Patch "mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mptcp-mptcp_parse_option-fix-for-mptcpopt_mp_join.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c05933565c5cf107c726e1bf55543f1227464bdd
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Thu Jan 11 19:49:13 2024 +0000

    mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
    
    [ Upstream commit 89e23277f9c16df6f9f9c1a1a07f8f132339c15c ]
    
    mptcp_parse_option() currently sets OPTIONS_MPTCP_MPJ, for the three
    possible cases handled for MPTCPOPT_MP_JOIN option.
    
    OPTIONS_MPTCP_MPJ is the combination of three flags:
    - OPTION_MPTCP_MPJ_SYN
    - OPTION_MPTCP_MPJ_SYNACK
    - OPTION_MPTCP_MPJ_ACK
    
    This is a problem, because backup, join_id, token, nonce and/or hmac fields
    could be left uninitialized in some cases.
    
    Distinguish the three cases, as following patches will need this step.
    
    Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Florian Westphal <fw@xxxxxxxxx>
    Cc: Peter Krystad <peter.krystad@xxxxxxxxxxxxxxx>
    Cc: Matthieu Baerts <matttbe@xxxxxxxxxx>
    Cc: Mat Martineau <martineau@xxxxxxxxxx>
    Cc: Geliang Tang <geliang.tang@xxxxxxxxx>
    Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
    Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240111194917.4044654-2-edumazet@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index c53914012d01..d2527d189a79 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -123,8 +123,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 		break;
 
 	case MPTCPOPT_MP_JOIN:
-		mp_opt->suboptions |= OPTIONS_MPTCP_MPJ;
 		if (opsize == TCPOLEN_MPTCP_MPJ_SYN) {
+			mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYN;
 			mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
 			mp_opt->join_id = *ptr++;
 			mp_opt->token = get_unaligned_be32(ptr);
@@ -135,6 +135,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 				 mp_opt->backup, mp_opt->join_id,
 				 mp_opt->token, mp_opt->nonce);
 		} else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) {
+			mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYNACK;
 			mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
 			mp_opt->join_id = *ptr++;
 			mp_opt->thmac = get_unaligned_be64(ptr);
@@ -145,11 +146,10 @@ static void mptcp_parse_option(const struct sk_buff *skb,
 				 mp_opt->backup, mp_opt->join_id,
 				 mp_opt->thmac, mp_opt->nonce);
 		} else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) {
+			mp_opt->suboptions |= OPTION_MPTCP_MPJ_ACK;
 			ptr += 2;
 			memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
 			pr_debug("MP_JOIN hmac");
-		} else {
-			mp_opt->suboptions &= ~OPTIONS_MPTCP_MPJ;
 		}
 		break;