| From b878dfdd12d7a5b8722a78d35e313506140ca3d9 Mon Sep 17 00:00:00 2001 |
| From: Harshit Varu <harshitvaru666@gmail.com> |
| Date: Sat, 15 Aug 2026 17:22:05 +0530 |
| Subject: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction |
| |
| From: Harshit Varu <harshitvaru666@gmail.com> |
| |
| commit b878dfdd12d7a5b8722a78d35e313506140ca3d9 upstream. |
| |
| mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, |
| backup, join_id, token and msk from the saved cookie entry when rebuilding |
| the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it |
| does not restore local_id, even though the SYN path saved it. |
| subflow_ulp_clone() then reads that uninitialized field and stores it as |
| the joined subflow's address-ID. Because the request-sock slab is |
| SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale |
| byte of a previously freed request socket, which an off-path peer can |
| influence by sending concurrent MP_JOIN SYNs. This corrupts the path |
| manager's id-based subflow bookkeeping for the connection. |
| |
| Restore subflow_req->local_id from the cookie entry, as done for the other |
| fields. |
| |
| Fixes: 9466a1ccebbe ("mptcp: enable JOIN requests even if cookies are in use") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Harshit Varu <harshitvaru666@gmail.com> |
| Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> |
| Link: https://patch.msgid.link/20260815115205.197151-1-harshitvaru666@gmail.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/mptcp/syncookies.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/net/mptcp/syncookies.c |
| +++ b/net/mptcp/syncookies.c |
| @@ -118,6 +118,7 @@ bool mptcp_token_join_cookie_init_state( |
| subflow_req->local_nonce = e->local_nonce; |
| subflow_req->backup = e->backup; |
| subflow_req->remote_id = e->join_id; |
| + subflow_req->local_id = e->local_id; |
| subflow_req->token = e->token; |
| subflow_req->msk = msk; |
| spin_unlock_bh(&join_entry_locks[i]); |
