mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
mainline inclusion
from mainline-v6.8-rc1
commit be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9D1
CVE: CVE-2024-35840
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb
--------------------------------
subflow_finish_connect() uses four fields (backup, join_id, thmac, none)
that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set
in mptcp_parse_option()
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Conflicts:
net/mptcp/options.c
net/mptcp/protocol.h
net/mptcp/subflow.c
[The introduction of suboptions is from commit 74c7dfbee3e1, and
OPTION_MPTCP_MPJ_SYNACK assignment of suboptions is from commit 89e23277f9c1.
Just focus on OPTION_MPTCP_MPJ_SYNACK related logic.]
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
(cherry picked from commit 964bc2774b1c3f48f480dcb3bf05e58f3af67cdb)
3 files changed
