Tao Cui 14e9fea30b mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation ... The userspace PM increments extra_subflows after __mptcp_subflow_connect() succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to roll back the pre-increment done by the kernel PM's fill_*() helpers. Because the userspace PM hasn't incremented yet at that point, this decrement is spurious and causes extra_subflows to underflow. Fix it by aligning the userspace PM with the kernel PM: increment extra_subflows before calling __mptcp_subflow_connect(), so the existing error path in subflow.c correctly rolls it back on failure. Also simplify the error handling by taking pm.lock only when needed for cleanup. Fixes: 77e4b94a3d ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui <cuitao@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-06-03 19:04:26 -07:00
..
6lowpan	6lowpan: fix off-by-one in multicast context address compression	2026-06-01 19:10:16 -07:00
9p	9p/trans_xen: replace simple_strto* with kstrtouint	2026-04-16 02:57:01 +00:00
802	net: garp: fix unsigned integer underflow in garp_pdu_parse_attr	2026-06-02 12:16:53 -07:00
8021q	8021q: delete cleared egress QoS mappings	2026-04-23 12:13:57 +02:00
appletalk	appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak	2026-06-03 18:08:58 -07:00
atm	net: atm: fix skb leak in sigd_send() default branch	2026-05-12 18:07:02 -07:00
batman-adv	batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface	2026-05-19 10:43:54 +02:00
bluetooth	Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()	2026-05-28 08:52:21 -04:00
bpf	bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb	2026-04-12 15:42:57 -07:00
bridge	netfilter: bridge: make ebt_snat ARP rewrite writable	2026-06-01 13:43:53 +02:00
can	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
ceph	libceph: Fix potential null-ptr-deref in decode_choose_args()	2026-05-12 21:00:59 +02:00
core	net: Annotate sk->sk_write_space() for UDP SOCKMAP.	2026-06-02 11:44:43 -07:00
dcb	…
devlink	devlink: Release nested relation on devlink free	2026-06-01 19:54:52 -07:00
dns_resolver	…
dsa	net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops	2026-04-16 19:10:48 -07:00
ethernet	…
ethtool	ethtool: eeprom: add more safeties to EEPROM Netlink fallback	2026-05-27 17:42:09 -07:00
handshake	net/handshake: Drain pending requests at net namespace exit	2026-05-28 13:35:32 +02:00
hsr	hsr: Remove WARN_ONCE() in hsr_addr_is_self().	2026-06-02 12:04:52 -07:00
ieee802154	…
ife	…
ipv4	ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options	2026-06-03 18:53:14 -07:00
ipv6	ipv6: anycast: insert aca into global hash under idev->lock	2026-06-02 19:30:39 -07:00
iucv	net/iucv: fix locking in .getsockopt	2026-05-22 17:40:32 -07:00
kcm	…
key	xfrm: route MIGRATE notifications to caller's netns	2026-05-07 09:31:10 +02:00
l2tp	l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()	2026-06-01 19:40:46 -07:00
l3mdev	…
lapb	…
llc	llc: Return -EINPROGRESS from llc_ui_connect()	2026-04-23 11:40:39 -07:00
mac80211	wifi: mac80211: consume only present negotiated TTLM maps	2026-05-20 11:20:37 +02:00
mac802154	…
mctp	net: mctp: test: Use dev_direct_xmit for TX to our test device	2026-04-30 13:36:47 -07:00
mpls	…
mptcp	mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation	2026-06-03 19:04:26 -07:00
ncsi	…
netfilter	netfilter: nft_byteorder: remove multi-register support	2026-06-01 13:43:53 +02:00
netlabel	…
netlink	net: netlink: don't set nsid on local notifications	2026-05-22 17:11:09 -07:00
nfc	nfc: hci: fix out-of-bounds read in HCP header parsing	2026-05-07 12:42:09 +02:00
nsh	…
openvswitch	openvswitch: vport: fix race between linking and the device notifier	2026-05-18 16:38:45 -07:00
packet	net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()	2026-04-22 20:16:34 -07:00
phonet	phonet/pep: disable BH around forwarded sk_receive_skb()	2026-05-21 07:38:21 -07:00
psample	…
psp	psp: strip variable-length PSP header in psp_dev_rcv()	2026-05-04 19:25:14 -07:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
rds	net: rds: clear i_sends on setup unwind	2026-06-02 13:31:27 -07:00
rfkill	…
rxrpc	rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer	2026-05-20 16:36:45 -07:00
sched	net/sched: act_api: use RCU with deferred freeing for action lifecycle	2026-06-01 16:52:08 -07:00
sctp	sctp: diag: reject stale associations in dump_one path	2026-06-02 14:25:17 -07:00
shaper	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
smc	net/smc: Do not re-initialize smc hashtables	2026-05-22 17:38:02 -07:00
strparser	net: strparser: fix skb_head leak in strp_abort_strp()	2026-04-14 12:37:00 +02:00
sunrpc	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
switchdev	…
tipc	Including fixes from Netfilter.	2026-04-23 16:50:42 -07:00
tls	tls: Preserve sk_err across recvmsg() when data has been copied	2026-05-14 18:19:44 -07:00
unix	af_unix: Fix inq_len update problem in partial read	2026-06-03 18:52:25 -07:00
vmw_vsock	vsock/virtio: bind uarg before filling zerocopy skb	2026-05-29 12:38:00 -07:00
wireless	wifi: cfg80211: wext: validate chandef in monitor mode	2026-05-20 11:44:19 +02:00
x25	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
xdp	xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()	2026-06-03 17:45:42 -07:00
xfrm	xfrm: input: hold netns during deferred transport reinjection	2026-05-26 10:35:30 +02:00
Kconfig	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
Kconfig.debug	…
Makefile	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
compat.c	…
devres.c	…
socket.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
sysctl_net.c	…