}
 }
 
+static bool lookup_address_in_vec(struct mptcp_addr_info *addrs, unsigned int nr,
+                                 struct mptcp_addr_info *addr)
+{
+       int i;
+
+       for (i = 0; i < nr; i++) {
+               if (addresses_equal(&addrs[i], addr, addr->port))
+                       return true;
+       }
+
+       return false;
+}
+
+/* Fill all the remote addresses into the array addrs[],
+ * and return the array size.
+ */
+static unsigned int fill_remote_addresses_vec(struct mptcp_sock *msk, bool fullmesh,
+                                             struct mptcp_addr_info *addrs)
+{
+       struct sock *sk = (struct sock *)msk, *ssk;
+       struct mptcp_subflow_context *subflow;
+       struct mptcp_addr_info remote = { 0 };
+       unsigned int subflows_max;
+       int i = 0;
+
+       subflows_max = mptcp_pm_get_subflows_max(msk);
+
+       /* Non-fullmesh endpoint, fill in the single entry
+        * corresponding to the primary MPC subflow remote address
+        */
+       if (!fullmesh) {
+               remote_address((struct sock_common *)sk, &remote);
+               msk->pm.subflows++;
+               addrs[i++] = remote;
+       } else {
+               mptcp_for_each_subflow(msk, subflow) {
+                       ssk = mptcp_subflow_tcp_sock(subflow);
+                       remote_address((struct sock_common *)ssk, &remote);
+                       if (!lookup_address_in_vec(addrs, i, &remote) &&
+                           msk->pm.subflows < subflows_max) {
+                               msk->pm.subflows++;
+                               addrs[i++] = remote;
+                       }
+               }
+       }
+
+       return i;
+}
+
 static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
 {
        struct sock *sk = (struct sock *)msk;
            !READ_ONCE(msk->pm.remote_deny_join_id0)) {
                local = select_local_address(pernet, msk);
                if (local) {
-                       struct mptcp_addr_info remote = { 0 };
+                       bool fullmesh = !!(local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
+                       struct mptcp_addr_info addrs[MPTCP_PM_ADDR_MAX];
+                       int i, nr;
 
                        msk->pm.local_addr_used++;
-                       msk->pm.subflows++;
                        check_work_pending(msk);
-                       remote_address((struct sock_common *)sk, &remote);
+                       nr = fill_remote_addresses_vec(msk, fullmesh, addrs);
                        spin_unlock_bh(&msk->pm.lock);
-                       __mptcp_subflow_connect(sk, &local->addr, &remote);
+                       for (i = 0; i < nr; i++)
+                               __mptcp_subflow_connect(sk, &local->addr, &addrs[i]);
                        spin_lock_bh(&msk->pm.lock);
                        return;
                }