Re: [PATCH net] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Hi Harshit,

On 15/08/2026 13:52, Harshit Varu wrote:

mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
backup, join_id, token and msk from the saved cookie entry when rebuilding
the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
does not restore local_id, even though the SYN path saved it.
subflow_ulp_clone() then reads that uninitialized field and stores it as
the joined subflow's address-ID. Because the request-sock slab is
SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
byte of a previously freed request socket, which an off-path peer can
influence by sending concurrent MP_JOIN SYNs. This corrupts the path
manager's id-based subflow bookkeeping for the connection.

Thank you for this new version:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Please next time add all the reviewers in cc -- as requested in your v2
-- and add the version number in the prefix. No need to send a new
version to address that.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.