Commit 27fd02860164 for kernel

commit 27fd02860164bfa78cec2640dfad630d832e302c
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Tue Nov 25 17:59:11 2025 +0100

    mptcp: clear scheduled subflows on retransmit

    When __mptcp_retrans() kicks-in, it schedules one or more subflows for
    retransmission, but such subflows could be actually left alone if there
    is no more data to retransmit and/or in case of concurrent fallback.

    Scheduled subflows could be processed much later in time, i.e. when new
    data will be transmitted, leading to bad subflow selection.

    Explicitly clear all scheduled subflows before leaving the
    retransmission function.

    Fixes: ee2708aedad0 ("mptcp: use get_retrans wrapper")
    Cc: stable@vger.kernel.org
    Reported-by: Filip Pokryvka <fpokryvk@redhat.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20251125-net-mptcp-clear-sched-rtx-v1-1-1cea4ad2165f@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 33b5dce431c2..8abb425d8b5f 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2665,7 +2665,7 @@ static void __mptcp_retrans(struct sock *sk)
 		}

 		if (!mptcp_send_head(sk))
-			return;
+			goto clear_scheduled;

 		goto reset_timer;
 	}
@@ -2696,7 +2696,7 @@ static void __mptcp_retrans(struct sock *sk)
 			if (__mptcp_check_fallback(msk)) {
 				spin_unlock_bh(&msk->fallback_lock);
 				release_sock(ssk);
-				return;
+				goto clear_scheduled;
 			}

 			while (info.sent < info.limit) {
@@ -2728,6 +2728,15 @@ static void __mptcp_retrans(struct sock *sk)

 	if (!mptcp_rtx_timer_pending(sk))
 		mptcp_reset_rtx_timer(sk);
+
+clear_scheduled:
+	/* If no rtx data was available or in case of fallback, there
+	 * could be left-over scheduled subflows; clear them all
+	 * or later xmit could use bad ones
+	 */
+	mptcp_for_each_subflow(msk, subflow)
+		if (READ_ONCE(subflow->scheduled))
+			mptcp_subflow_set_scheduled(subflow, false);
 }

 /* schedule the timeout timer for the relevant event: either close timeout