From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Geliang Tang <geliang@kernel.org>,
"Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.12 26/70] Revert "mptcp: add needs_id for netlink appending addr"
Date: Mon, 13 Apr 2026 18:00:21 +0200 [thread overview]
Message-ID: <20260413155729.164812636@linuxfoundation.org> (raw)
In-Reply-To: <20260413155728.181580293@linuxfoundation.org>
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit 8e2760eaab778494fc1fa257031e0e1799647f46 ]
This commit was originally adding the ability to add MPTCP endpoints
with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
net namespace level, is not supposed to handle endpoints with such ID,
because this ID 0 is reserved to the initial subflow, as mentioned in
the MPTCPv1 protocol [1], a per-connection setting.
Note that 'ip mptcp endpoint add id 0' stops early with an error, but
other tools might still request the in-kernel PM to create MPTCP
endpoints with this restricted ID 0.
In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
helper to check whether the address ID attribute is set: if it was set
to 0, a new MPTCP endpoint would be created with ID 0, which is not
expected, and might cause various issues later.
Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
Cc: stable@vger.kernel.org
Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied changes to net/mptcp/pm_netlink.c instead of renamed net/mptcp/pm_kernel.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm_netlink.c | 24 +++++-------------------
1 file changed, 5 insertions(+), 19 deletions(-)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -1076,7 +1076,7 @@ static void __mptcp_pm_release_addr_entr
static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
struct mptcp_pm_addr_entry *entry,
- bool needs_id, bool replace)
+ bool replace)
{
struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
unsigned int addr_max;
@@ -1135,7 +1135,7 @@ static int mptcp_pm_nl_append_new_local_
}
}
- if (!entry->addr.id && needs_id) {
+ if (!entry->addr.id) {
find_next:
entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
MPTCP_PM_MAX_ADDR_ID + 1,
@@ -1146,7 +1146,7 @@ find_next:
}
}
- if (!entry->addr.id && needs_id)
+ if (!entry->addr.id)
goto out;
__set_bit(entry->addr.id, pernet->id_bitmap);
@@ -1279,7 +1279,7 @@ int mptcp_pm_nl_get_local_id(struct mptc
entry->ifindex = 0;
entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
entry->lsk = NULL;
- ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
+ ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, false);
if (ret < 0)
kfree(entry);
@@ -1498,18 +1498,6 @@ next:
return 0;
}
-static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
- struct genl_info *info)
-{
- struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
-
- if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
- mptcp_pm_address_nl_policy, info->extack) &&
- tb[MPTCP_PM_ADDR_ATTR_ID])
- return true;
- return false;
-}
-
int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
{
struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
@@ -1551,9 +1539,7 @@ int mptcp_pm_nl_add_addr_doit(struct sk_
goto out_free;
}
}
- ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
- !mptcp_pm_has_addr_attr_id(attr, info),
- true);
+ ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
if (ret < 0) {
GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
goto out_free;
next prev parent reply other threads:[~2026-04-13 16:11 UTC|newest]
Thread overview: 90+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-13 15:59 [PATCH 6.12 00/70] 6.12.82-rc1 review Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 01/70] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 02/70] usb: typec: ucsi: skip connector validation before init Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 03/70] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 04/70] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 05/70] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 06/70] mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 07/70] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 08/70] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 09/70] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 10/70] MIPS: Always record SEGBITS in cpu_data.vmbits Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 11/70] MIPS: mm: Suppress TLB uniquification on EHINV hardware Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 12/70] MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 13/70] ASoC: simple-card-utils: Dont use __free(device_node) at graph_util_parse_dai() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 14/70] btrfs: make wait_on_extent_buffer_writeback() static inline Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 15/70] btrfs: remove unused define WAIT_PAGE_LOCK for extent io Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 16/70] btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 17/70] btrfs: remove unused flag EXTENT_BUFFER_READAHEAD Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 18/70] btrfs: remove unused flag EXTENT_BUFFER_CORRUPT Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 19/70] btrfs: remove pointless out labels from extent-tree.c Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 20/70] btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 21/70] blktrace: fix __this_cpu_read/write in preemptible context Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 22/70] nfc: nci: complete pending data exchange on device close Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 23/70] arm64: dts: renesas: white-hawk-cpu-common: Add pin control for DSI-eDP IRQ Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 24/70] misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 25/70] sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Greg Kroah-Hartman
2026-04-13 16:00 ` Greg Kroah-Hartman [this message]
2026-04-13 16:00 ` [PATCH 6.12 27/70] net: annotate data-races around sk->sk_{data_ready,write_space} Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 28/70] mptcp: fix soft lockup in mptcp_recvmsg() Greg Kroah-Hartman
2026-04-14 1:52 ` Li Xiasong
2026-04-14 12:08 ` Sasha Levin
2026-04-13 16:00 ` [PATCH 6.12 29/70] LoongArch: Remove unnecessary checks for ORC unwinder Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 30/70] LoongArch: Handle percpu handler address " Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 31/70] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 32/70] workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 33/70] xfrm: clear trailing padding in build_polexpire() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 34/70] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 35/70] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 36/70] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 37/70] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 38/70] arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 39/70] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 40/70] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 41/70] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 42/70] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 43/70] X.509: Fix out-of-bounds access when parsing extensions Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 44/70] EDAC/mc: Fix error path ordering in edac_mc_alloc() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 45/70] net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 46/70] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 47/70] batman-adv: hold claim backbone gateways by reference Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 48/70] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 49/70] drm/i915/psr: Do not use pipe_src as borders for SU area Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 50/70] net/mlx5: Update the list of the PCI supported devices Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 51/70] pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 52/70] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 53/70] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 54/70] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 55/70] mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 56/70] idpf: improve locking around idpf_vc_xn_push_free() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 57/70] idpf: set the payload size before calling the async handler Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 58/70] net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 59/70] net: lan966x: fix page pool leak in error paths Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 60/70] net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 61/70] rxrpc: Fix anonymous key handling Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 62/70] rxrpc: Fix call removal to use RCU safe deletion Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 63/70] rxrpc: Fix key reference count leak from call->key Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 64/70] rxrpc: Only put the call ref if one was acquired Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 65/70] rxrpc: reject undecryptable rxkad response tickets Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 66/70] rxrpc: fix reference count leak in rxrpc_server_keyring() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 67/70] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 68/70] rxrpc: Fix missing error checks for rxkad encryption/decryption failure Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 69/70] net: skb: fix cross-cache free of KFENCE-allocated skb head Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 70/70] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Greg Kroah-Hartman
2026-04-13 17:42 ` [PATCH 6.12 00/70] 6.12.82-rc1 review Brett A C Sheffield
2026-04-13 19:02 ` Florian Fainelli
2026-04-14 0:29 ` Barry K. Nathan
2026-04-14 7:54 ` Jon Hunter
2026-04-14 8:11 ` Pavel Machek
2026-04-14 11:37 ` Ron Economos
2026-04-14 12:32 ` Francesco Dolcini
2026-04-14 17:08 ` Peter Schneider
2026-04-14 17:43 ` Shuah Khan
2026-04-14 18:01 ` Miguel Ojeda
2026-04-15 1:34 ` Harshit Mogalapalli
2026-04-15 3:49 ` Shung-Hsi Yu
2026-04-15 10:13 ` Mark Brown
2026-04-15 18:45 ` Dileep malepu
2026-04-16 18:55 ` Eddie Chapman
2026-04-17 6:25 ` Greg Kroah-Hartman
2026-04-17 15:34 ` Eddie Chapman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260413155729.164812636@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=geliang@kernel.org \
--cc=kuba@kernel.org \
--cc=matttbe@kernel.org \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.