Re: [PATCH net] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

[Matthieu Baerts <matttbe@kernel.org>]

Hi Harshit,

On 15/08/2026 13:52, Harshit Varu wrote:
> mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
> backup, join_id, token and msk from the saved cookie entry when rebuilding
> the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
> does not restore local_id, even though the SYN path saved it.
> subflow_ulp_clone() then reads that uninitialized field and stores it as
> the joined subflow's address-ID. Because the request-sock slab is
> SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
> byte of a previously freed request socket, which an off-path peer can
> influence by sending concurrent MP_JOIN SYNs. This corrupts the path
> manager's id-based subflow bookkeeping for the connection.

Thank you for this new version:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Please next time add all the reviewers in cc -- as requested in your v2
-- and add the version number in the prefix. No need to send a new
version to address that.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.