[PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

[PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

[Matthieu Baerts (NGI0)]

When sending a DATA_FIN without data, and because the DATA_FIN occupies
1 octet of the connection-level sequence space [1], it is then required
to add a DSS mapping with specific values.

If the checksum has been negotiated, it also needs to be computed, and
included in the outgoing packet, and thus the initial csum data needs to
be reset to 0 as well. This is no longer the case since commit
cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()"),
because the whole ext_copy structure is no longer zeroed by default.

This seems to be the only case where use_map is changed and set
afterwards, so initialising the csum field only in this case, along with
other fields for this specific case.

Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()")
Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1]
Link: https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb%40kernel.org?part=2
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/options.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 1bb486daf56a..9f6b4358e564 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -611,6 +611,7 @@ static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow,
 		ext->data_seq = data_fin_tx_seq;
 		ext->subflow_seq = 0;
 		ext->data_len = 1;
+		ext->csum = 0;
 	} else if (ext->data_seq + ext->data_len == data_fin_tx_seq) {
 		/* If there's an existing DSS mapping and it is the
 		 * final mapping, DATA_FIN consumes 1 additional byte of

---
base-commit: ab76ed72e0bed8352d3b8e2b4d1be7c823e5fba3
change-id: 20260814-mptcp-dfin-csum-d39bce4e9eb7

Best regards,
--  
Matthieu Baerts (NGI0) <matttbe@kernel.org>

Re: [PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

[MPTCP CI]

Hi Matthieu,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): packetdrill_syscalls ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/31844725190

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/10b4213297b8
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1146309


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

[Geliang Tang]

Hi Matt,

On Fri, 2026-08-14 at 23:38 +0200, Matthieu Baerts (NGI0) wrote:
> When sending a DATA_FIN without data, and because the DATA_FIN
> occupies
> 1 octet of the connection-level sequence space [1], it is then
> required
> to add a DSS mapping with specific values.
> 
> If the checksum has been negotiated, it also needs to be computed,
> and
> included in the outgoing packet, and thus the initial csum data needs
> to
> be reset to 0 as well. This is no longer the case since commit
> cfcceb7a39fc ("tcp: shrink per-packet memset in
> __tcp_transmit_skb()"),
> because the whole ext_copy structure is no longer zeroed by default.
> 
> This seems to be the only case where use_map is changed and set
> afterwards, so initialising the csum field only in this case, along
> with
> other fields for this specific case.

Initially, I was wondering if we could skip calling mptcp_make_csum()
for data_fin in mptcp_write_options(), similar to how we skip it for
the infinite mapping:

        /* data_len == 0 is reserved for the infinite mapping,
         * the checksum will also be set to 0.
         */
        put_len_csum(mpext->data_len,
                     (mpext->data_len ? mptcp_make_csum(mpext) : 0),
                     ptr);

But I realized that your modification is more straightforward.

> 
> Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in
> __tcp_transmit_skb()")
> Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1]
> Link:
> https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb%40kernel.org?part=2
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Looks good to me!

    Reviewed-by: Geliang Tang <geliang@kernel.org>

Thanks,
-Geliang

> ---
>  net/mptcp/options.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
> index 1bb486daf56a..9f6b4358e564 100644
> --- a/net/mptcp/options.c
> +++ b/net/mptcp/options.c
> @@ -611,6 +611,7 @@ static void mptcp_write_data_fin(struct
> mptcp_subflow_context *subflow,
>  		ext->data_seq = data_fin_tx_seq;
>  		ext->subflow_seq = 0;
>  		ext->data_len = 1;
> +		ext->csum = 0;
>  	} else if (ext->data_seq + ext->data_len == data_fin_tx_seq)
> {
>  		/* If there's an existing DSS mapping and it is the
>  		 * final mapping, DATA_FIN consumes 1 additional
> byte of
> 
> ---
> base-commit: ab76ed72e0bed8352d3b8e2b4d1be7c823e5fba3
> change-id: 20260814-mptcp-dfin-csum-d39bce4e9eb7
> 
> Best regards,
> --  
> Matthieu Baerts (NGI0) <matttbe@kernel.org>
> 

Re: [PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

[Matthieu Baerts]

Hi Geliang,

On 19/08/2026 11:09, Geliang Tang wrote:
> Hi Matt,
> 
> On Fri, 2026-08-14 at 23:38 +0200, Matthieu Baerts (NGI0) wrote:
>> When sending a DATA_FIN without data, and because the DATA_FIN
>> occupies
>> 1 octet of the connection-level sequence space [1], it is then
>> required
>> to add a DSS mapping with specific values.
>>
>> If the checksum has been negotiated, it also needs to be computed,
>> and
>> included in the outgoing packet, and thus the initial csum data needs
>> to
>> be reset to 0 as well. This is no longer the case since commit
>> cfcceb7a39fc ("tcp: shrink per-packet memset in
>> __tcp_transmit_skb()"),
>> because the whole ext_copy structure is no longer zeroed by default.
>>
>> This seems to be the only case where use_map is changed and set
>> afterwards, so initialising the csum field only in this case, along
>> with
>> other fields for this specific case.
> 
> Initially, I was wondering if we could skip calling mptcp_make_csum()
> for data_fin in mptcp_write_options(), similar to how we skip it for
> the infinite mapping:
> 
>         /* data_len == 0 is reserved for the infinite mapping,
>          * the checksum will also be set to 0.
>          */
>         put_len_csum(mpext->data_len,
>                      (mpext->data_len ? mptcp_make_csum(mpext) : 0),
>                      ptr);
> 
> But I realized that your modification is more straightforward.
> 
>>
>> Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in
>> __tcp_transmit_skb()")
>> Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1]
>> Link:
>> https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb%40kernel.org?part=2
>> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
> 
> Looks good to me!
> 
>     Reviewed-by: Geliang Tang <geliang@kernel.org>

Thank you for the review!

New patches for t/upstream-net and t/upstream:
- fbdc41264992: mptcp: options: fix uninit-value in mptcp_write_data_fin
- Results: e9b9aadd7dfb..d251bdc7d65e (export-net)
- Results: 8cefef708ced..77661003be12 (export)

Tests are now in progress:

- export-net:
https://github.com/multipath-tcp/mptcp_net-next/commit/439ace86ec3085a503e16283cf2719876d9a9d7e/checks
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/7c1c363f2cd4fb1dbd7edb83dc2d57313289d200/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.