From: MoYuanhao moyuanhao3676@163.com

Ensure there is enough space before adding MPTCP options in tcp_syn_options().

Without this check, 'remaining' could underflow, and causes issues. If there is not enough space, MPTCP should not be used.

Signed-off-by: MoYuanhao moyuanhao3676@163.com Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections") Cc: stable@vger.kernel.org Acked-by: Matthieu Baerts (NGI0) matttbe@kernel.org [ Matt: Add Fixes, cc Stable, update Description ] Signed-off-by: Matthieu Baerts (NGI0) matttbe@kernel.org --- net/ipv4/tcp_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 5485a70b5fe5a6039d19f4321c3c2ec8ecc6ffea..0e5b9a654254b32907ee9739f3443791104bd611 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -883,8 +883,10 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb, unsigned int size;

if (mptcp_syn_options(sk, skb, &size, &opts->mptcp)) { - opts->options |= OPTION_MPTCP; - remaining -= size; + if (remaining >= size) { + opts->options |= OPTION_MPTCP; + remaining -= size; + } } }

--- base-commit: 09310cfd4ea5c3ab2c7a610420205e0a1660bf7e change-id: 20241209-net-mptcp-check-space-syn-5694196ffb5f

Best regards,