Re: [PATCH mptcp-next 3/3] mptcp: options: reset parsing in case of invalidity

[Matthieu Baerts <matttbe@kernel.org>]

On 03/09/2026 13:38, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The `break` statement inside `mptcp_get_options` incorrectly exits the `switch` statement instead of the `while` loop, causing `length` and `ptr` to become desynchronized, leading to an infinite loop, out-of-bounds reads, and MPTCP option smuggling.
> --
> 
> commit 60e4bc5aa7cfc08049c3062323eeae263a824439
> Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> 
> mptcp: options: reset parsing in case of invalidity
> 
> When an invalid option is detected, it is safer to drop any previously
> parsed MPTCP options. This ensures a fallback to TCP or a subflow reject
> instead of just ignoring the currently parsed option.
> 
>> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
>> index aaaabcab0f8f9..b6d2e39f8464a 100644
>> --- a/net/mptcp/options.c
>> +++ b/net/mptcp/options.c
> [ ... ]
>> @@ -461,9 +456,12 @@ void mptcp_get_options(const struct sock *sk, const struct sk_buff *skb,
>>  				return;
>>  			if (opsize > length)
>>  				return;	/* don't parse partial options */
>> -			if (opcode == TCPOPT_MPTCP)
>> -				mptcp_parse_option(sk, skb, ptr, opsize,
>> -						   mp_opt);
>> +			if (opcode == TCPOPT_MPTCP &&
>> +			    !mptcp_parse_option(sk, skb, ptr, opsize, mp_opt)) {
>> +				/* invalid option, drop previously parsed opt */
>> +				*(u32 *)&mp_opt->status = 0;
>> +				break;
> 
> [Severity: High]
> Does this break statement exit the switch rather than the while loop?

Arf, it was supposed to be a break for the while loop, but I missed the
switch... Let's use 'return' here, then.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.