Re: [PATCH] mptcp: zero opts->ext_copy in mptcp_established_options_dss()

[Matthieu Baerts <matttbe@kernel.org>]

Hi Deepanshu,

On 04/05/2026 02:31, Deepanshu Kartikey wrote:
> syzbot reported a KMSAN uninit-value in mptcp_write_data_fin() reached
> via tcp_send_ack() from the subflow shutdown path:
> 
>   BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542
>    mptcp_established_options_dss net/mptcp/options.c:590
>    mptcp_established_options net/mptcp/options.c:874
>    tcp_established_options net/ipv4/tcp_output.c:1192
>    __tcp_transmit_skb net/ipv4/tcp_output.c:1575
>    __tcp_send_ack net/ipv4/tcp_output.c:4499
>    tcp_send_ack net/ipv4/tcp_output.c:4505
>    mptcp_subflow_shutdown net/mptcp/protocol.c:3137
>    mptcp_check_send_data_fin net/mptcp/protocol.c:3218
>    __mptcp_wr_shutdown net/mptcp/protocol.c:3234
>    __mptcp_close net/mptcp/protocol.c:3313
> 
>   Local variable opts created at:
>    __tcp_transmit_skb net/ipv4/tcp_output.c:1536
> 
> __tcp_transmit_skb() partially clears its on-stack tcp_out_options via
> "memset(&opts.cleared, ...)" which does not cover opts.mptcp, so MPTCP
> is responsible for initializing opts->ext_copy before use.
> 
> mptcp_established_options_dss() only writes opts->ext_copy when an
> MPTCP extension is attached to the skb ("opts->ext_copy = *mpext").
> When tcp_send_ack() builds a fresh pure-ACK skb during subflow
> shutdown, the skb has no extension and that assignment is skipped, but
> the function still calls mptcp_write_data_fin(&opts->ext_copy) because
> snd_data_fin_enable is set. mptcp_write_data_fin() then reads
> ext->use_map to choose between writing a synthetic DATA_FIN mapping or
> extending an existing one, and that read hits uninitialized stack
> memory.
> 
> Zero opts->ext_copy at the top of mptcp_established_options_dss() so
> mptcp_write_data_fin() takes its synthetic-mapping branch on clean
> memory.
Thank you for sharing this patch!

Kuniyuki already shared the same patch on the MPTCP ML a few days ago:

https://lore.kernel.org/mptcp/20260501061939.1808489-1-kuniyu@google.com/T/#u

A v2 has been shared a few hours ago:

https://lore.kernel.org/mptcp/20260504044051.3725846-1-kuniyu@google.com/T/#u

(and apparently, a v3 will be needed)

Cheers,
Matt
-- 
pw-bot: Rejected
Sponsored by the NGI0 Core fund.