[PATCH net] tipc: fix rc_dests counter corruption on reinit

[PATCH net] tipc: fix rc_dests counter corruption on reinit

[Ömer Mete Kaya]

tipc_named_reinit() unconditionally resets rc_dests to zero while
re-initializing local publications. However, node-up events may
already have incremented rc_dests for peers without
TIPC_NAMED_BCAST capability before network finalization.

The reset discards these counts. When such peers later disconnect,
tipc_publ_notify() decrements the already-zero u32 counter, wrapping
it to UINT32_MAX and permanently forcing replicast distribution.

Remove the unnecessary rc_dests reset from tipc_named_reinit(),
which only updates local publication addresses and has no reason to
touch the remote peer counter.

Discovered by Sashiko, not triggered, not runtime tested.

Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
 net/tipc/name_distr.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index ba4f4906e13b..1dfe8475a75d 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -415,6 +415,5 @@ void tipc_named_reinit(struct net *net)
 		p->sk.node = self;
 	list_for_each_entry_rcu(p, &nt->cluster_scope, binding_node)
 		p->sk.node = self;
-	nt->rc_dests = 0;
 	spin_unlock_bh(&tn->nametbl_lock);
 }
--
2.56.0

Re: [PATCH net] tipc: fix rc_dests counter corruption on reinit

[Tung Quang Nguyen]

> Subject: [PATCH net] tipc: fix rc_dests counter corruption on reinit

This is part of my on-going series: https://lore.kernel.org/all/20261102034207.10639-4-tung.quang.nguyen@est.tech/
I will send new version soon.

---
pw-bot: rejected