For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] mptcp: zero opts->ext_copy in mptcp_established_options_dss()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


syzbot reported two related KMSAN uninit-value reports rooted in
mptcp_established_options_dss():

1. mptcp_write_data_fin() reads ext->use_map on the subflow shutdown
   path (tcp_send_ack via mptcp_subflow_shutdown), where the skb has
   no MPTCP extension and the "opts->ext_copy = *mpext" assignment is
   skipped.

2. mptcp_write_options() reads mpext->use_ack on the data_fin
   acknowledgement path (tcp_send_ack via mptcp_send_ack from
   mptcp_check_data_fin), where the outer DSS-mapping block is
   skipped entirely (snd_data_fin_enable is false and mpext is NULL),
   yet bitfield RMW writes to opts->ext_copy.use_ack / .ack64 leave
   neighboring bits poisoned, which mptcp_write_options() then reads.

The root cause is the same in both cases: opts->ext_copy lives in a
union inside opts->mptcp, which is a plain (non-cleared) member of
the on-stack struct tcp_out_options declared in __tcp_transmit_skb().
Multiple code paths in mptcp_established_options_dss() write only
some fields of ext_copy and rely on the rest being zero, but that
precondition is never enforced.

Zero opts->ext_copy at the start of mptcp_established_options_dss()
so all subsequent writes -- including bitfield RMWs -- operate on
clean memory regardless of which path is taken.

Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 net/mptcp/options.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..3fb914196987 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -572,6 +572,7 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
 	bool ret = false;
 	u64 ack_seq;
 
+	memset(&opts->ext_copy, 0, sizeof(opts->ext_copy));
 	opts->csum_reqd = READ_ONCE(msk->csum_enabled);
 	mpext = skb ? mptcp_get_ext(skb) : NULL;
 
-- 
2.43.0