Re: [PATCH mptcp-net 27/34] tcp: do not pass a BPF reqsk to an MPTCP listener

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] tcp: uninitialized AccECN bitfields in
  cookie_tcp_reqsk_init() [1]
--

commit 60c8cb4a139f552e38c9eee24fcc2376af54953b
Author: Chris Mason <mason@kernel.org>

tcp: do not pass a BPF reqsk to an MPTCP listener

This commit rejects MPTCP listeners in cookie_bpf_check() so a plain TCP
request socket allocated by bpf_sk_assign_tcp_reqsk() is not passed to
mptcp_subflow_init_cookie_req() when SO_REUSEPORT selects an MPTCP listener.

> diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
> index 4e0ff3b820627..8433c856a7d8e 100644
> --- a/net/ipv4/syncookies.c
> +++ b/net/ipv4/syncookies.c
> @@ -308,7 +308,8 @@ struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
>  	skb->sk = NULL;
>  	skb->destructor = NULL;
>  
> -	if (cookie_tcp_reqsk_init(sk, skb, req)) {
> +	/* reuseport can pick an MPTCP listener: req is too small for it */
> +	if (sk_is_mptcp(sk) || cookie_tcp_reqsk_init(sk, skb, req)) {
>  		reqsk_free(req);
>  		req = NULL;
>  	}

[Severity: Medium]
This problem wasn't introduced by this patch, but does
cookie_tcp_reqsk_init() [1] leave the saw_accecn_opt,
accecn_fail_mode, syn_ect_rcv, and syn_ect_snt bitfields of struct
tcp_request_sock uninitialized?

When ECN is enabled and the third ACK negotiates AccECN so cookie_v4_check()
or cookie_v6_check() sets treq->accecn_ok, tcp_ecn_openreq_child() copies
those uninitialized slab bits into the child struct tcp_sock, corrupting the
connection's initial AccECN state and exposing the uninitialized bits to
userspace via TCP_INFO in tcpi_accecn_fail_mode and tcpi_accecn_opt_seen.

[1] https://sashiko.dev/#/bug/linux-ed19fae6-fc32-4f5d-a0ad-dc03d9ce058f

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-mptcp-cmason-fixes-v1-0-9205b77e9a2f@kernel.org?part=27