--- zzzz-none-000/linux-4.19.183/net/ipv4/inet_connection_sock.c	2021-03-24 10:07:39.000000000 +0000
+++ bcm63-7530ax-756/linux-4.19.183/net/ipv4/inet_connection_sock.c	2023-06-28 08:54:21.000000000 +0000
@@ -23,6 +23,9 @@
 #include <net/route.h>
 #include <net/tcp_states.h>
 #include <net/xfrm.h>
+#if defined(CONFIG_BCM_KF_MPTCP) && defined(CONFIG_BCM_MPTCP)
+#include <net/mptcp.h>
+#endif
 #include <net/tcp.h>
 #include <net/sock_reuseport.h>
 #include <net/addrconf.h>
@@ -725,7 +728,14 @@
 	int max_retries, thresh;
 	u8 defer_accept;
 
+#if !defined(CONFIG_BCM_KF_MPTCP) || !defined(CONFIG_BCM_MPTCP)
 	if (inet_sk_state_load(sk_listener) != TCP_LISTEN)
+#else
+	if (!is_meta_sk(sk_listener) && inet_sk_state_load(sk_listener) != TCP_LISTEN)
+		goto drop;
+
+	if (is_meta_sk(sk_listener) && !mptcp_can_new_subflow(sk_listener))
+#endif
 		goto drop;
 
 	max_retries = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_synack_retries;
@@ -818,7 +828,13 @@
 				 const struct request_sock *req,
 				 const gfp_t priority)
 {
+#if !defined(CONFIG_BCM_KF_MPTCP) || !defined(CONFIG_BCM_MPTCP)
 	struct sock *newsk = sk_clone_lock(sk, priority);
+#else
+	struct sock *newsk;
+
+	newsk = sk_clone_lock(sk, priority);
+#endif
 
 	if (newsk) {
 		struct inet_connection_sock *newicsk = inet_csk(newsk);
@@ -1018,7 +1034,18 @@
 	 */
 	while ((req = reqsk_queue_remove(queue, sk)) != NULL) {
 		struct sock *child = req->sk;
+#if defined(CONFIG_BCM_KF_MPTCP) && defined(CONFIG_BCM_MPTCP)
+		bool mutex_taken = false;
+		struct mptcp_cb *mpcb = tcp_sk(child)->mpcb;
+#endif
 
+#if defined(CONFIG_BCM_KF_MPTCP) && defined(CONFIG_BCM_MPTCP)
+		if (is_meta_sk(child)) {
+			WARN_ON(refcount_inc_not_zero(&mpcb->mpcb_refcnt) == 0);
+			mutex_lock(&mpcb->mpcb_mutex);
+			mutex_taken = true;
+		}
+#endif
 		local_bh_disable();
 		bh_lock_sock(child);
 		WARN_ON(sock_owned_by_user(child));
@@ -1028,6 +1055,12 @@
 		reqsk_put(req);
 		bh_unlock_sock(child);
 		local_bh_enable();
+#if defined(CONFIG_BCM_KF_MPTCP) && defined(CONFIG_BCM_MPTCP)
+		if (mutex_taken) {
+			mutex_unlock(&mpcb->mpcb_mutex);
+			mptcp_mpcb_put(mpcb);
+		}
+#endif
 		sock_put(child);
 
 		cond_resched();