[MPTCP] [PATCH net] mptcp: explicitly zeros msk fields on clone

[MPTCP] [PATCH net] mptcp: explicitly zeros msk fields on clone

[Paolo Abeni]

[-- Attachment #1: Type: text/plain, Size: 1327 bytes --]

sk_clone_lock() does not set the __GFP_ZERO flag on the
internal socket allocation, so we must explicitly zero
all the relevant msk fields, or we could see inconsitent
socket status leading to unexpected fallback or data
corruption.

Fixes: d22f4988ffec ("mptcp: process MP_CAPABLE data option")
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
---
The goal is send this patch upstream asap, so that is hopefully 
included soon in net-next.

In the export branch should be located on top of current net-next
HEAD, that is, before all pending export branch patches
---
 net/mptcp/protocol.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index dbe43e0cd734..5449fee82239 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1511,12 +1511,15 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
 		inet_sk(nsk)->pinet6 = mptcp_inet6_sk(nsk);
 #endif
 
-	__mptcp_init_sock(nsk);
-
 	msk = mptcp_sk(nsk);
 	msk->local_key = subflow_req->local_key;
 	msk->token = subflow_req->token;
 	msk->subflow = NULL;
+	msk->cached_ext = NULL;
+	msk->flags = 0;
+	msk->can_ack = false;
+
+	__mptcp_init_sock(nsk);
 
 	msk->write_seq = subflow_req->idsn + 1;
 	atomic64_set(&msk->snd_una, msk->write_seq);
-- 
2.26.2