]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
mptcp: options: reset DSS fields in case of unexpected size
authorMatthieu Baerts (NGI0) <matttbe@kernel.org>
Mon, 3 Aug 2026 16:16:33 +0000 (18:16 +0200)
committerJakub Kicinski <kuba@kernel.org>
Thu, 6 Aug 2026 15:46:22 +0000 (08:46 -0700)
commit35772b4981f38ba8059372cde8753e8e477e98ec
tree3311681fa5e542c9faa847a4d17c87fd629fa3be
parentfde39b8a521780391fb4e5bda2c0aa4928947f12
mptcp: options: reset DSS fields in case of unexpected size

A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.

Explicitly reset the fields that could have been modified in case of
unexpected size.

Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260728-net-mptcp-misc-fixes-7-2-rc6-v1-0-f7e2d229159d%40kernel.org?part=1
Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
Cc: stable@vger.kernel.org
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-1-b8f496d71664@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/mptcp/options.c