From: Quanye Yang <quanyeyang@proton.me>

copyfd_io_poll() and sock_connect_mptcp() store the signed read()
return value in unsigned wstate.len. On failure, -1 becomes UINT_MAX,
so the later "len > 0" check is always true and the error path is
dead. do_rnd_write() / sendto() then copy past the 8192-byte stack
buffer.

Keep wstate.len unsigned, but capture read() in a ssize_t and only
store a non-negative length. Retry EINTR in the poll loop; abort the
TFO connect if the input file cannot be read.

Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
Fixes: ca7ae8916043 ("selftests: mptcp: mptfo Initiator/Listener")
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/636
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
 tools/testing/selftests/net/mptcp/mptcp_connect.c | 32 ++++++++++++++++-------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index 178d98d91fea..d124fb96db15 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -398,9 +398,17 @@ static int sock_connect_mptcp(const char * const remoteaddr,
 			set_mark(sock, cfg_mark);
 
 		if (cfg_sockopt_types.mptfo) {
-			if (!winfo->total_len)
-				winfo->total_len = winfo->len = read(infd, winfo->buf,
-								     sizeof(winfo->buf));
+			if (!winfo->total_len) {
+				ssize_t ret = read(infd, winfo->buf,
+						   sizeof(winfo->buf));
+
+				if (ret < 0) {
+					perror("read");
+					close(sock);
+					return -1;
+				}
+				winfo->total_len = winfo->len = ret;
+			}
 
 			syn_copied = sendto(sock, winfo->buf, winfo->len, MSG_FASTOPEN,
 					    a->ai_addr, a->ai_addrlen);
@@ -698,8 +706,17 @@ static int copyfd_io_poll(int infd, int peerfd, int outfd,
 
 		if (fds.revents & POLLOUT) {
 			if (winfo->len == 0) {
+				ssize_t ret;
+
 				winfo->off = 0;
-				winfo->len = read(infd, winfo->buf, sizeof(winfo->buf));
+				ret = read(infd, winfo->buf, sizeof(winfo->buf));
+				if (ret < 0) {
+					if (errno == EINTR)
+						continue;
+					perror("read");
+					return 4;
+				}
+				winfo->len = ret;
 			}
 
 			if (winfo->len > 0) {
@@ -726,7 +743,7 @@ static int copyfd_io_poll(int infd, int peerfd, int outfd,
 				winfo->off += bw;
 				winfo->len -= bw;
 				total_wlen += bw;
-			} else if (winfo->len == 0) {
+			} else {
 				/* We have no more data to send. */
 				fds.events &= ~POLLOUT;
 
@@ -735,11 +752,6 @@ static int copyfd_io_poll(int infd, int peerfd, int outfd,
 					break;
 
 				shut_wr(peerfd);
-			} else {
-				if (errno == EINTR)
-					continue;
-				perror("read");
-				return 4;
 			}
 		}
 

---
base-commit: f2f79e9af965c1c49decfe56312fa547095fbbee
change-id: 20261028-fix-mptcp-issue-636-150d6411fd30

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>

Hi Quanye,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): selftest_simult_flows ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Unstable ⚠️
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/40664161219

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/06b5641fc3ac
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1195263


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)