Commit c1665273 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

mptcp: strict validation before using mp_opt->hmac 



mp_opt->hmac contains uninitialized data unless OPTION_MPTCP_MPJ_ACK
was set in mptcp_parse_option().

We must refine the condition before we call subflow_hmac_valid().

Fixes: f296234c ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-3-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 89e23277

net/mptcp/subflow.c

+1 −1
Original line number Diff line number Diff line
@@ -788,7 +788,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, 


	} else if (subflow_req->mp_join) {

		mptcp_get_options(skb, &mp_opt);

		if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) ||

		if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK) ||

		    !subflow_hmac_valid(req, &mp_opt) ||

		    !mptcp_can_accept_new_subflow(subflow_req->msk)) {

			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);