net/mptcp/options.c | 2 ++ 1 file changed, 2 insertions(+)
Just to let syzbot testing it.
See Paolo's suggestion from [1].
Link: https://lore.kernel.org/6d342ef2-d480-4be6-afad-a3841cf205a8@redhat.com [1]
Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()")
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/69f44505.050a0220.3cbe47.0008.GAE@google.com
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Cc: syzkaller-bugs@googlegroups.com
Cc: linux-kernel@vger.kernel.org
---
net/mptcp/options.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..24903a12a4e0 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -583,6 +583,8 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
map_size += TCPOLEN_MPTCP_DSS_CHECKSUM;
opts->ext_copy = *mpext;
+ } else {
+ opts->ext_copy.use_map = 0;
}
dss_size = map_size;
--
2.53.0Hello,
On 04/05/2026 11:51, Matthieu Baerts (NGI0) wrote:
> Just to let syzbot testing it.
Sorry for the noise: I forgot to add the syzbot instruction... (and I
forgot to remove the MPTCP ML from the sendmail.to option).
Hopefully now the following is correct:
#syz test
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..24903a12a4e0 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -583,6 +583,8 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
map_size += TCPOLEN_MPTCP_DSS_CHECKSUM;
opts->ext_copy = *mpext;
+ } else {
+ opts->ext_copy.use_map = 0;
}
dss_size = map_size;
Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KMSAN: uninit-value in mptcp_write_options ===================================================== BUG: KMSAN: uninit-value in mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462 mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462 mptcp_options_write net/ipv4/tcp_output.c:457 [inline] tcp_options_write+0x1399/0x1920 net/ipv4/tcp_output.c:833 __tcp_transmit_skb+0x36fe/0x5fe0 net/ipv4/tcp_output.c:1656 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505 __mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline] mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline] mptcp_send_ack net/mptcp/protocol.c:555 [inline] mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643 mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385 worker_thread+0xee4/0x1590 kernel/workqueue.c:3466 kthread+0x53f/0x600 kernel/kthread.c:436 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Uninit was stored to memory at: mptcp_established_options_dss net/mptcp/options.c:616 [inline] mptcp_established_options+0x2265/0x3580 net/mptcp/options.c:876 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505 __mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline] mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline] mptcp_send_ack net/mptcp/protocol.c:555 [inline] mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643 mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385 worker_thread+0xee4/0x1590 kernel/workqueue.c:3466 kthread+0x53f/0x600 kernel/kthread.c:436 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Local variable opts created at: __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 CPU: 0 UID: 0 PID: 4890 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: events mptcp_worker ===================================================== Tested on: commit: 6d35786d Merge tag 'for-linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=123d6696580000 kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5 dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1663f21f980000
© 2016 - 2026 Red Hat, Inc.