[PATCH net v2] tipc: protect node reset trace dump with node lock

[PATCH net v2] tipc: protect node reset trace dump with node lock

[Chengfeng Ye]

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is
dumping it:

  CPU 0                                CPU 1
  trace_tipc_node_reset_links()
    tipc_node_dump()
      l = n->links[0].link
                                       tipc_node_write_lock()
                                       kfree(l)
                                       n->links[0].link = NULL
                                       tipc_node_write_unlock()
      tipc_link_dump(l)

tipc_link_dump() then dereferences the stale pointer. KASAN reported:

  BUG: KASAN: slab-use-after-free in tipc_link_dump (net/tipc/link.c:2910)
  Read of size 4 by task poc/115
  Call Trace:
   tipc_link_dump+0x10cb/0x16b0
   tipc_node_dump+0x4bb/0x740
   trace_event_raw_event_tipc_node_class+0x258/0x360
   tipc_node_reset_links+0x14d/0x1a0
   tipc_rcv+0x13f5/0x3030
   tipc_udp_recv+0x4e3/0x670
  Allocated by task 0:
   tipc_link_create+0x1e1/0x1020
   tipc_node_check_dest+0x7d2/0x11a0
   tipc_disc_rcv+0xdbf/0x1430
  Freed by task 89:
   kfree+0x131/0x3c0
   tipc_node_link_down+0x267/0x4b0
   tipc_node_delete_links+0xec/0x160
   bearer_disable+0x107/0x260

Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.

Do not take the lock inside tipc_node_dump() itself: several dump
callers, including tipc_node_link_down(), already hold the write lock.

Fixes: eb18a510b5cd ("tipc: add trace_events for tipc node")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
v1 -> v2:
- Use tipc_node_write_lock() instead of tipc_node_read_lock() so the
  dump is exclusive with link deletion.

 net/tipc/node.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 683a136e53ef..127848e8a644 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1333,7 +1333,9 @@ static void tipc_node_reset_links(struct tipc_node *n)
 
 	pr_warn("Resetting all links to %x\n", n->addr);
 
+	tipc_node_write_lock(n);
 	trace_tipc_node_reset_links(n, true, " ");
+	tipc_node_write_unlock(n);
 	for (i = 0; i < MAX_BEARERS; i++) {
 		tipc_node_link_down(n, i, false);
 	}
-- 
2.43.0

Re: [PATCH net v2] tipc: protect node reset trace dump with node lock

[Tung Quang Nguyen]

> +       tipc_node_write_lock(n);
>        trace_tipc_node_reset_links(n, true, " ");
> +       tipc_node_write_unlock(n);
Please use tipc_node_write_unlock_fast(n) as I mentioned before.

[PATCH net v3] tipc: protect node reset trace dump with node lock

[Chengfeng Ye]

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is
dumping it:

  CPU 0                                CPU 1
  trace_tipc_node_reset_links()
    tipc_node_dump()
      l = n->links[0].link
                                       tipc_node_write_lock()
                                       kfree(l)
                                       n->links[0].link = NULL
                                       tipc_node_write_unlock()
      tipc_link_dump(l)

tipc_link_dump() then dereferences the stale pointer. KASAN reported:

  BUG: KASAN: slab-use-after-free in tipc_link_dump
  Read of size 4 by task poc/115
  Call Trace:
   tipc_link_dump+0x10cb/0x16b0
   tipc_node_dump+0x4bb/0x740
   trace_event_raw_event_tipc_node_class+0x258/0x360
   tipc_node_reset_links+0x14d/0x1a0
   tipc_rcv+0x13f5/0x3030
   tipc_udp_recv+0x4e3/0x670
  Allocated by task 0:
   tipc_link_create+0x1e1/0x1020
   tipc_node_check_dest+0x7d2/0x11a0
   tipc_disc_rcv+0xdbf/0x1430
  Freed by task 89:
   kfree+0x131/0x3c0
   tipc_node_link_down+0x267/0x4b0
   tipc_node_delete_links+0xec/0x160
   bearer_disable+0x107/0x260

Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.

Fixes: eb18a510b5cd ("tipc: add trace_events for tipc node")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
v1 -> v2:
- Use tipc_node_write_lock() instead of tipc_node_read_lock() so the
  dump is exclusive with link deletion.

v2 -> v3:
- Use tipc_node_write_unlock_fast().

 net/tipc/node.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 683a136e53ef..bd91378b7540 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1333,7 +1333,9 @@ static void tipc_node_reset_links(struct tipc_node *n)
 
 	pr_warn("Resetting all links to %x\n", n->addr);
 
+	tipc_node_write_lock(n);
 	trace_tipc_node_reset_links(n, true, " ");
+	tipc_node_write_unlock_fast(n);
 	for (i = 0; i < MAX_BEARERS; i++) {
 		tipc_node_link_down(n, i, false);
 	}
-- 
2.43.0

Re: [PATCH net v2] tipc: protect node reset trace dump with node lock

[Chengfeng Ye]

On Tue, Aug 25, 2026 at 7:08 PM Tung Quang Nguyen
<tung.quang.nguyen@est.tech> wrote:
>
> > +       tipc_node_write_lock(n);
> >        trace_tipc_node_reset_links(n, true, " ");
> > +       tipc_node_write_unlock(n);
> Please use tipc_node_write_unlock_fast(n) as I mentioned before.
>

Sorry for the negligence, the v3 is just sent to address it.

Best,
Chengfeng

RE: [PATCH net v3] tipc: protect node reset trace dump with node lock

[Tung Quang Nguyen]

>Subject: [PATCH net v3] tipc: protect node reset trace dump with node lock
>
>The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
>node's link entries. Unlike the other node events that request link data, this
>event runs without the node lock.
>
>This permits bearer teardown to free a link while the trace callback is dumping
>it:
>
>  CPU 0                                CPU 1
>  trace_tipc_node_reset_links()
>    tipc_node_dump()
>      l = n->links[0].link
>                                       tipc_node_write_lock()
>                                       kfree(l)
>                                       n->links[0].link = NULL
>                                       tipc_node_write_unlock()
>      tipc_link_dump(l)
>
>tipc_link_dump() then dereferences the stale pointer. KASAN reported:
>
>  BUG: KASAN: slab-use-after-free in tipc_link_dump
>  Read of size 4 by task poc/115
>  Call Trace:
>   tipc_link_dump+0x10cb/0x16b0
>   tipc_node_dump+0x4bb/0x740
>   trace_event_raw_event_tipc_node_class+0x258/0x360
>   tipc_node_reset_links+0x14d/0x1a0
>   tipc_rcv+0x13f5/0x3030
>   tipc_udp_recv+0x4e3/0x670
>  Allocated by task 0:
>   tipc_link_create+0x1e1/0x1020
>   tipc_node_check_dest+0x7d2/0x11a0
>   tipc_disc_rcv+0xdbf/0x1430
>  Freed by task 89:
>   kfree+0x131/0x3c0
>   tipc_node_link_down+0x267/0x4b0
>   tipc_node_delete_links+0xec/0x160
>   bearer_disable+0x107/0x260
>
>Take the node write lock around the trace event. This serializes the dump
>against tipc_node_link_down(delete=true), which frees the link under the
>same write lock.
>
>Fixes: eb18a510b5cd ("tipc: add trace_events for tipc node")
>Cc: stable@vger.kernel.org
>Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
>---
>v1 -> v2:
>- Use tipc_node_write_lock() instead of tipc_node_read_lock() so the
>  dump is exclusive with link deletion.
>
>v2 -> v3:
>- Use tipc_node_write_unlock_fast().
>
> net/tipc/node.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/net/tipc/node.c b/net/tipc/node.c index
>683a136e53ef..bd91378b7540 100644
>--- a/net/tipc/node.c
>+++ b/net/tipc/node.c
>@@ -1333,7 +1333,9 @@ static void tipc_node_reset_links(struct tipc_node
>*n)
>
> 	pr_warn("Resetting all links to %x\n", n->addr);
>
>+	tipc_node_write_lock(n);
> 	trace_tipc_node_reset_links(n, true, " ");
>+	tipc_node_write_unlock_fast(n);
> 	for (i = 0; i < MAX_BEARERS; i++) {
> 		tipc_node_link_down(n, i, false);
> 	}
>--
>2.43.0

Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>

Note that sashiko reports pre-existing UAF issue related to link input queue. This needs to be addressed via a separate patch.

Re: [PATCH net v3] tipc: protect node reset trace dump with node lock

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 26 Aug 2026 03:01:41 +0800 you wrote:
> The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
> node's link entries. Unlike the other node events that request link data,
> this event runs without the node lock.
> 
> This permits bearer teardown to free a link while the trace callback is
> dumping it:
> 
> [...]

Here is the summary with links:
  - [net,v3] tipc: protect node reset trace dump with node lock
    https://git.kernel.org/netdev/net/c/dddf197f29ba

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html