Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [Medium] When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated `opts.mptcp.ext_copy.csum` is left uninitialized. If MPTCP checksums are enabled, this uninitialized memory is written to the TCP header, leaking 2 bytes of kernel stack memory over the network. -- --- Patch [2]: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext --- commit 5596db7582bd748ad6320aef70bbdd448c28de36 Author: Geliang Tang <[email protected]> mptcp: remove unused data_ack from struct mptcp_ext The data_ack and data_ack32 fields in struct mptcp_ext are no longer used anywhere. Remove them from the structure and update mptcp_dump_mpext() trace helper accordingly. Drop the data_ack field from the trace entry and the corresponding output in TP_printk(). > diff --git a/include/net/mptcp.h b/include/net/mptcp.h > index 71b9fc5a57963..485d55b66ea67 100644 > --- a/include/net/mptcp.h > +++ b/include/net/mptcp.h > @@ -19,10 +19,6 @@ struct seq_file; > > /* MPTCP sk_buff extension data */ > struct mptcp_ext { > - union { > - u64 data_ack; > - u32 data_ack32; > - }; > u64 data_seq; > u32 subflow_seq; > u16 data_len; [Severity: Medium] This is a pre-existing issue, but does this structure leave the csum field uninitialized on the stack under certain conditions? When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated opts structure in net/ipv4/tcp_output.c:__tcp_transmit_skb() is not fully zeroed: struct tcp_out_options opts; If mpext is NULL, net/mptcp/options.c:mptcp_established_options_dss() only clears the bitfield flags: /* Zero `use_ack` and `use_map` flags with one shot. */ memset(&opts->ext_copy.flags, 0, sizeof(opts->ext_copy.flags)); This leaves opts->ext_copy.csum uninitialized. The code then passes this to net/mptcp/options.c:mptcp_write_data_fin(), which populates fields like data_fin and data_seq but fails to initialize the csum field. Finally, in net/mptcp/options.c:mptcp_write_options(), it reads the uninitialized csum when writing the TCP header: put_len_csum(mpext->data_len, (mpext->data_len ? mptcp_make_csum(mpext) : 0), ptr); Could this uninitialized struct memory result in leaking 2 bytes of kernel stack memory over the network when MPTCP checksums are enabled? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f...@kernel.org?part=2
