Re: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated `opts.mptcp.ext_copy.csum` is left uninitialized. If MPTCP checksums are enabled, this uninitialized memory is written to the TCP header, leaking 2 bytes of kernel stack memory over the network.
--

--- Patch [2]: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext ---
commit 5596db7582bd748ad6320aef70bbdd448c28de36
Author: Geliang Tang <geliang@kernel.org>

mptcp: remove unused data_ack from struct mptcp_ext
    
The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().

> diff --git a/include/net/mptcp.h b/include/net/mptcp.h
> index 71b9fc5a57963..485d55b66ea67 100644
> --- a/include/net/mptcp.h
> +++ b/include/net/mptcp.h
> @@ -19,10 +19,6 @@ struct seq_file;
>  
>  /* MPTCP sk_buff extension data */
>  struct mptcp_ext {
> -	union {
> -		u64	data_ack;
> -		u32	data_ack32;
> -	};
>  	u64		data_seq;
>  	u32		subflow_seq;
>  	u16		data_len;

[Severity: Medium]
This is a pre-existing issue, but does this structure leave the csum field
uninitialized on the stack under certain conditions?

When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g.,
on a pure ACK), the stack-allocated opts structure in 
net/ipv4/tcp_output.c:__tcp_transmit_skb() is not fully zeroed:

    struct tcp_out_options opts;

If mpext is NULL, net/mptcp/options.c:mptcp_established_options_dss() only
clears the bitfield flags:

    /* Zero `use_ack` and `use_map` flags with one shot. */
    memset(&opts->ext_copy.flags, 0, sizeof(opts->ext_copy.flags));

This leaves opts->ext_copy.csum uninitialized. The code then passes this to
net/mptcp/options.c:mptcp_write_data_fin(), which populates fields like
data_fin and data_seq but fails to initialize the csum field.

Finally, in net/mptcp/options.c:mptcp_write_options(), it reads the
uninitialized csum when writing the TCP header:

    put_len_csum(mpext->data_len,
                 (mpext->data_len ? mptcp_make_csum(mpext) : 0),
                 ptr);

Could this uninitialized struct memory result in leaking 2 bytes of kernel
stack memory over the network when MPTCP checksums are enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org?part=2