From: Greg Kroah-Hartman Date: Tue, 25 Mar 2025 11:29:13 +0000 (-0400) Subject: 6.12-stable patches X-Git-Tag: v6.1.132~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=293d7c92fe9cc75d0b3bab38bef2a1477ef1926c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: mptcp-fix-data-stream-corruption-in-the-address-announcement.patch --- diff --git a/queue-6.12/mptcp-fix-data-stream-corruption-in-the-address-announcement.patch b/queue-6.12/mptcp-fix-data-stream-corruption-in-the-address-announcement.patch new file mode 100644 index 0000000000..89ef12adc4 --- /dev/null +++ b/queue-6.12/mptcp-fix-data-stream-corruption-in-the-address-announcement.patch @@ -0,0 +1,78 @@ +From 2c1f97a52cb827a5f2768e67a9dddffae1ed47ab Mon Sep 17 00:00:00 2001 +From: Arthur Mongodin +Date: Fri, 14 Mar 2025 21:11:31 +0100 +Subject: mptcp: Fix data stream corruption in the address announcement + +From: Arthur Mongodin + +commit 2c1f97a52cb827a5f2768e67a9dddffae1ed47ab upstream. + +Because of the size restriction in the TCP options space, the MPTCP +ADD_ADDR option is exclusive and cannot be sent with other MPTCP ones. +For this reason, in the linked mptcp_out_options structure, group of +fields linked to different options are part of the same union. + +There is a case where the mptcp_pm_add_addr_signal() function can modify +opts->addr, but not ended up sending an ADD_ADDR. Later on, back in +mptcp_established_options, other options will be sent, but with +unexpected data written in other fields due to the union, e.g. in +opts->ext_copy. This could lead to a data stream corruption in the next +packet. + +Using an intermediate variable, prevents from corrupting previously +established DSS option. The assignment of the ADD_ADDR option +parameters is now done once we are sure this ADD_ADDR option can be set +in the packet, e.g. after having dropped other suboptions. + +Fixes: 1bff1e43a30e ("mptcp: optimize out option generation") +Cc: stable@vger.kernel.org +Suggested-by: Paolo Abeni +Signed-off-by: Arthur Mongodin +Reviewed-by: Matthieu Baerts (NGI0) +[ Matt: the commit message has been updated: long lines splits and some + clarifications. ] +Signed-off-by: Matthieu Baerts (NGI0) +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250314-net-mptcp-fix-data-stream-corr-sockopt-v1-1-122dbb249db3@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/options.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -651,6 +651,7 @@ static bool mptcp_established_options_ad + struct mptcp_sock *msk = mptcp_sk(subflow->conn); + bool drop_other_suboptions = false; + unsigned int opt_size = *size; ++ struct mptcp_addr_info addr; + bool echo; + int len; + +@@ -659,7 +660,7 @@ static bool mptcp_established_options_ad + */ + if (!mptcp_pm_should_add_signal(msk) || + (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) || +- !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &opts->addr, ++ !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &addr, + &echo, &drop_other_suboptions)) + return false; + +@@ -672,7 +673,7 @@ static bool mptcp_established_options_ad + else if (opts->suboptions & OPTION_MPTCP_DSS) + return false; + +- len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port); ++ len = mptcp_add_addr_len(addr.family, echo, !!addr.port); + if (remaining < len) + return false; + +@@ -689,6 +690,7 @@ static bool mptcp_established_options_ad + opts->ahmac = 0; + *size -= opt_size; + } ++ opts->addr = addr; + opts->suboptions |= OPTION_MPTCP_ADD_ADDR; + if (!echo) { + MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ADDADDRTX); diff --git a/queue-6.12/series b/queue-6.12/series index b804d231f8..85bae61694 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -113,3 +113,4 @@ revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch libsubcmd-silence-compiler-warning.patch arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch +mptcp-fix-data-stream-corruption-in-the-address-announcement.patch