(OK) Android-x86-7.1.1/ kernel 4.4.62

gedit kernel/net/mptcp/mptcp_fullmesh.c

static void create_subflow_worker(struct work_struct *work)
{
	struct fullmesh_priv *fmp = container_of(work, struct fullmesh_priv,
						 subflow_work);
	struct mptcp_cb *mpcb = fmp->mpcb;
	struct sock *meta_sk = mpcb->meta_sk;
	struct mptcp_loc_addr *mptcp_local;
	const struct mptcp_fm_ns *fm_ns = fm_get_ns(sock_net(meta_sk));
	int iter = 0, retry = 0;
	int i;

	/* We need a local (stable) copy of the address-list. Really, it is not
	 * such a big deal, if the address-list is not 100% up-to-date.
	 */
	rcu_read_lock_bh();
	mptcp_local = rcu_dereference_bh(fm_ns->local);
	mptcp_local = kmemdup(mptcp_local, sizeof(*mptcp_local), GFP_ATOMIC);
	rcu_read_unlock_bh();

	if (!mptcp_local)
		return;

next_subflow:
	if (iter) {
		release_sock(meta_sk);
		mutex_unlock(&mpcb->mpcb_mutex);

		cond_resched();
	}
	mutex_lock(&mpcb->mpcb_mutex);
	lock_sock_nested(meta_sk, SINGLE_DEPTH_NESTING);

	/* Create the additional subflows for the first pair */
	if (fmp->first_pair == 0 && mpcb->master_sk) {
		struct mptcp_loc4 loc;
		struct mptcp_rem4 rem;

		loc.addr.s_addr = inet_sk(meta_sk)->inet_saddr;
		loc.loc4_id = 0;
		loc.low_prio = 0;
		loc.if_idx = mpcb->master_sk->sk_bound_dev_if;

		rem.addr.s_addr = inet_sk(meta_sk)->inet_daddr;
		rem.port = inet_sk(meta_sk)->inet_dport;
		rem.rem4_id = 0; /* Default 0 */

		mptcp_v4_subflows(meta_sk, &loc, &rem);

		fmp->first_pair = 1;
	}
	iter++;

	if (sock_flag(meta_sk, SOCK_DEAD))
		goto exit;

	if (mpcb->master_sk &&
	    !tcp_sk(mpcb->master_sk)->mptcp->fully_established)
		goto exit;

/*
112.26.0.1 (16783984)
112.26.1.1 (16849520)
112.26.2.1 (16915056)
112.26.3.1 (16980592)
112.26.4.1 (17046128)

112.26.0.6 (100670064)
112.26.1.6 (100735600)
112.26.2.6 (100801136)
112.26.3.6 (100866672)
112.26.4.6 (100932208)
*/

//ztg add
/*
printk(KERN_INFO "mptcp: create_subflow_worker: i = %u
", fmp->rem4_bits);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr0 = %u
", fmp->remaddr4[0].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr1 = %u
", fmp->remaddr4[1].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr2 = %u
", fmp->remaddr4[2].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr3 = %u
", fmp->remaddr4[3].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr4 = %u
", fmp->remaddr4[4].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr5 = %u
", fmp->remaddr4[5].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr6 = %u
", fmp->remaddr4[6].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: remaddr7 = %u
", fmp->remaddr4[7].addr.s_addr);
//*/
printk(KERN_INFO "mptcp: create_subflow_worker: next_subflow
");

	mptcp_for_each_bit_set(fmp->rem4_bits, i) {
		struct fullmesh_rem4 *rem;
		u8 remaining_bits;

		rem = &fmp->remaddr4[i];
		remaining_bits = ~(rem->bitfield) & mptcp_local->loc4_bits;

		/* Are there still combinations to handle? */
		if (remaining_bits) {
			int i = mptcp_find_free_index(~remaining_bits);
			struct mptcp_rem4 rem4;

			rem->bitfield |= (1 << i);

			rem4.addr = rem->addr;
			rem4.port = rem->port;
			rem4.rem4_id = rem->rem4_id;
//ztg add
//printk(KERN_INFO "mptcp: create_subflow_worker: i = %u
", remaining_bits);
//printk(KERN_INFO "mptcp: create_subflow_worker: locaddr%d = %u
", i, mptcp_local->locaddr4[i].addr.s_addr);
printk(KERN_INFO "mptcp: create_subflow_worker: locaddr = %u --- remaddr = %u
", mptcp_local->locaddr4[i].addr.s_addr, rem4.addr.s_addr);

			/* If a route is not yet available then retry once */
			if (mptcp_init4_subsockets(meta_sk, &mptcp_local->locaddr4[i],
						   &rem4) == -ENETUNREACH)
				retry = rem->retry_bitfield |= (1 << i);
			else
				mptcp_v4_subflows(meta_sk,
						  &mptcp_local->locaddr4[i],
						  &rem4);
			goto next_subflow;
		}
	}
// ...
}

gedit kernel/net/mptcp/mptcp_ipv4.c

/* Create a new IPv4 subflow.
 *
 * We are in user-context and meta-sock-lock is hold.
 */
int mptcp_init4_subsockets(struct sock *meta_sk, const struct mptcp_loc4 *loc,
			   struct mptcp_rem4 *rem)
{
	struct tcp_sock *tp;
	struct sock *sk;
	struct sockaddr_in loc_in, rem_in;
	struct socket_alloc sock_full;
	struct socket *sock = (struct socket *)&sock_full;
	int ret;

	/** First, create and prepare the new socket */
	memcpy(&sock_full, meta_sk->sk_socket, sizeof(sock_full));
	sock->state = SS_UNCONNECTED;
	sock->ops = NULL;

//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 111
");
	ret = inet_create(sock_net(meta_sk), sock, IPPROTO_TCP, 1);
	if (unlikely(ret < 0)) {
		mptcp_debug("%s inet_create failed ret: %d
", __func__, ret);
		return ret;
	}

	sk = sock->sk;
	tp = tcp_sk(sk);

	/* All subsockets need the MPTCP-lock-class */
	lockdep_set_class_and_name(&(sk)->sk_lock.slock, &meta_slock_key, meta_slock_key_name);
	lockdep_init_map(&(sk)->sk_lock.dep_map, meta_key_name, &meta_key, 0);

//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 222
");
	if (mptcp_add_sock(meta_sk, sk, loc->loc4_id, rem->rem4_id, GFP_KERNEL))
		goto error;

	tp->mptcp->slave_sk = 1;
	tp->mptcp->low_prio = loc->low_prio;

	/* Initializing the timer for an MPTCP subflow */
	setup_timer(&tp->mptcp->mptcp_ack_timer, mptcp_ack_handler, (unsigned long)sk);

	/** Then, connect the socket to the peer */
	loc_in.sin_family = AF_INET;
	rem_in.sin_family = AF_INET;
	loc_in.sin_port = 0;
	if (rem->port)
		rem_in.sin_port = rem->port;
	else
		rem_in.sin_port = inet_sk(meta_sk)->inet_dport;
	loc_in.sin_addr = loc->addr;
	rem_in.sin_addr = rem->addr;

	if (loc->if_idx)
		sk->sk_bound_dev_if = loc->if_idx;

//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 333
");
	ret = kernel_bind(sock, (struct sockaddr *)&loc_in,
			  sizeof(struct sockaddr_in));
	if (ret < 0) {
		mptcp_debug("%s: MPTCP subsocket bind() failed, error %d
",
			    __func__, ret);
		goto error;
	}

	mptcp_debug("%s: token %#x pi %d src_addr:%pI4:%d dst_addr:%pI4:%d ifidx: %d
",
		    __func__, tcp_sk(meta_sk)->mpcb->mptcp_loc_token,
		    tp->mptcp->path_index, &loc_in.sin_addr,
		    ntohs(loc_in.sin_port), &rem_in.sin_addr,
		    ntohs(rem_in.sin_port), loc->if_idx);

	if (tcp_sk(meta_sk)->mpcb->pm_ops->init_subsocket_v4)
		tcp_sk(meta_sk)->mpcb->pm_ops->init_subsocket_v4(sk, rem->addr);

//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 444
");
	ret = kernel_connect(sock, (struct sockaddr *)&rem_in,
			     sizeof(struct sockaddr_in), O_NONBLOCK);
	if (ret < 0 && ret != -EINPROGRESS) {
		mptcp_debug("%s: MPTCP subsocket connect() failed, error %d
",
			    __func__, ret);
		goto error;
	}

	MPTCP_INC_STATS(sock_net(meta_sk), MPTCP_MIB_JOINSYNTX);

	sk_set_socket(sk, meta_sk->sk_socket);
	sk->sk_wq = meta_sk->sk_wq;

//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 555
");

	return 0;

error:
	/* May happen if mptcp_add_sock fails first */
	if (!mptcp(tp)) {
		tcp_close(sk, 0);
	} else {
		local_bh_disable();
		mptcp_sub_force_close(sk);
		local_bh_enable();
	}
//ztg add
printk(KERN_INFO "mptcp: mptcp_init4_subsockets: 666
");

	return ret;
}
EXPORT_SYMBOL(mptcp_init4_subsockets);