From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51AC213EFE1; Tue, 23 Jan 2024 01:06:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705972007; cv=none; b=KlMWXhrkVC+1+SuPzFfDKu7STGWTpyBiZaL0KLyH6Jg9woTK8hs0uETRsuLTJWxuUbBpjhwwdaAxCXh62/pniA0mdKhdKSSmcuxB28aJcKguDgjWLfnbiduU+4G87Ms6wWocObXG/uwGeYwsvQqFm5w3JCh/Q3p2fj874lLSth0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705972007; c=relaxed/simple; bh=9JYWAXzCNuBMhvZIbsEdt7U+7o5LaWP7qhB+cL1fjsk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SNJLXDlc6pY0wCqivFavFUYGYZNGVRMZaWQhIHp0zbowkbh19BhThV8oZL3DEsLRZZi4gBsNG6qE3KRSmwqbleUeiOXzcOe7Bp6eN8WFSfPNcdU7j0o0XJa+YDsjRN3nr7WiBE/FpCsj84GRxXJZY6T5y1fjMoQ5ZvTlw58dneI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f+OCEmUi; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="f+OCEmUi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6C99C433C7; Tue, 23 Jan 2024 01:06:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1705972007; bh=9JYWAXzCNuBMhvZIbsEdt7U+7o5LaWP7qhB+cL1fjsk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f+OCEmUidMx/1IaqTIok7LysPMzqSUyVQ/FcxuofHZXOilhDTTe+FAiTSBd1PTK6k lQy8xo9gygSykomH94OSXQYLlxxzyum3rmBv56pJ78ydCo5AqOsnAEDeixsQz6ze9W e0CH4UcOq7sNDBgIeqO6nQIYNFf0M5h8g57eNjCs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Eric Dumazet , Florian Westphal , Peter Krystad , Matthieu Baerts , Mat Martineau , Geliang Tang , Simon Horman , Paolo Abeni , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.1 382/417] mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN Date: Mon, 22 Jan 2024 15:59:10 -0800 Message-ID: <20240122235805.008793275@linuxfoundation.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240122235751.480367507@linuxfoundation.org> References: <20240122235751.480367507@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 89e23277f9c16df6f9f9c1a1a07f8f132339c15c ] mptcp_parse_option() currently sets OPTIONS_MPTCP_MPJ, for the three possible cases handled for MPTCPOPT_MP_JOIN option. OPTIONS_MPTCP_MPJ is the combination of three flags: - OPTION_MPTCP_MPJ_SYN - OPTION_MPTCP_MPJ_SYNACK - OPTION_MPTCP_MPJ_ACK This is a problem, because backup, join_id, token, nonce and/or hmac fields could be left uninitialized in some cases. Distinguish the three cases, as following patches will need this step. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Signed-off-by: Eric Dumazet Cc: Florian Westphal Cc: Peter Krystad Cc: Matthieu Baerts Cc: Mat Martineau Cc: Geliang Tang Reviewed-by: Simon Horman Acked-by: Paolo Abeni Reviewed-by: Mat Martineau Link: https://lore.kernel.org/r/20240111194917.4044654-2-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/mptcp/options.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 74027bb5b429..a718ebcb5bc6 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -118,8 +118,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, break; case MPTCPOPT_MP_JOIN: - mp_opt->suboptions |= OPTIONS_MPTCP_MPJ; if (opsize == TCPOLEN_MPTCP_MPJ_SYN) { + mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYN; mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP; mp_opt->join_id = *ptr++; mp_opt->token = get_unaligned_be32(ptr); @@ -130,6 +130,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, mp_opt->backup, mp_opt->join_id, mp_opt->token, mp_opt->nonce); } else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) { + mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYNACK; mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP; mp_opt->join_id = *ptr++; mp_opt->thmac = get_unaligned_be64(ptr); @@ -140,11 +141,10 @@ static void mptcp_parse_option(const struct sk_buff *skb, mp_opt->backup, mp_opt->join_id, mp_opt->thmac, mp_opt->nonce); } else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) { + mp_opt->suboptions |= OPTION_MPTCP_MPJ_ACK; ptr += 2; memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN); pr_debug("MP_JOIN hmac"); - } else { - mp_opt->suboptions &= ~OPTIONS_MPTCP_MPJ; } break; -- 2.43.0