Commit 41b49a8b914e for kernel

commit 41b49a8b914ec7dcb03eae93fb27f3c464078644
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Mon Aug 3 18:16:40 2026 +0200

    mptcp: reclaim forward-allocated memory on RX path errors

    After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"),
    errors in the receive path prior to queueing skbs into the receive
    queue do not trigger forward-allocated memory reclaiming.

    Prevent forward memory from growing unboundedly in pathological drop
    scenarios by explicitly reclaiming memory when skbs are dropped.

    Fixes: 9db5b3cec4ec ("mptcp: borrow forward memory from subflow")
    Cc: stable@vger.kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-8-b8f496d71664@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index ca644ec53eed..7c8180d8d5ef 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -149,6 +149,12 @@ struct sock *__mptcp_nmpc_sk(struct mptcp_sock *msk)

 static void mptcp_drop(struct sock *sk, struct sk_buff *skb)
 {
+	/* The skb forward memory was already transferred to sk by
+	 * mptcp_borrow_fwdmem(), even before setting the destructor.
+	 */
+	if (!skb->destructor)
+		sk_mem_reclaim(sk);
+
 	sk_drops_skbadd(sk, skb);
 	__kfree_skb(skb);
 }