Re: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext
From: sashiko-bot@kernel.org
Date: 2026-08-13 14:56:35
Also in:
mptcp
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [Medium] When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g., on a pure ACK), the stack-allocated `opts.mptcp.ext_copy.csum` is left uninitialized. If MPTCP checksums are enabled, this uninitialized memory is written to the TCP header, leaking 2 bytes of kernel stack memory over the network. --
--- Patch [2]: [PATCH net-next 02/11] mptcp: remove unused data_ack from struct mptcp_ext ---commit 5596db7582bd748ad6320aef70bbdd448c28de36
Author: Geliang Tang [off-list ref]
mptcp: remove unused data_ack from struct mptcp_ext
The data_ack and data_ack32 fields in struct mptcp_ext are no longer used
anywhere. Remove them from the structure and update mptcp_dump_mpext()
trace helper accordingly. Drop the data_ack field from the trace entry
and the corresponding output in TP_printk().
quoted hunk ↗ jump to hunk
diff --git a/include/net/mptcp.h b/include/net/mptcp.h index 71b9fc5a57963..485d55b66ea67 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h@@ -19,10 +19,6 @@ struct seq_file; /* MPTCP sk_buff extension data */ struct mptcp_ext { - union { - u64 data_ack; - u32 data_ack32; - }; u64 data_seq; u32 subflow_seq; u16 data_len;
[Severity: Medium]
This is a pre-existing issue, but does this structure leave the csum field
uninitialized on the stack under certain conditions?
When transmitting an MPTCP DATA_FIN DSS option without a data payload (e.g.,
on a pure ACK), the stack-allocated opts structure in
net/ipv4/tcp_output.c:__tcp_transmit_skb() is not fully zeroed:
struct tcp_out_options opts;
If mpext is NULL, net/mptcp/options.c:mptcp_established_options_dss() only
clears the bitfield flags:
/* Zero `use_ack` and `use_map` flags with one shot. */
memset(&opts->ext_copy.flags, 0, sizeof(opts->ext_copy.flags));
This leaves opts->ext_copy.csum uninitialized. The code then passes this to
net/mptcp/options.c:mptcp_write_data_fin(), which populates fields like
data_fin and data_seq but fails to initialize the csum field.
Finally, in net/mptcp/options.c:mptcp_write_options(), it reads the
uninitialized csum when writing the TCP header:
put_len_csum(mpext->data_len,
(mpext->data_len ? mptcp_make_csum(mpext) : 0),
ptr);
Could this uninitialized struct memory result in leaking 2 bytes of kernel
stack memory over the network when MPTCP checksums are enabled?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb@kernel.org?part=2