30.zip | |
mptcp: decrement subflows counter on failed passive join
mptcp_pm_allow_new_subflow() increments extra_subflows before
__mptcp_finish_join() on the passive MP_JOIN path.
In case of race conditions, the subflow is dropped without calling
mptcp_close_ssk(), so the counter is not rolled back.
Call mptcp_pm_close_subflow() when the join completion fails to
decrement the subflows counter.
Fixes: 10f6d46c943d ("mptcp: fix race between MP_JOIN and close")
Cc: stable@vger.kernel.org
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-1-6fb595bc86ef@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/mptcp/protocol.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index cb9515f505aa..b32f0cd262a7 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -3907,6 +3907,7 @@ bool mptcp_finish_join(struct sock *ssk) mptcp_data_unlock(parent); if (!ret) { + mptcp_pm_close_subflow(msk); err_prohibited: subflow->reset_reason = MPTCP_RST_EPROHIBIT; return false; |