From: Geliang Tang <tanggeliang@kylinos.cn>

Commit 1c670b39cec7 ("mptcp: change local addr type of subflow_destroy")
introduced a bug in mptcp_pm_nl_subflow_destroy_doit().

ipv6_addr_set_v4mapped() should be called to set the remote ipv4 address
'addr_r.addr.s_addr' to the remote ipv6 address 'addr_r.addr6', not
'addr_l.addr.addr6', which is the local ipv6 address.

Fixes: 1c670b39cec7 ("mptcp: change local addr type of subflow_destroy")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Note: this is a fix for an issue only present in net-next, not in net.
---
 net/mptcp/pm_userspace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
index 740a10d669f859baec975556f1d7c4e90df62c4a..a3d477059b11c3a5618dbb6256434a8e55845995 100644
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -520,7 +520,7 @@ int mptcp_pm_nl_subflow_destroy_doit(struct sk_buff *skb, struct genl_info *info
 		addr_l.addr.family = AF_INET6;
 	}
 	if (addr_r.family == AF_INET && ipv6_addr_v4mapped(&addr_l.addr.addr6)) {
-		ipv6_addr_set_v4mapped(addr_r.addr.s_addr, &addr_l.addr.addr6);
+		ipv6_addr_set_v4mapped(addr_r.addr.s_addr, &addr_r.addr6);
 		addr_r.family = AF_INET6;
 	}
 #endif

---
base-commit: 9c7ad35632297edc08d0f2c7b599137e9fb5f9ff
change-id: 20250114-net-next-mptcp-fix-remote-addr-e7e84620e7a4

Best regards,
-- 
Matthieu Baerts (NGI0) <matttbe@kernel.org>

On Tue, 14 Jan 2025 19:06:22 +0100 Matthieu Baerts (NGI0) wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> Commit 1c670b39cec7 ("mptcp: change local addr type of subflow_destroy")
> introduced a bug in mptcp_pm_nl_subflow_destroy_doit().
> 
> ipv6_addr_set_v4mapped() should be called to set the remote ipv4 address
> 'addr_r.addr.s_addr' to the remote ipv6 address 'addr_r.addr6', not
> 'addr_l.addr.addr6', which is the local ipv6 address.

Wasn't there a syzbot report for this? Just curious.

Hi Jakub,

On 15/01/2025 22:21, Jakub Kicinski wrote:
> On Tue, 14 Jan 2025 19:06:22 +0100 Matthieu Baerts (NGI0) wrote:
>> From: Geliang Tang <tanggeliang@kylinos.cn>
>>
>> Commit 1c670b39cec7 ("mptcp: change local addr type of subflow_destroy")
>> introduced a bug in mptcp_pm_nl_subflow_destroy_doit().
>>
>> ipv6_addr_set_v4mapped() should be called to set the remote ipv4 address
>> 'addr_r.addr.s_addr' to the remote ipv6 address 'addr_r.addr6', not
>> 'addr_l.addr.addr6', which is the local ipv6 address.
> 
> Wasn't there a syzbot report for this? Just curious.

Apparently no :)

From what I understood, Geliang spotted that while looking at the code
around.

Thank you for having applied the patches!

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.