Re: [PATCH mptcp-net] mptcp: options: fix uninit-value in mptcp_write_data_fin

Hi Matt,

On Fri, 2026-08-14 at 23:38 +0200, Matthieu Baerts (NGI0) wrote:
> When sending a DATA_FIN without data, and because the DATA_FIN
> occupies
> 1 octet of the connection-level sequence space [1], it is then
> required
> to add a DSS mapping with specific values.
> 
> If the checksum has been negotiated, it also needs to be computed,
> and
> included in the outgoing packet, and thus the initial csum data needs
> to
> be reset to 0 as well. This is no longer the case since commit
> cfcceb7a39fc ("tcp: shrink per-packet memset in
> __tcp_transmit_skb()"),
> because the whole ext_copy structure is no longer zeroed by default.
> 
> This seems to be the only case where use_map is changed and set
> afterwards, so initialising the csum field only in this case, along
> with
> other fields for this specific case.

Initially, I was wondering if we could skip calling mptcp_make_csum()
for data_fin in mptcp_write_options(), similar to how we skip it for
the infinite mapping:

        /* data_len == 0 is reserved for the infinite mapping,
         * the checksum will also be set to 0.
         */
        put_len_csum(mpext->data_len,
                     (mpext->data_len ? mptcp_make_csum(mpext) : 0),
                     ptr);

But I realized that your modification is more straightforward.

> 
> Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in
> __tcp_transmit_skb()")
> Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1]
> Link:
> https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb%40kernel.org?part=2
> Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>

Looks good to me!

    Reviewed-by: Geliang Tang <[email protected]>

Thanks,
-Geliang

> ---
>  net/mptcp/options.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
> index 1bb486daf56a..9f6b4358e564 100644
> --- a/net/mptcp/options.c
> +++ b/net/mptcp/options.c
> @@ -611,6 +611,7 @@ static void mptcp_write_data_fin(struct
> mptcp_subflow_context *subflow,
>  		ext->data_seq = data_fin_tx_seq;
>  		ext->subflow_seq = 0;
>  		ext->data_len = 1;
> +		ext->csum = 0;
>  	} else if (ext->data_seq + ext->data_len == data_fin_tx_seq)
> {
>  		/* If there's an existing DSS mapping and it is the
>  		 * final mapping, DATA_FIN consumes 1 additional
> byte of
> 
> ---
> base-commit: ab76ed72e0bed8352d3b8e2b4d1be7c823e5fba3
> change-id: 20260814-mptcp-dfin-csum-d39bce4e9eb7
> 
> Best regards,
> --  
> Matthieu Baerts (NGI0) <[email protected]>
>