mptcp: fix KMSAN: uninit-value in mptcp_established_options

[PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options

Posted by Matthieu Baerts (NGI0) 1 week, 3 days ago

Just to let syzbot testing it.

See Paolo's suggestion from [1].

Link: https://lore.kernel.org/6d342ef2-d480-4be6-afad-a3841cf205a8@redhat.com [1]
Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()")
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/69f44505.050a0220.3cbe47.0008.GAE@google.com
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Cc: syzkaller-bugs@googlegroups.com
Cc: linux-kernel@vger.kernel.org
---
 net/mptcp/options.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..24903a12a4e0 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -583,6 +583,8 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
 				map_size += TCPOLEN_MPTCP_DSS_CHECKSUM;
 
 			opts->ext_copy = *mpext;
+		} else {
+			opts->ext_copy.use_map = 0;
 		}
 
 		dss_size = map_size;
-- 
2.53.0

Re: [PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options

Posted by MPTCP CI 1 week, 3 days ago

Hi Matthieu,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Unstable: 1 failed test(s): packetdrill_dss ⚠️ 
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/25313209741

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/f5d0fa2e42ba
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1089187


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options

Posted by Matthieu Baerts 1 week, 3 days ago

Hello,

On 04/05/2026 11:51, Matthieu Baerts (NGI0) wrote:
> Just to let syzbot testing it.

Sorry for the noise: I forgot to add the syzbot instruction... (and I
forgot to remove the MPTCP ML from the sendmail.to option).

Hopefully now the following is correct:
#syz test

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..24903a12a4e0 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -583,6 +583,8 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
 				map_size += TCPOLEN_MPTCP_DSS_CHECKSUM;
 
 			opts->ext_copy = *mpext;
+		} else {
+			opts->ext_copy.use_map = 0;
 		}
 
 		dss_size = map_size;

Re: [PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options

Posted by Paolo Abeni 1 week, 3 days ago

On 5/4/26 11:59 AM, Matthieu Baerts wrote:
> 
> Sorry for the noise: I forgot to add the syzbot instruction... (and I
> forgot to remove the MPTCP ML from the sendmail.to option).

I did not take in account all the possible corner cases.

Let's be a little more conservative.

#syz test
---
diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index f7263fe2a2e4..0763fd6f7758 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -27,6 +27,9 @@ struct mptcp_ext {
 	u32		subflow_seq;
 	u16		data_len;
 	__sum16		csum;
+
+	struct_group(flags,
+
 	u8		use_map:1,
 			dsn64:1,
 			data_fin:1,
@@ -38,6 +41,8 @@ struct mptcp_ext {
 	u8		reset_reason:4,
 			csum_reqd:1,
 			infinite_map:1;
+
+	); /* end of flags group */
 };

 #define MPTCPOPT_HMAC_LEN	20
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..3fd40dbff82b 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -572,6 +572,11 @@ static bool mptcp_established_options_dss(struct
sock *sk, struct sk_buff *skb,
 	bool ret = false;
 	u64 ack_seq;

+	/* Zero `can_ack` and `use_map` flags with one shot. */
+	BUILD_BUG_ON(sizeof_field(struct mptcp_ext, flags) != sizeof(u16));
+	BUILD_BUG_ON(!IS_ALIGNED(offsetof(struct mptcp_ext, flags),
+				 sizeof(u16)));
+	*(u16 *)&opts->ext_copy.flags = 0;
 	opts->csum_reqd = READ_ONCE(msk->csum_enabled);
 	mpext = skb ? mptcp_get_ext(skb) : NULL;

@@ -595,7 +600,6 @@ static bool mptcp_established_options_dss(struct
sock *sk, struct sk_buff *skb,
 	/* passive sockets msk will set the 'can_ack' after accept(), even
 	 * if the first subflow may have the already the remote key handy
 	 */
-	opts->ext_copy.use_ack = 0;
 	if (!READ_ONCE(msk->can_ack)) {
 		*size = ALIGN(dss_size, 4);
 		return ret;

Re: [PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options

Posted by Paolo Abeni 1 week, 3 days ago

On 5/4/26 6:22 PM, Paolo Abeni wrote:
> On 5/4/26 11:59 AM, Matthieu Baerts wrote:
>>
>> Sorry for the noise: I forgot to add the syzbot instruction... (and I
>> forgot to remove the MPTCP ML from the sendmail.to option).
> 
> I did not take in account all the possible corner cases.
> 
> Let's be a little more conservative.
Darn... the last upgrade here broke the line (un)wrap extension. Let me
attach the patch. Sorry for the spam.

#syz test