5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paolo Abeni commit 42064de57fb83231fcc89663a94885f228a1ee53 upstream. The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario. Fixes: c886d70286bf ("mptcp: do not queue data on closed subflows") Cc: stable@vger.kernel.org Reported-by: Shardul Bankar Reported-by: Xinyang Ge Closes: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricsoftware.com Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-2-0cf5c72667c8@kernel.org Signed-off-by: Jakub Kicinski [ Note: moved the mss_now check in previous places before commit d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()") which is not in this version. ] Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Greg Kroah-Hartman --- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1381,7 +1381,7 @@ restart: } mptcp_set_timeout(sk, ssk); - if (copied) { + if (copied && mss_now) { tcp_push(ssk, msg->msg_flags, mss_now, tcp_sk(ssk)->nonagle, size_goal); @@ -1891,7 +1891,7 @@ static void mptcp_worker(struct work_str if (!mptcp_ext_cache_refill(msk)) break; } - if (copied) { + if (copied && mss_now) { tcp_push(ssk, msg.msg_flags, mss_now, tcp_sk(ssk)->nonagle, size_goal); WRITE_ONCE(msk->allow_infinite_fallback, false);