Forwarded: [PATCH] mptcp: zero opts->ext_copy on DATA_FIN-only path

[syzbot <syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] mptcp: zero opts->ext_copy on DATA_FIN-only path
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



syzbot reported a KMSAN uninit-value in mptcp_write_data_fin() when
sending a DATA_FIN on a pure-ACK path triggered by subflow shutdown:

  BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542
   mptcp_established_options_dss net/mptcp/options.c:590
   mptcp_established_options net/mptcp/options.c:874
   tcp_established_options net/ipv4/tcp_output.c:1192
   __tcp_transmit_skb net/ipv4/tcp_output.c:1575
   __tcp_send_ack net/ipv4/tcp_output.c:4499
   tcp_send_ack net/ipv4/tcp_output.c:4505
   mptcp_subflow_shutdown net/mptcp/protocol.c:3137
   mptcp_check_send_data_fin net/mptcp/protocol.c:3218
   __mptcp_close net/mptcp/protocol.c:3313

  Local variable opts created at:
   __tcp_transmit_skb net/ipv4/tcp_output.c:1536

mptcp_established_options_dss() copies an existing DSS mapping into
opts->ext_copy only when the skb has an MPTCP extension attached:

	if (mpext) {
		...
		opts->ext_copy = *mpext;
	}

When called via tcp_send_ack() from the subflow shutdown path, the skb
is a freshly allocated pure-ACK with no MPTCP extension, so
mptcp_get_ext(skb) returns NULL and the assignment is skipped.
mptcp_established_options_dss() still proceeds to call
mptcp_write_data_fin(... &opts->ext_copy) when snd_data_fin_enable is
set, and mptcp_write_data_fin() reads ext->use_map to decide whether to
synthesize a 1-byte DATA_FIN mapping. opts is a stack local in
__tcp_transmit_skb() and opts->mptcp is not part of the cleared
sub-group, so ext_copy is uninitialized on this path.

Zero opts->ext_copy at the start of the DSS mapping block so the
synthetic-mapping branch in mptcp_write_data_fin() runs on clean memory
regardless of whether mpext is present.

Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 net/mptcp/options.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..6707f70024f2 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -578,6 +578,8 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
 	if (!skb || (mpext && mpext->use_map) || snd_data_fin_enable) {
 		unsigned int map_size = TCPOLEN_MPTCP_DSS_BASE + TCPOLEN_MPTCP_DSS_MAP64;
 
+		memset(&opts->ext_copy, 0, sizeof(opts->ext_copy));
+
 		if (mpext) {
 			if (opts->csum_reqd)
 				map_size += TCPOLEN_MPTCP_DSS_CHECKSUM;
-- 
2.43.0