Re: [PATCH net] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Sat, 15 Aug 2026 17:22:05 +0530 you wrote:
> mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
> backup, join_id, token and msk from the saved cookie entry when rebuilding
> the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
> does not restore local_id, even though the SYN path saved it.
> subflow_ulp_clone() then reads that uninitialized field and stores it as
> the joined subflow's address-ID. Because the request-sock slab is
> SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
> byte of a previously freed request socket, which an off-path peer can
> influence by sending concurrent MP_JOIN SYNs. This corrupts the path
> manager's id-based subflow bookkeeping for the connection.
> 
> [...]

Here is the summary with links:
  - [net] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
    https://git.kernel.org/netdev/net/c/b878dfdd12d7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html