Netdev List
 help / color / mirror / Atom feed
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
To: Mat Martineau <martineau@kernel.org>,
	Geliang Tang <geliang@kernel.org>,
	 "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	 Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,  Simon Horman <horms@kernel.org>
Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev,
	 linux-kernel@vger.kernel.org,
	"Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	 stable@vger.kernel.org
Subject: [PATCH net v2 03/15] mptcp: syncookies: remember the request backup flag
Date: Tue, 08 Sep 2026 16:07:08 +0200	[thread overview]
Message-ID: <20260908-net-mptcp-misc-fixes-7-3-rc1-v2-3-df1de70348b6@kernel.org> (raw)
In-Reply-To: <20260908-net-mptcp-misc-fixes-7-3-rc1-v2-0-df1de70348b6@kernel.org>

Instead of using an uninitialised bit when copying the info in
subflow_ulp_clone().

To fix this, no need to extend the join_entry structure: backup is
coming from struct mptcp_subflow_request_sock, only one bit. Do the same
here by using one bit for both.

Fixes: efd340bf3d77 ("mptcp: distinguish rcv vs sent backup flag in requests")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
v2: update the Fixes tag (even if the target version is the same)
---
 net/mptcp/syncookies.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/syncookies.c b/net/mptcp/syncookies.c
index b5cac5701122..9474706641c1 100644
--- a/net/mptcp/syncookies.c
+++ b/net/mptcp/syncookies.c
@@ -26,7 +26,8 @@ struct join_entry {
 	u32 local_nonce;
 	u8 join_id;
 	u8 local_id;
-	u8 backup;
+	u8 backup:1,
+	   request_bkup:1;
 	u8 valid;
 };
 
@@ -63,6 +64,7 @@ static void mptcp_join_store_state(struct join_entry *entry,
 	entry->remote_nonce = subflow_req->remote_nonce;
 	entry->local_nonce = subflow_req->local_nonce;
 	entry->backup = subflow_req->backup;
+	entry->request_bkup = subflow_req->request_bkup;
 	entry->join_id = subflow_req->remote_id;
 	entry->local_id = subflow_req->local_id;
 	entry->valid = 1;
@@ -117,6 +119,7 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl
 	subflow_req->remote_nonce = e->remote_nonce;
 	subflow_req->local_nonce = e->local_nonce;
 	subflow_req->backup = e->backup;
+	subflow_req->request_bkup = e->request_bkup;
 	subflow_req->remote_id = e->join_id;
 	subflow_req->local_id = e->local_id;
 	subflow_req->token = e->token;

-- 
2.55.0


  parent reply	other threads:[~2026-09-08 14:14 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-08 14:07 [PATCH net v2 00/15] mptcp: misc fixes for v7.3-rc1 Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 01/15] mptcp: do not reschedule the RTX timer for fallback sockets Matthieu Baerts (NGI0)
2026-09-09 14:49   ` netdev-bot+sashiko
2026-09-09 15:32     ` Paolo Abeni
2026-09-08 14:07 ` [PATCH net v2 02/15] mptcp: subflow: no need to copy thmac during ulp_clone Matthieu Baerts (NGI0)
2026-09-08 14:07 ` Matthieu Baerts (NGI0) [this message]
2026-09-08 14:07 ` [PATCH net v2 04/15] mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 Matthieu Baerts (NGI0)
2026-09-09 14:49   ` netdev-bot+sashiko
2026-09-09 17:57     ` Matthieu Baerts
2026-09-08 14:07 ` [PATCH net v2 05/15] mptcp: options: handle MPC data + csum reqd + no csum Matthieu Baerts (NGI0)
2026-09-09 14:49   ` netdev-bot+sashiko
2026-09-09 18:03     ` Matthieu Baerts
2026-09-08 14:07 ` [PATCH net v2 06/15] mptcp: prevent race between disconnect() and rtx Matthieu Baerts (NGI0)
2026-09-09 14:49   ` netdev-bot+sashiko
2026-09-09 15:54     ` Paolo Abeni
2026-09-09 18:05   ` Matthieu Baerts
2026-09-08 14:07 ` [PATCH net v2 07/15] selftests: mptcp: fix an UAF in mptcp_connect.c Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 08/15] mptcp: pm: userspace: fix address ID overflow Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 09/15] mptcp: pm: reset retrans_time when ADD_ADDR entry is reused Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 10/15] mptcp: remove unneeded READ_ONCE() annotation Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 11/15] selftests: mptcp: lib: dump nstat for the right test Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 12/15] selftests: mptcp: lib: get counters " Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 13/15] mptcp: options: fix uninit-value in mptcp_write_data_fin Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 14/15] mptcp: being below memory limit is a likely() condition Matthieu Baerts (NGI0)
2026-09-08 14:07 ` [PATCH net v2 15/15] mptcp: avoid pruning for OoW data Matthieu Baerts (NGI0)
2026-09-09 14:49   ` netdev-bot+sashiko
2026-09-09 15:50     ` Paolo Abeni
2026-09-09 18:07       ` Matthieu Baerts
2026-09-09 18:09 ` [PATCH net v2 00/15] mptcp: misc fixes for v7.3-rc1 Matthieu Baerts
2026-09-09 20:40 ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260908-net-mptcp-misc-fixes-7-3-rc1-v2-3-df1de70348b6@kernel.org \
    --to=matttbe@kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=geliang@kernel.org \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=martineau@kernel.org \
    --cc=mptcp@lists.linux.dev \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox