public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Geliang Tang <geliang@kernel.org>,
	"Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 6.19 07/86] Revert "mptcp: add needs_id for netlink appending addr"
Date: Mon, 13 Apr 2026 17:59:14 +0200	[thread overview]
Message-ID: <20260413155731.848141693@linuxfoundation.org> (raw)
In-Reply-To: <20260413155731.568515178@linuxfoundation.org>

6.19-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matthieu Baerts (NGI0) <matttbe@kernel.org>

commit 8e2760eaab778494fc1fa257031e0e1799647f46 upstream.

This commit was originally adding the ability to add MPTCP endpoints
with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
net namespace level, is not supposed to handle endpoints with such ID,
because this ID 0 is reserved to the initial subflow, as mentioned in
the MPTCPv1 protocol [1], a per-connection setting.

Note that 'ip mptcp endpoint add id 0' stops early with an error, but
other tools might still request the in-kernel PM to create MPTCP
endpoints with this restricted ID 0.

In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
helper to check whether the address ID attribute is set: if it was set
to 0, a new MPTCP endpoint would be created with ID 0, which is not
expected, and might cause various issues later.

Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
Cc: stable@vger.kernel.org
Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/pm_kernel.c |   24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)

--- a/net/mptcp/pm_kernel.c
+++ b/net/mptcp/pm_kernel.c
@@ -720,7 +720,7 @@ static void __mptcp_pm_release_addr_entr
 
 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 					     struct mptcp_pm_addr_entry *entry,
-					     bool needs_id, bool replace)
+					     bool replace)
 {
 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
 	int ret = -EINVAL;
@@ -779,7 +779,7 @@ static int mptcp_pm_nl_append_new_local_
 		}
 	}
 
-	if (!entry->addr.id && needs_id) {
+	if (!entry->addr.id) {
 find_next:
 		entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
 						    MPTCP_PM_MAX_ADDR_ID + 1,
@@ -790,7 +790,7 @@ find_next:
 		}
 	}
 
-	if (!entry->addr.id && needs_id)
+	if (!entry->addr.id)
 		goto out;
 
 	__set_bit(entry->addr.id, pernet->id_bitmap);
@@ -923,7 +923,7 @@ int mptcp_pm_nl_get_local_id(struct mptc
 		return -ENOMEM;
 
 	entry->addr.port = 0;
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, false);
 	if (ret < 0)
 		kfree(entry);
 
@@ -977,18 +977,6 @@ next:
 	return 0;
 }
 
-static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
-				      struct genl_info *info)
-{
-	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
-
-	if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
-					 mptcp_pm_address_nl_policy, info->extack) &&
-	    tb[MPTCP_PM_ADDR_ATTR_ID])
-		return true;
-	return false;
-}
-
 /* Add an MPTCP endpoint */
 int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
 {
@@ -1037,9 +1025,7 @@ int mptcp_pm_nl_add_addr_doit(struct sk_
 			goto out_free;
 		}
 	}
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
-						!mptcp_pm_has_addr_attr_id(attr, info),
-						true);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
 	if (ret < 0) {
 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
 		goto out_free;



  parent reply	other threads:[~2026-04-13 16:04 UTC|newest]

Thread overview: 100+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-13 15:59 [PATCH 6.19 00/86] 6.19.13-rc1 review Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 01/86] usb: typec: ucsi: skip connector validation before init Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 02/86] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 03/86] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 04/86] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 05/86] Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 06/86] ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL Greg Kroah-Hartman
2026-04-13 15:59 ` Greg Kroah-Hartman [this message]
2026-04-13 15:59 ` [PATCH 6.19 08/86] mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 09/86] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 10/86] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 11/86] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 12/86] MIPS: Always record SEGBITS in cpu_data.vmbits Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 13/86] MIPS: mm: Suppress TLB uniquification on EHINV hardware Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 14/86] MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 15/86] btrfs: remove pointless out labels from extent-tree.c Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 16/86] btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 17/86] i2c: imx: zero-initialize dma_slave_config for eDMA Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 18/86] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 19/86] firmware: thead: Fix buffer overflow and use standard endian macros Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 20/86] workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 21/86] modpost: Declare extra_warn with unused attribute Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 22/86] xfrm: clear trailing padding in build_polexpire() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 23/86] xfrm: hold dev ref until after transport_finish NF_HOOK Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 24/86] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 25/86] kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 26/86] ASoC: SOF: Intel: hda: modify period size constraints for ACE4 Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 27/86] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 28/86] x86/mce/amd: Filter bogus hardware errors on Zen3 clients Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 29/86] platform/x86: ISST: Reset core count to 0 Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 30/86] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 31/86] Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 32/86] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 33/86] arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 34/86] arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 35/86] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 36/86] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 37/86] liveupdate: propagate file deserialization failures Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 38/86] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 39/86] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 40/86] X.509: Fix out-of-bounds access when parsing extensions Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 41/86] EDAC/mc: Fix error path ordering in edac_mc_alloc() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 42/86] net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 43/86] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 44/86] batman-adv: hold claim backbone gateways by reference Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 45/86] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 46/86] drm/i915/psr: Do not use pipe_src as borders for SU area Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 47/86] net/mlx5: Update the list of the PCI supported devices Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 48/86] pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 49/86] igb: remove napi_synchronize() in igb_down() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 50/86] mm/vma: fix memory leak in __mmap_region() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 51/86] mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 6.19 52/86] mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 53/86] mm/damon/stat: deallocate damon_call() failure leaking damon_ctx Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 54/86] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 55/86] mmc: vub300: fix use-after-free " Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 56/86] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 57/86] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 58/86] mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 59/86] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 60/86] idpf: improve locking around idpf_vc_xn_push_free() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 61/86] idpf: set the payload size before calling the async handler Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 62/86] net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 63/86] net: lan966x: fix page pool leak in error paths Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 64/86] net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 65/86] rxrpc: Fix key quota calculation for multitoken keys Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 66/86] rxrpc: Fix key parsing memleak Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 67/86] rxrpc: Fix anonymous key handling Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 68/86] rxrpc: Fix call removal to use RCU safe deletion Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 69/86] rxrpc: Fix RxGK token loading to check bounds Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 70/86] rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 71/86] rxrpc: Fix rack timer warning to report unexpected mode Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 72/86] rxrpc: Fix key reference count leak from call->key Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 73/86] rxrpc: Fix to request an ack if window is limited Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 74/86] rxrpc: Only put the call ref if one was acquired Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 75/86] rxrpc: reject undecryptable rxkad response tickets Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 76/86] rxrpc: fix RESPONSE authenticator parser OOB read Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 77/86] rxrpc: fix oversized RESPONSE authenticator length check Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 78/86] rxrpc: fix reference count leak in rxrpc_server_keyring() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 79/86] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 80/86] rxrpc: Fix missing error checks for rxkad encryption/decryption failure Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 81/86] rxrpc: Fix integer overflow in rxgk_verify_response() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 82/86] rxrpc: Fix leak of rxgk context " Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 83/86] rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 84/86] rxrpc: only handle RESPONSE during service challenge Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 85/86] rxrpc: proc: size address buffers for %pISpc output Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 6.19 86/86] net: skb: fix cross-cache free of KFENCE-allocated skb head Greg Kroah-Hartman
2026-04-13 17:01 ` [PATCH 6.19 00/86] 6.19.13-rc1 review Ronald Warsow
2026-04-13 17:43 ` Brett A C Sheffield
2026-04-13 19:46 ` Florian Fainelli
2026-04-14  7:54 ` Jon Hunter
2026-04-14 11:25 ` Ron Economos
2026-04-14 11:26 ` Takeshi Ogasawara
2026-04-14 17:42 ` Shuah Khan
2026-04-14 18:17 ` Mark Brown
2026-04-14 18:21 ` Miguel Ojeda
2026-04-14 23:34 ` Peter Schneider
2026-04-15  2:19 ` Barry K. Nathan
2026-04-15  3:47 ` Shung-Hsi Yu
2026-04-15 12:26 ` Dileep malepu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260413155731.848141693@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=geliang@kernel.org \
    --cc=kuba@kernel.org \
    --cc=matttbe@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox