Re: [PATCH mptcp-net] mptcp: disconnect: reset first subflow's local_id

[Mat Martineau <martineau@kernel.org>]

On Thu, 15 Oct 2026, Matthieu Baerts (NGI0) wrote:

> The first subflow can get disconnected for various reasons and
> mptcp_subflow_ctx_reset() will reset most fields and set local_id to -1.
> That's fine until the subflow is reused after a reconnect.
>
> As mentioned by Clashiko [1]: on the retry, local_id is -1, so the
> connect goes through:
>
>  tcp_connect()
>    subflow_rebuild_header()
>      subflow_chk_local_id()
>        mptcp_pm_get_local_id()
>
> mptcp_pm_get_local_id() returns 0 only when the msk local address
> matches the subflow's address. The addresses can change, but even if
> they don't, for an unbound msk, the address is therefore still zero at
> this point. (Note: in MPTCP disconnect selftests, the address is the
> same, and mptcp_pm_get_local_id() will return 0.)
>
> At this stage, the kernel PM might then give the MPC subflow a non-zero
> ID, either from a matching endpoint or by adding an "implicit" endpoint.
> The RFC 8684 says that the first subflow always has the ID 0, and the
> PMs rely on that for special cases. So it is important to reset it to 0.
>
> Note that we need to keep it to -1 in mptcp_subflow_ctx_reset() to avoid
> a double closures in mptcp_close_ssk().
>
> This issue was found by code analysis, and confirmed by looking at the
> ID after a reconnection.
>
> Fixes: a7cfe7766370 ("mptcp: fix data races on local_id")
> Link: https://lore.kernel.org/179198834484.434549.4616694240552704738@kernel.org
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> ---
> net/mptcp/protocol.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
> index 60cbd91be632..4a6f16e0d809 100644
> --- a/net/mptcp/protocol.c
> +++ b/net/mptcp/protocol.c
> @@ -3654,6 +3654,7 @@ static int mptcp_disconnect(struct sock *sk, int flags)
> 	 */
> 	mptcp_do_fastclose(sk);
> 	mptcp_destroy_common(msk);
> +	WRITE_ONCE(mptcp_subflow_ctx(msk->first)->local_id, 0);
>
> 	/* The first subflow is already in TCP_CLOSE status, the following
> 	 * can't overlap with a fallback anymore
>
> ---
> base-commit: 6a6728a8e881c12c984d104403ecaa0523d3b7e8
> change-id: 20261015-mptcp-first-disco-id-reset-a0866d67d9a6
>

Fix looks good, thanks Matthieu

Reviewed-by: Mat Martineau <martineau@kernel.org>