[PATCH net 10/10] mptcp: check desc->count in read_sock

From: Matthieu Baerts (NGI0)

Date: Sun May 31 2026 - 23:12:44 EST


From: Gang Yan <yangang@xxxxxxxxxx>

__tcp_read_sock() checks desc->count after each skb is consumed and
breaks the loop when it reaches 0. The MPTCP variant lacks this check.

This is a functional bug, other subsystems also rely on this check:
TLS strparser sets desc->count to 0 once a full TLS record is assembled
and depends on this break to stop reading.

Add the same desc->count check to __mptcp_read_sock(), mirroring
__tcp_read_sock().

Fixes: 250d9766a984 ("mptcp: implement .read_sock")
Cc: stable@xxxxxxxxxxxxxxx
Co-developed-by: Geliang Tang <geliang@xxxxxxxxxx>
Signed-off-by: Geliang Tang <geliang@xxxxxxxxxx>
Signed-off-by: Gang Yan <yangang@xxxxxxxxxx>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
---
net/mptcp/protocol.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 7fac5fac2097..cb9515f505aa 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -4428,6 +4428,8 @@ static int __mptcp_read_sock(struct sock *sk, read_descriptor_t *desc,
}

mptcp_eat_recv_skb(sk, skb);
+ if (!desc->count)
+ break;
}

if (noack)

--
2.53.0