title: mptcp: really cope with fastopen race
description: In the Linux kernel, the following vulnerability has been resolved:
mptcp: really cope with fastopen race
Fastopen and PM-trigger subflow shutdown can race, as reported by
syzkaller.
In my first attempt to close such race, I missed the fact that
the subflow status can change again before the subflow_state_change
callback is invoked.
Address the issue additionally copying with all the states directly
reachable from TCP_FIN_WAIT1.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 1e777f39b4d7, lessThan: 4bfe217e075d, status: affected, versionType: git
version: 1e777f39b4d7, lessThan: e158fb9679d1, status: affected, versionType: git
version: 1e777f39b4d7, lessThan: 337cebbd850f, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.2, status: affected
version: 0, lessThan: 6.2, status: unaffected, versionType: custom
version: 6.6.18, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.6, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
