[PATCH] mptcp: zero opts->ext_copy in mptcp_established_options_dss()

[Deepanshu Kartikey]

syzbot reported a KMSAN uninit-value in mptcp_write_data_fin() reached
via tcp_send_ack() from the subflow shutdown path:

  BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542
   mptcp_established_options_dss net/mptcp/options.c:590
   mptcp_established_options net/mptcp/options.c:874
   tcp_established_options net/ipv4/tcp_output.c:1192
   __tcp_transmit_skb net/ipv4/tcp_output.c:1575
   __tcp_send_ack net/ipv4/tcp_output.c:4499
   tcp_send_ack net/ipv4/tcp_output.c:4505
   mptcp_subflow_shutdown net/mptcp/protocol.c:3137
   mptcp_check_send_data_fin net/mptcp/protocol.c:3218
   __mptcp_wr_shutdown net/mptcp/protocol.c:3234
   __mptcp_close net/mptcp/protocol.c:3313

  Local variable opts created at:
   __tcp_transmit_skb net/ipv4/tcp_output.c:1536

__tcp_transmit_skb() partially clears its on-stack tcp_out_options via
"memset(&opts.cleared, ...)" which does not cover opts.mptcp, so MPTCP
is responsible for initializing opts->ext_copy before use.

mptcp_established_options_dss() only writes opts->ext_copy when an
MPTCP extension is attached to the skb ("opts->ext_copy = *mpext").
When tcp_send_ack() builds a fresh pure-ACK skb during subflow
shutdown, the skb has no extension and that assignment is skipped, but
the function still calls mptcp_write_data_fin(&opts->ext_copy) because
snd_data_fin_enable is set. mptcp_write_data_fin() then reads
ext->use_map to choose between writing a synthetic DATA_FIN mapping or
extending an existing one, and that read hits uninitialized stack
memory.

Zero opts->ext_copy at the top of mptcp_established_options_dss() so
mptcp_write_data_fin() takes its synthetic-mapping branch on clean
memory.

Fixes: 9c29e3615274 ("mptcp: fix DSS map generation on fin retransmission")
Reported-by: syzbot+ff020673c5e3d94d9478@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
---
 net/mptcp/options.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 8a1c5698983c..3fb914196987 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -572,6 +572,7 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,
 	bool ret = false;
 	u64 ack_seq;
 
+	memset(&opts->ext_copy, 0, sizeof(opts->ext_copy));
 	opts->csum_reqd = READ_ONCE(msk->csum_enabled);
 	mpext = skb ? mptcp_get_ext(skb) : NULL;
 
-- 
2.43.0