All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Geliang Tang <geliang@kernel.org>,
	"Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.6 16/50] Revert "mptcp: add needs_id for netlink appending addr"
Date: Mon, 13 Apr 2026 18:00:43 +0200	[thread overview]
Message-ID: <20260413155725.117835298@linuxfoundation.org> (raw)
In-Reply-To: <20260413155724.497323914@linuxfoundation.org>

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>

[ Upstream commit 8e2760eaab778494fc1fa257031e0e1799647f46 ]

This commit was originally adding the ability to add MPTCP endpoints
with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
net namespace level, is not supposed to handle endpoints with such ID,
because this ID 0 is reserved to the initial subflow, as mentioned in
the MPTCPv1 protocol [1], a per-connection setting.

Note that 'ip mptcp endpoint add id 0' stops early with an error, but
other tools might still request the in-kernel PM to create MPTCP
endpoints with this restricted ID 0.

In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
helper to check whether the address ID attribute is set: if it was set
to 0, a new MPTCP endpoint would be created with ID 0, which is not
expected, and might cause various issues later.

Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
Cc: stable@vger.kernel.org
Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied changes to net/mptcp/pm_netlink.c instead of renamed net/mptcp/pm_kernel.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/pm_netlink.c |   24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)

--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -1079,7 +1079,7 @@ static void __mptcp_pm_release_addr_entr
 
 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 					     struct mptcp_pm_addr_entry *entry,
-					     bool needs_id, bool replace)
+					     bool replace)
 {
 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
 	unsigned int addr_max;
@@ -1138,7 +1138,7 @@ static int mptcp_pm_nl_append_new_local_
 		}
 	}
 
-	if (!entry->addr.id && needs_id) {
+	if (!entry->addr.id) {
 find_next:
 		entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
 						    MPTCP_PM_MAX_ADDR_ID + 1,
@@ -1149,7 +1149,7 @@ find_next:
 		}
 	}
 
-	if (!entry->addr.id && needs_id)
+	if (!entry->addr.id)
 		goto out;
 
 	__set_bit(entry->addr.id, pernet->id_bitmap);
@@ -1282,7 +1282,7 @@ int mptcp_pm_nl_get_local_id(struct mptc
 	entry->ifindex = 0;
 	entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
 	entry->lsk = NULL;
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, false);
 	if (ret < 0)
 		kfree(entry);
 
@@ -1524,18 +1524,6 @@ next:
 	return 0;
 }
 
-static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
-				      struct genl_info *info)
-{
-	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
-
-	if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
-					 mptcp_pm_addr_policy, info->extack) &&
-	    tb[MPTCP_PM_ADDR_ATTR_ID])
-		return true;
-	return false;
-}
-
 static int mptcp_nl_cmd_add_addr(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nlattr *attr = info->attrs[MPTCP_PM_ATTR_ADDR];
@@ -1577,9 +1565,7 @@ static int mptcp_nl_cmd_add_addr(struct
 			goto out_free;
 		}
 	}
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
-						!mptcp_pm_has_addr_attr_id(attr, info),
-						true);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
 	if (ret < 0) {
 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
 		goto out_free;



  parent reply	other threads:[~2026-04-13 16:14 UTC|newest]

Thread overview: 65+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-13 16:00 [PATCH 6.6 00/50] 6.6.135-rc1 review Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 01/50] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 02/50] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 03/50] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 04/50] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 05/50] mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 06/50] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 07/50] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 08/50] MIPS: Always record SEGBITS in cpu_data.vmbits Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 09/50] MIPS: mm: Suppress TLB uniquification on EHINV hardware Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 10/50] MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 11/50] ASoC: simple-card-utils: Dont use __free(device_node) at graph_util_parse_dai() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 12/50] scsi: ufs: core: Fix use-after free in init error and remove paths Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 13/50] virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 14/50] mptcp: fix soft lockup in mptcp_recvmsg() Greg Kroah-Hartman
2026-04-14  1:30   ` Li Xiasong
2026-04-14 12:08     ` Sasha Levin
2026-04-13 16:00 ` [PATCH 6.6 15/50] usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman
2026-04-13 16:00 ` Greg Kroah-Hartman [this message]
2026-04-13 16:00 ` [PATCH 6.6 17/50] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 18/50] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 19/50] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 20/50] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 21/50] xfrm: clear trailing padding in build_polexpire() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 22/50] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 23/50] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 24/50] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 25/50] arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 26/50] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 27/50] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 28/50] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 29/50] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 30/50] X.509: Fix out-of-bounds access when parsing extensions Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 31/50] EDAC/mc: Fix error path ordering in edac_mc_alloc() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.6 32/50] net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 33/50] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 34/50] batman-adv: hold claim backbone gateways by reference Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 35/50] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 36/50] net/mlx5: Update the list of the PCI supported devices Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 37/50] pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 38/50] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 39/50] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 40/50] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 41/50] mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 42/50] net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 43/50] rxrpc: Fix call removal to use RCU safe deletion Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 44/50] rxrpc: Fix key reference count leak from call->key Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 45/50] rxrpc: Only put the call ref if one was acquired Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 46/50] rxrpc: reject undecryptable rxkad response tickets Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 47/50] rxrpc: fix reference count leak in rxrpc_server_keyring() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 48/50] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 49/50] rxrpc: Fix missing error checks for rxkad encryption/decryption failure Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.6 50/50] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Greg Kroah-Hartman
2026-04-13 17:43 ` [PATCH 6.6 00/50] 6.6.135-rc1 review Brett A C Sheffield
2026-04-13 19:14 ` Florian Fainelli
2026-04-14  7:53 ` Jon Hunter
2026-04-14  8:10 ` Pavel Machek
2026-04-14  9:30 ` Peter Schneider
2026-04-14 11:43 ` Ron Economos
2026-04-14 12:31 ` Francesco Dolcini
2026-04-14 15:01 ` Barry K. Nathan
2026-04-14 17:43 ` Shuah Khan
2026-04-14 17:48 ` Miguel Ojeda
2026-04-15  3:49 ` Shung-Hsi Yu
2026-04-15 10:16 ` Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260413155725.117835298@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=geliang@kernel.org \
    --cc=kuba@kernel.org \
    --cc=matttbe@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.