Commit 280d654324e3 for kernel

commit 280d654324e33f8e6e3641f76764694c7b64c5db
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Tue Jan 27 20:27:23 2026 +0100

    mptcp: avoid dup SUB_CLOSED events after disconnect

    In case of subflow disconnect(), which can also happen with the first
    subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset
    will reset most fields from the mptcp_subflow_context structure,
    including close_event_done. Then, when another subflow is closed, yet
    another SUB_CLOSED event for the disconnected initial subflow is sent.
    Because of the previous reset, there are no source address and
    destination port.

    A solution is then to also check the subflow's local id: it shouldn't be
    negative anyway.

    Another solution would be not to reset subflow->close_event_done at
    disconnect time, but when reused. But then, probably the whole reset
    could be done when being reused. Let's not change this logic, similar
    to TCP with tcp_disconnect().

    Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
    Cc: stable@vger.kernel.org
    Reported-by: Marco Angaroni <marco.angaroni@italtel.com>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/603
    Reviewed-by: Geliang Tang <geliang@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-1-7f71e1bc4feb@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f505b780f713..e32ae594b4ef 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2598,8 +2598,8 @@ void mptcp_close_ssk(struct sock *sk, struct sock *ssk,
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	struct sk_buff *skb;

-	/* The first subflow can already be closed and still in the list */
-	if (subflow->close_event_done)
+	/* The first subflow can already be closed or disconnected */
+	if (subflow->close_event_done || READ_ONCE(subflow->local_id) < 0)
 		return;

 	subflow->close_event_done = true;