public inbox for patches@lists.linux.dev
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Geliang Tang <geliang@kernel.org>,
	"Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.12 26/70] Revert "mptcp: add needs_id for netlink appending addr"
Date: Mon, 13 Apr 2026 18:00:21 +0200	[thread overview]
Message-ID: <20260413155729.164812636@linuxfoundation.org> (raw)
In-Reply-To: <20260413155728.181580293@linuxfoundation.org>

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>

[ Upstream commit 8e2760eaab778494fc1fa257031e0e1799647f46 ]

This commit was originally adding the ability to add MPTCP endpoints
with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
net namespace level, is not supposed to handle endpoints with such ID,
because this ID 0 is reserved to the initial subflow, as mentioned in
the MPTCPv1 protocol [1], a per-connection setting.

Note that 'ip mptcp endpoint add id 0' stops early with an error, but
other tools might still request the in-kernel PM to create MPTCP
endpoints with this restricted ID 0.

In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
helper to check whether the address ID attribute is set: if it was set
to 0, a new MPTCP endpoint would be created with ID 0, which is not
expected, and might cause various issues later.

Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
Cc: stable@vger.kernel.org
Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied changes to net/mptcp/pm_netlink.c instead of renamed net/mptcp/pm_kernel.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/pm_netlink.c |   24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)

--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -1076,7 +1076,7 @@ static void __mptcp_pm_release_addr_entr
 
 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 					     struct mptcp_pm_addr_entry *entry,
-					     bool needs_id, bool replace)
+					     bool replace)
 {
 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
 	unsigned int addr_max;
@@ -1135,7 +1135,7 @@ static int mptcp_pm_nl_append_new_local_
 		}
 	}
 
-	if (!entry->addr.id && needs_id) {
+	if (!entry->addr.id) {
 find_next:
 		entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
 						    MPTCP_PM_MAX_ADDR_ID + 1,
@@ -1146,7 +1146,7 @@ find_next:
 		}
 	}
 
-	if (!entry->addr.id && needs_id)
+	if (!entry->addr.id)
 		goto out;
 
 	__set_bit(entry->addr.id, pernet->id_bitmap);
@@ -1279,7 +1279,7 @@ int mptcp_pm_nl_get_local_id(struct mptc
 	entry->ifindex = 0;
 	entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
 	entry->lsk = NULL;
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, false);
 	if (ret < 0)
 		kfree(entry);
 
@@ -1498,18 +1498,6 @@ next:
 	return 0;
 }
 
-static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
-				      struct genl_info *info)
-{
-	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
-
-	if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
-					 mptcp_pm_address_nl_policy, info->extack) &&
-	    tb[MPTCP_PM_ADDR_ATTR_ID])
-		return true;
-	return false;
-}
-
 int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
@@ -1551,9 +1539,7 @@ int mptcp_pm_nl_add_addr_doit(struct sk_
 			goto out_free;
 		}
 	}
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
-						!mptcp_pm_has_addr_attr_id(attr, info),
-						true);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
 	if (ret < 0) {
 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
 		goto out_free;



  parent reply	other threads:[~2026-04-13 16:11 UTC|newest]

Thread overview: 89+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-13 15:59 [PATCH 6.12 00/70] 6.12.82-rc1 review Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 01/70] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 02/70] usb: typec: ucsi: skip connector validation before init Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 03/70] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.12 04/70] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 05/70] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 06/70] mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 07/70] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 08/70] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 09/70] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 10/70] MIPS: Always record SEGBITS in cpu_data.vmbits Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 11/70] MIPS: mm: Suppress TLB uniquification on EHINV hardware Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 12/70] MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 13/70] ASoC: simple-card-utils: Dont use __free(device_node) at graph_util_parse_dai() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 14/70] btrfs: make wait_on_extent_buffer_writeback() static inline Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 15/70] btrfs: remove unused define WAIT_PAGE_LOCK for extent io Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 16/70] btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 17/70] btrfs: remove unused flag EXTENT_BUFFER_READAHEAD Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 18/70] btrfs: remove unused flag EXTENT_BUFFER_CORRUPT Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 19/70] btrfs: remove pointless out labels from extent-tree.c Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 20/70] btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 21/70] blktrace: fix __this_cpu_read/write in preemptible context Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 22/70] nfc: nci: complete pending data exchange on device close Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 23/70] arm64: dts: renesas: white-hawk-cpu-common: Add pin control for DSI-eDP IRQ Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 24/70] misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 25/70] sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Greg Kroah-Hartman
2026-04-13 16:00 ` Greg Kroah-Hartman [this message]
2026-04-13 16:00 ` [PATCH 6.12 27/70] net: annotate data-races around sk->sk_{data_ready,write_space} Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 28/70] mptcp: fix soft lockup in mptcp_recvmsg() Greg Kroah-Hartman
2026-04-14  1:52   ` Li Xiasong
2026-04-13 16:00 ` [PATCH 6.12 29/70] LoongArch: Remove unnecessary checks for ORC unwinder Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 30/70] LoongArch: Handle percpu handler address " Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 31/70] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 32/70] workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 33/70] xfrm: clear trailing padding in build_polexpire() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 34/70] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 35/70] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 36/70] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 37/70] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 38/70] arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 39/70] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 40/70] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 41/70] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 42/70] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 43/70] X.509: Fix out-of-bounds access when parsing extensions Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 44/70] EDAC/mc: Fix error path ordering in edac_mc_alloc() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 45/70] net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 46/70] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 47/70] batman-adv: hold claim backbone gateways by reference Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 48/70] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 49/70] drm/i915/psr: Do not use pipe_src as borders for SU area Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 50/70] net/mlx5: Update the list of the PCI supported devices Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 51/70] pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 52/70] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 53/70] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 54/70] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 55/70] mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 56/70] idpf: improve locking around idpf_vc_xn_push_free() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 57/70] idpf: set the payload size before calling the async handler Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 58/70] net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 59/70] net: lan966x: fix page pool leak in error paths Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 60/70] net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 61/70] rxrpc: Fix anonymous key handling Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 62/70] rxrpc: Fix call removal to use RCU safe deletion Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 63/70] rxrpc: Fix key reference count leak from call->key Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.12 64/70] rxrpc: Only put the call ref if one was acquired Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 65/70] rxrpc: reject undecryptable rxkad response tickets Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 66/70] rxrpc: fix reference count leak in rxrpc_server_keyring() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 67/70] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 68/70] rxrpc: Fix missing error checks for rxkad encryption/decryption failure Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 69/70] net: skb: fix cross-cache free of KFENCE-allocated skb head Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 6.12 70/70] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Greg Kroah-Hartman
2026-04-13 17:42 ` [PATCH 6.12 00/70] 6.12.82-rc1 review Brett A C Sheffield
2026-04-13 19:02 ` Florian Fainelli
2026-04-14  0:29 ` Barry K. Nathan
2026-04-14  7:54 ` Jon Hunter
2026-04-14  8:11 ` Pavel Machek
2026-04-14 11:37 ` Ron Economos
2026-04-14 12:32 ` Francesco Dolcini
2026-04-14 17:08 ` Peter Schneider
2026-04-14 17:43 ` Shuah Khan
2026-04-14 18:01 ` Miguel Ojeda
2026-04-15  1:34 ` Harshit Mogalapalli
2026-04-15  3:49 ` Shung-Hsi Yu
2026-04-15 10:13 ` Mark Brown
2026-04-15 18:45 ` Dileep malepu
2026-04-16 18:55 ` Eddie Chapman
2026-04-17  6:25   ` Greg Kroah-Hartman
2026-04-17 15:34     ` Eddie Chapman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260413155729.164812636@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=geliang@kernel.org \
    --cc=kuba@kernel.org \
    --cc=matttbe@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox