Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in mptcp_write_options

=====================================================
BUG: KMSAN: uninit-value in mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
 mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
 mptcp_options_write net/ipv4/tcp_output.c:457 [inline]
 tcp_options_write+0x1399/0x1920 net/ipv4/tcp_output.c:833
 __tcp_transmit_skb+0x36fe/0x5fe0 net/ipv4/tcp_output.c:1656
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
 __mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
 mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
 mptcp_send_ack net/mptcp/protocol.c:555 [inline]
 mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
 mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
 process_one_work kernel/workqueue.c:3302 [inline]
 process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
 worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
 kthread+0x53f/0x600 kernel/kthread.c:436
 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Uninit was stored to memory at:
 mptcp_established_options_dss net/mptcp/options.c:616 [inline]
 mptcp_established_options+0x2270/0x3590 net/mptcp/options.c:876
 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
 __mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
 mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
 mptcp_send_ack net/mptcp/protocol.c:555 [inline]
 mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
 mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
 process_one_work kernel/workqueue.c:3302 [inline]
 process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
 worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
 kthread+0x53f/0x600 kernel/kthread.c:436
 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Local variable opts created at:
 __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499

CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events mptcp_worker
=====================================================


Tested on:

commit:         66edb901 Merge tag 'v7.1-p3' of git://git.kernel.org/p..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f8fece580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1668fece580000