5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet <edumazet@xxxxxxxxxx> [ Upstream commit be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb ] subflow_finish_connect() uses four fields (backup, join_id, thmac, none) that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set in mptcp_parse_option() Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Cc: Florian Westphal <fw@xxxxxxxxx> Cc: Peter Krystad <peter.krystad@xxxxxxxxxxxxxxx> Cc: Matthieu Baerts <matttbe@xxxxxxxxxx> Cc: Mat Martineau <martineau@xxxxxxxxxx> Cc: Geliang Tang <geliang.tang@xxxxxxxxx> Reviewed-by: Simon Horman <horms@xxxxxxxxxx> Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx> Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx> Link: https://lore.kernel.org/r/20240111194917.4044654-4-edumazet@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> --- net/mptcp/subflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index c2c30724b322..297d2465c413 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -432,7 +432,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) } else if (subflow->request_join) { u8 hmac[SHA256_DIGEST_SIZE]; - if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ)) { + if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) { subflow->reset_reason = MPTCP_RST_EMPTCP; goto do_reset; } -- 2.43.0