* [PATCH net v4 0/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list @ 2026-07-16 19:02 Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 1/2] tipc: guard against empty list in tipc_node_xmit() Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi 0 siblings, 2 replies; 6+ messages in thread From: Weiming Shi @ 2026-07-16 19:02 UTC (permalink / raw) To: Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman Cc: Hoang Huu Le, netdev, tipc-discussion, linux-kernel, xmei5, Weiming Shi named_distribute() stamps the last_bulk flag on the tail skb of the publication list. When the list is empty no skb is enqueued and the tail access dereferences NULL. tipc_named_node_up() hits this on an empty cluster_scope, which happens with a node-id configuration where cluster_scope is populated only later by tipc_net_finalize(). It is reachable by an unprivileged user over a UDP bearer in a user+net namespace. Patch 1 guards tipc_node_xmit() against an empty list, so the allocation- failure path in named_distribute() cannot pass an empty list down to tipc_lxc_xmit(), which has the same tail-of-empty-list deref. Patch 2 emits an item-less bulk when the publication list is empty, so the peer still receives the last_bulk flag and does not stall this node's later name updates. Changes in v4: - Keep the original return on allocation failure in the build loop (v3 changed it to break). The empty-list block now runs only for a genuinely empty cluster_scope, so an allocation failure no longer falls through to it and cannot emit a bulk that misrepresents a non-empty list. Changes in v3: - Split into two patches; add patch 1 to guard tipc_node_xmit() against the tipc_lxc_xmit() deref reachable via the allocation-failure path. - Break out of the build loop on allocation failure instead of returning, so the last_bulk flag is still applied to the last queued skb. Changes in v2: - Instead of returning early on an empty cluster_scope (which would stall the peer, since it waits for a bulk with the last_bulk flag before accepting later name updates), emit an item-less bulk so the peer opens normally. Weiming Shi (2): tipc: guard against empty list in tipc_node_xmit() tipc: fix NULL deref in tipc_named_node_up() on empty publication list net/tipc/name_distr.c | 14 ++++++++++++++ net/tipc/node.c | 3 +++ 2 files changed, 17 insertions(+) base-commit: 4595d2c77ea4bfe4ae0efa38770a59ee5d2f06d3 -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net v4 1/2] tipc: guard against empty list in tipc_node_xmit() 2026-07-16 19:02 [PATCH net v4 0/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi @ 2026-07-16 19:02 ` Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi 1 sibling, 0 replies; 6+ messages in thread From: Weiming Shi @ 2026-07-16 19:02 UTC (permalink / raw) To: Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman Cc: Hoang Huu Le, netdev, tipc-discussion, linux-kernel, xmei5, Weiming Shi tipc_node_xmit() passes @list to tipc_lxc_xmit(), which dereferences buf_msg(skb_peek(list)) without checking, so an empty list causes a NULL pointer dereference. named_distribute() can hand it an empty list when a bulk allocation fails. tipc_link_xmit() was already guarded in commit b77413446408 ("tipc: fix NULL deref in tipc_link_xmit()"); guard tipc_node_xmit() itself so the tipc_lxc_xmit() path is covered too. Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns") Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs@gmail.com> --- net/tipc/node.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 97aa970a0d83..fc241e7b0c1f 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list, int bearer_id; int rc; + if (skb_queue_empty(list)) + return 0; + if (in_own_node(net, dnode)) { tipc_loopback_trace(net, list); spin_lock_init(&list->lock); -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list 2026-07-16 19:02 [PATCH net v4 0/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 1/2] tipc: guard against empty list in tipc_node_xmit() Weiming Shi @ 2026-07-16 19:02 ` Weiming Shi 2026-07-17 9:48 ` Tung Quang Nguyen 1 sibling, 1 reply; 6+ messages in thread From: Weiming Shi @ 2026-07-16 19:02 UTC (permalink / raw) To: Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman Cc: Hoang Huu Le, netdev, tipc-discussion, linux-kernel, xmei5, Weiming Shi named_distribute() ends by stamping the last_bulk flag on the tail skb via buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced. tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id configuration cluster_scope is populated only later by tipc_net_finalize(), so a peer link that comes up first reaches named_distribute() with an empty list. It is reachable by an unprivileged user (TIPC genl ops use GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace: KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196) tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221) tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:2185) tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal exception in interrupt The peer holds back this node's later name updates until it sees a bulk with the last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk when the publication list is empty, so the peer still receives the last_bulk flag and opens. Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs@gmail.com> --- net/tipc/name_distr.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index ba4f4906e13b..a8bb7bd101ea 100644 --- a/net/tipc/name_distr.c +++ b/net/tipc/name_distr.c @@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem)); __skb_queue_tail(list, skb); } + + if (skb_queue_empty(list)) { + skb = named_prepare_buf(net, PUBLICATION, 0, dnode); + if (!skb) { + pr_warn("Bulk publication failure\n"); + return; + } + hdr = buf_msg(skb); + msg_set_bc_ack_invalid(hdr, true); + msg_set_bulk(hdr); + msg_set_non_legacy(hdr); + __skb_queue_tail(list, skb); + } + hdr = buf_msg(skb_peek_tail(list)); msg_set_last_bulk(hdr); msg_set_named_seqno(hdr, seqno); -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list 2026-07-16 19:02 ` [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi @ 2026-07-17 9:48 ` Tung Quang Nguyen 2026-07-17 18:34 ` Weiming Shi 0 siblings, 1 reply; 6+ messages in thread From: Tung Quang Nguyen @ 2026-07-17 9:48 UTC (permalink / raw) To: Weiming Shi Cc: netdev, tipc-discussion, linux-kernel, xmei5, Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman >Subject: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on >empty publication list > >named_distribute() ends by stamping the last_bulk flag on the tail skb via >buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is >enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced. > >tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id >configuration cluster_scope is populated only later by tipc_net_finalize(), so a >peer link that comes up first reaches named_distribute() with an empty list. It >is reachable by an unprivileged user (TIPC genl ops use >GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace: > > KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] > RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196) > tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221) > tipc_node_write_unlock (net/tipc/node.c:428) > tipc_rcv (net/tipc/node.c:2185) > tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal >exception in interrupt > >The peer holds back this node's later name updates until it sees a bulk with the >last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk >when the publication list is empty, so the peer still receives the last_bulk flag >and opens. > >Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") >Reported-by: Xiang Mei <xmei5@asu.edu> >Assisted-by: Claude:claude-opus-4-8 >Signed-off-by: Weiming Shi <bestswngs@gmail.com> >--- > net/tipc/name_distr.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > >diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index >ba4f4906e13b..a8bb7bd101ea 100644 >--- a/net/tipc/name_distr.c >+++ b/net/tipc/name_distr.c >@@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct >sk_buff_head *list, > skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem)); > __skb_queue_tail(list, skb); > } >+ >+ if (skb_queue_empty(list)) { >+ skb = named_prepare_buf(net, PUBLICATION, 0, dnode); >+ if (!skb) { >+ pr_warn("Bulk publication failure\n"); >+ return; >+ } >+ hdr = buf_msg(skb); >+ msg_set_bc_ack_invalid(hdr, true); >+ msg_set_bulk(hdr); >+ msg_set_non_legacy(hdr); >+ __skb_queue_tail(list, skb); >+ } As I explained before, this approach is wrong because 1. It does not handle memory allocation failure. 2. It breaks receiving peer by sending non-data message to that peer in case skb is not NULL. Could you please test below patch to see if it fixes the NULL dereference issue you reported ? --- net/tipc/core.c | 1 + net/tipc/core.h | 2 ++ net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++---- net/tipc/name_distr.h | 3 ++- net/tipc/net.c | 2 ++ net/tipc/node.c | 34 ++++++++++++++++++++++++++++-- 6 files changed, 83 insertions(+), 7 deletions(-) diff --git a/net/tipc/core.c b/net/tipc/core.c index 315975c3be81..9e81be4f01cf 100644 --- a/net/tipc/core.c +++ b/net/tipc/core.c @@ -61,6 +61,7 @@ static int __net_init tipc_init_net(struct net *net) tn->trial_addr = 0; tn->addr_trial_end = 0; tn->capabilities = TIPC_NODE_CAPABILITIES; + atomic_set(&tn->finalized, 0); INIT_WORK(&tn->work, tipc_net_finalize_work); memset(tn->node_id, 0, sizeof(tn->node_id)); memset(tn->node_id_string, 0, sizeof(tn->node_id_string)); diff --git a/net/tipc/core.h b/net/tipc/core.h index 9ce5f9ff6cc0..76768844c808 100644 --- a/net/tipc/core.h +++ b/net/tipc/core.h @@ -145,6 +145,8 @@ struct tipc_net { struct work_struct work; /* The numbers of work queues in schedule */ atomic_t wq_count; + /* flag to indicate work has finished */ + atomic_t finalized; }; static inline struct tipc_net *tipc_net(struct net *net) diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index ba5f4906e13b..8a1692dbd243 100644 --- a/net/tipc/name_distr.c +++ b/net/tipc/name_distr.c @@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p) * @pls: linked list of publication items to be packed into buffer chain * @seqno: sequence number for this message */ -static void named_distribute(struct net *net, struct sk_buff_head *list, +static int named_distribute(struct net *net, struct sk_buff_head *list, u32 dnode, struct list_head *pls, u16 seqno) { struct publication *publ; @@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, skb = named_prepare_buf(net, PUBLICATION, msg_rem, dnode); if (!skb) { + __skb_queue_purge(list); pr_warn("Bulk publication failure\n"); - return; + return 1; } hdr = buf_msg(skb); msg_set_bc_ack_invalid(hdr, true); @@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, hdr = buf_msg(skb_peek_tail(list)); msg_set_last_bulk(hdr); msg_set_named_seqno(hdr, seqno); + + return 0; } /** @@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, * @dnode: destination node * @capabilities: peer node's capabilities */ -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) { struct name_table *nt = tipc_name_table(net); struct tipc_net *tn = tipc_net(net); @@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) spin_unlock_bh(&tn->nametbl_lock); read_lock_bh(&nt->cluster_scope_lock); - named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); + /* tipc_net_finalize_work() has not finished inserting self address to + * name table yet. + */ + if (unlikely(list_empty(&nt->cluster_scope))) { + read_unlock_bh(&nt->cluster_scope_lock); + return 1; + } + + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { + read_unlock_bh(&nt->cluster_scope_lock); + return -ENOBUFS; + } + tipc_node_xmit(net, &head, dnode, 0); read_unlock_bh(&nt->cluster_scope_lock); + return 0; +} + +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode) +{ + struct name_table *nt = tipc_name_table(net); + struct tipc_net *tn = tipc_net(net); + struct sk_buff_head head; + u16 seqno; + + __skb_queue_head_init(&head); + wait_var_event(&tn->finalized, atomic_read(&tn->finalized)); + spin_lock_bh(&tn->nametbl_lock); + seqno = nt->snd_nxt; + spin_unlock_bh(&tn->nametbl_lock); + + read_lock_bh(&nt->cluster_scope_lock); + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { + read_unlock_bh(&nt->cluster_scope_lock); + return -ENOBUFS; + } + tipc_node_xmit(net, &head, dnode, 0); + read_unlock_bh(&nt->cluster_scope_lock); + + return 0; } /** diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h index c677f6f082df..cadf4e8c3e66 100644 --- a/net/tipc/name_distr.h +++ b/net/tipc/name_distr.h @@ -69,7 +69,8 @@ struct distr_item { struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ); struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ); -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode); void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq, u16 *rcv_nxt, bool *open); void tipc_named_reinit(struct net *net); diff --git a/net/tipc/net.c b/net/tipc/net.c index 7e65d0b0c4a8..4c144e720ac1 100644 --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr) tipc_sk_reinit(net); tipc_mon_reinit_self(net); tipc_nametbl_publish(net, &ua, &sk, addr); + atomic_inc(&tn->finalized); + wake_up_var(&tn->finalized); } void tipc_net_finalize_work(struct work_struct *work) diff --git a/net/tipc/node.c b/net/tipc/node.c index 8e4ef2630ae4..c5b0a98324c3 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -145,6 +145,8 @@ struct tipc_node { #ifdef CONFIG_TIPC_CRYPTO struct tipc_crypto *crypto_rx; #endif + /* Work item for bulk distribution of cluster scope publications */ + struct work_struct work; }; /* Node FSM states and events: @@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp) #ifdef CONFIG_TIPC_CRYPTO tipc_crypto_stop(&n->crypto_rx); #endif + cancel_work_sync(&n->work); kfree(n); } @@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n) write_unlock_bh(&n->lock); } +static void tipc_node_dist_bulk(struct work_struct *work) +{ + struct tipc_node *node = container_of(work, struct tipc_node, work); + + if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) { + u32 bearer_id = node->link_id & 0xffff; + + tipc_node_link_down(node, bearer_id, false); + } + + tipc_node_put(node); +} + static void tipc_node_write_unlock(struct tipc_node *n) __releases(n->lock) { @@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n) if (flags & TIPC_NOTIFY_NODE_DOWN) tipc_publ_notify(net, publ_list, node, n->capabilities); - if (flags & TIPC_NOTIFY_NODE_UP) - tipc_named_node_up(net, node, n->capabilities); + if (flags & TIPC_NOTIFY_NODE_UP) { + int rc = 0; + + rc = tipc_named_node_up(net, node, n->capabilities); + /* Defer bulk distribution to work queue */ + if (rc > 0) { + tipc_node_get(n); + schedule_work(&n->work); + } else if (rc < 0) { + /* Bring the link down to start over bulk distribution + * when the link is up again. + */ + tipc_node_link_down(n, bearer_id, false); + } + } if (flags & TIPC_NOTIFY_LINK_UP) { tipc_mon_peer_up(net, node, bearer_id); @@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id, INIT_LIST_HEAD(&n->list); INIT_LIST_HEAD(&n->publ_list); INIT_LIST_HEAD(&n->conn_sks); + INIT_WORK(&n->work, tipc_node_dist_bulk); skb_queue_head_init(&n->bc_entry.namedq); skb_queue_head_init(&n->bc_entry.inputq1); __skb_queue_head_init(&n->bc_entry.arrvq); ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list 2026-07-17 9:48 ` Tung Quang Nguyen @ 2026-07-17 18:34 ` Weiming Shi 2026-07-17 19:00 ` Weiming Shi 0 siblings, 1 reply; 6+ messages in thread From: Weiming Shi @ 2026-07-17 18:34 UTC (permalink / raw) To: Tung Quang Nguyen Cc: netdev, tipc-discussion, linux-kernel, xmei5, Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman Tung Quang Nguyen <tung.quang.nguyen@est.tech> 于2026年7月17日周五 17:48写道： > > >Subject: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on > >empty publication list > > > >named_distribute() ends by stamping the last_bulk flag on the tail skb via > >buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is > >enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced. > > > >tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id > >configuration cluster_scope is populated only later by tipc_net_finalize(), so a > >peer link that comes up first reaches named_distribute() with an empty list. It > >is reachable by an unprivileged user (TIPC genl ops use > >GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace: > > > > KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] > > RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196) > > tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221) > > tipc_node_write_unlock (net/tipc/node.c:428) > > tipc_rcv (net/tipc/node.c:2185) > > tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal > >exception in interrupt > > > >The peer holds back this node's later name updates until it sees a bulk with the > >last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk > >when the publication list is empty, so the peer still receives the last_bulk flag > >and opens. > > > >Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") > >Reported-by: Xiang Mei <xmei5@asu.edu> > >Assisted-by: Claude:claude-opus-4-8 > >Signed-off-by: Weiming Shi <bestswngs@gmail.com> > >--- > > net/tipc/name_distr.c | 14 ++++++++++++++ > > 1 file changed, 14 insertions(+) > > > >diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index > >ba4f4906e13b..a8bb7bd101ea 100644 > >--- a/net/tipc/name_distr.c > >+++ b/net/tipc/name_distr.c > >@@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct > >sk_buff_head *list, > > skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem)); > > __skb_queue_tail(list, skb); > > } > >+ > >+ if (skb_queue_empty(list)) { > >+ skb = named_prepare_buf(net, PUBLICATION, 0, dnode); > >+ if (!skb) { > >+ pr_warn("Bulk publication failure\n"); > >+ return; > >+ } > >+ hdr = buf_msg(skb); > >+ msg_set_bc_ack_invalid(hdr, true); > >+ msg_set_bulk(hdr); > >+ msg_set_non_legacy(hdr); > >+ __skb_queue_tail(list, skb); > >+ } > As I explained before, this approach is wrong because > 1. It does not handle memory allocation failure. > 2. It breaks receiving peer by sending non-data message to that peer in case skb is not NULL. > > Could you please test below patch to see if it fixes the NULL dereference issue you reported ? Hi , Tested your patch, it fixes the NULL dereference I reported. No more panic with an empty cluster_scope . One new bug found during testing: if tipc_nametbl_publish() fails in tipc_net_finalize(), the node is still marked finalized, so the deferred worker wakes up and calls named_distribute() with an empty list, hitting the same NULL dereference. I have the fix ready and sent it out: https://lore.kernel.org/all/20260717183047.2725959-1-bestswngs@gmail.com/ https://lore.kernel.org/all/20260717183047.2725959-2-bestswngs@gmail.com/ https://lore.kernel.org/all/20260717183047.2725959-3-bestswngs@gmail.com/ Thanks, Weiming Shi > > --- > net/tipc/core.c | 1 + > net/tipc/core.h | 2 ++ > net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++---- > net/tipc/name_distr.h | 3 ++- > net/tipc/net.c | 2 ++ > net/tipc/node.c | 34 ++++++++++++++++++++++++++++-- > 6 files changed, 83 insertions(+), 7 deletions(-) > > diff --git a/net/tipc/core.c b/net/tipc/core.c > index 315975c3be81..9e81be4f01cf 100644 > --- a/net/tipc/core.c > +++ b/net/tipc/core.c > @@ -61,6 +61,7 @@ static int __net_init tipc_init_net(struct net *net) > tn->trial_addr = 0; > tn->addr_trial_end = 0; > tn->capabilities = TIPC_NODE_CAPABILITIES; > + atomic_set(&tn->finalized, 0); > INIT_WORK(&tn->work, tipc_net_finalize_work); > memset(tn->node_id, 0, sizeof(tn->node_id)); > memset(tn->node_id_string, 0, sizeof(tn->node_id_string)); > diff --git a/net/tipc/core.h b/net/tipc/core.h > index 9ce5f9ff6cc0..76768844c808 100644 > --- a/net/tipc/core.h > +++ b/net/tipc/core.h > @@ -145,6 +145,8 @@ struct tipc_net { > struct work_struct work; > /* The numbers of work queues in schedule */ > atomic_t wq_count; > + /* flag to indicate work has finished */ > + atomic_t finalized; > }; > > static inline struct tipc_net *tipc_net(struct net *net) > diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c > index ba5f4906e13b..8a1692dbd243 100644 > --- a/net/tipc/name_distr.c > +++ b/net/tipc/name_distr.c > @@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p) > * @pls: linked list of publication items to be packed into buffer chain > * @seqno: sequence number for this message > */ > -static void named_distribute(struct net *net, struct sk_buff_head *list, > +static int named_distribute(struct net *net, struct sk_buff_head *list, > u32 dnode, struct list_head *pls, u16 seqno) > { > struct publication *publ; > @@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > skb = named_prepare_buf(net, PUBLICATION, msg_rem, > dnode); > if (!skb) { > + __skb_queue_purge(list); > pr_warn("Bulk publication failure\n"); > - return; > + return 1; > } > hdr = buf_msg(skb); > msg_set_bc_ack_invalid(hdr, true); > @@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > hdr = buf_msg(skb_peek_tail(list)); > msg_set_last_bulk(hdr); > msg_set_named_seqno(hdr, seqno); > + > + return 0; > } > > /** > @@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > * @dnode: destination node > * @capabilities: peer node's capabilities > */ > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > { > struct name_table *nt = tipc_name_table(net); > struct tipc_net *tn = tipc_net(net); > @@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > spin_unlock_bh(&tn->nametbl_lock); > > read_lock_bh(&nt->cluster_scope_lock); > - named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); > + /* tipc_net_finalize_work() has not finished inserting self address to > + * name table yet. > + */ > + if (unlikely(list_empty(&nt->cluster_scope))) { > + read_unlock_bh(&nt->cluster_scope_lock); > + return 1; > + } > + > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { > + read_unlock_bh(&nt->cluster_scope_lock); > + return -ENOBUFS; > + } > + > tipc_node_xmit(net, &head, dnode, 0); > read_unlock_bh(&nt->cluster_scope_lock); > + return 0; > +} > + > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode) > +{ > + struct name_table *nt = tipc_name_table(net); > + struct tipc_net *tn = tipc_net(net); > + struct sk_buff_head head; > + u16 seqno; > + > + __skb_queue_head_init(&head); > + wait_var_event(&tn->finalized, atomic_read(&tn->finalized)); > + spin_lock_bh(&tn->nametbl_lock); > + seqno = nt->snd_nxt; > + spin_unlock_bh(&tn->nametbl_lock); > + > + read_lock_bh(&nt->cluster_scope_lock); > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { > + read_unlock_bh(&nt->cluster_scope_lock); > + return -ENOBUFS; > + } > + tipc_node_xmit(net, &head, dnode, 0); > + read_unlock_bh(&nt->cluster_scope_lock); > + > + return 0; > } > > /** > diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h > index c677f6f082df..cadf4e8c3e66 100644 > --- a/net/tipc/name_distr.h > +++ b/net/tipc/name_distr.h > @@ -69,7 +69,8 @@ struct distr_item { > > struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ); > struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ); > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode); > void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq, > u16 *rcv_nxt, bool *open); > void tipc_named_reinit(struct net *net); > diff --git a/net/tipc/net.c b/net/tipc/net.c > index 7e65d0b0c4a8..4c144e720ac1 100644 > --- a/net/tipc/net.c > +++ b/net/tipc/net.c > @@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr) > tipc_sk_reinit(net); > tipc_mon_reinit_self(net); > tipc_nametbl_publish(net, &ua, &sk, addr); > + atomic_inc(&tn->finalized); > + wake_up_var(&tn->finalized); > } > > void tipc_net_finalize_work(struct work_struct *work) > diff --git a/net/tipc/node.c b/net/tipc/node.c > index 8e4ef2630ae4..c5b0a98324c3 100644 > --- a/net/tipc/node.c > +++ b/net/tipc/node.c > @@ -145,6 +145,8 @@ struct tipc_node { > #ifdef CONFIG_TIPC_CRYPTO > struct tipc_crypto *crypto_rx; > #endif > + /* Work item for bulk distribution of cluster scope publications */ > + struct work_struct work; > }; > > /* Node FSM states and events: > @@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp) > #ifdef CONFIG_TIPC_CRYPTO > tipc_crypto_stop(&n->crypto_rx); > #endif > + cancel_work_sync(&n->work); > kfree(n); > } > > @@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n) > write_unlock_bh(&n->lock); > } > > +static void tipc_node_dist_bulk(struct work_struct *work) > +{ > + struct tipc_node *node = container_of(work, struct tipc_node, work); > + > + if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) { > + u32 bearer_id = node->link_id & 0xffff; > + > + tipc_node_link_down(node, bearer_id, false); > + } > + > + tipc_node_put(node); > +} > + > static void tipc_node_write_unlock(struct tipc_node *n) > __releases(n->lock) > { > @@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n) > if (flags & TIPC_NOTIFY_NODE_DOWN) > tipc_publ_notify(net, publ_list, node, n->capabilities); > > - if (flags & TIPC_NOTIFY_NODE_UP) > - tipc_named_node_up(net, node, n->capabilities); > + if (flags & TIPC_NOTIFY_NODE_UP) { > + int rc = 0; > + > + rc = tipc_named_node_up(net, node, n->capabilities); > + /* Defer bulk distribution to work queue */ > + if (rc > 0) { > + tipc_node_get(n); > + schedule_work(&n->work); > + } else if (rc < 0) { > + /* Bring the link down to start over bulk distribution > + * when the link is up again. > + */ > + tipc_node_link_down(n, bearer_id, false); > + } > + } > > if (flags & TIPC_NOTIFY_LINK_UP) { > tipc_mon_peer_up(net, node, bearer_id); > @@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id, > INIT_LIST_HEAD(&n->list); > INIT_LIST_HEAD(&n->publ_list); > INIT_LIST_HEAD(&n->conn_sks); > + INIT_WORK(&n->work, tipc_node_dist_bulk); > skb_queue_head_init(&n->bc_entry.namedq); > skb_queue_head_init(&n->bc_entry.inputq1); > __skb_queue_head_init(&n->bc_entry.arrvq); ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list 2026-07-17 18:34 ` Weiming Shi @ 2026-07-17 19:00 ` Weiming Shi 0 siblings, 0 replies; 6+ messages in thread From: Weiming Shi @ 2026-07-17 19:00 UTC (permalink / raw) To: Tung Quang Nguyen Cc: netdev, tipc-discussion, linux-kernel, xmei5, Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman Weiming Shi <bestswngs@gmail.com> 于2026年7月18日周六 02:34写道： > > Tung Quang Nguyen <tung.quang.nguyen@est.tech> 于2026年7月17日周五 17:48写道： > > > > >Subject: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on > > >empty publication list > > > > > >named_distribute() ends by stamping the last_bulk flag on the tail skb via > > >buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is > > >enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced. > > > > > >tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id > > >configuration cluster_scope is populated only later by tipc_net_finalize(), so a > > >peer link that comes up first reaches named_distribute() with an empty list. It > > >is reachable by an unprivileged user (TIPC genl ops use > > >GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace: > > > > > > KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] > > > RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196) > > > tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221) > > > tipc_node_write_unlock (net/tipc/node.c:428) > > > tipc_rcv (net/tipc/node.c:2185) > > > tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal > > >exception in interrupt > > > > > >The peer holds back this node's later name updates until it sees a bulk with the > > >last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk > > >when the publication list is empty, so the peer still receives the last_bulk flag > > >and opens. > > > > > >Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") > > >Reported-by: Xiang Mei <xmei5@asu.edu> > > >Assisted-by: Claude:claude-opus-4-8 > > >Signed-off-by: Weiming Shi <bestswngs@gmail.com> > > >--- > > > net/tipc/name_distr.c | 14 ++++++++++++++ > > > 1 file changed, 14 insertions(+) > > > > > >diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index > > >ba4f4906e13b..a8bb7bd101ea 100644 > > >--- a/net/tipc/name_distr.c > > >+++ b/net/tipc/name_distr.c > > >@@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct > > >sk_buff_head *list, > > > skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem)); > > > __skb_queue_tail(list, skb); > > > } > > >+ > > >+ if (skb_queue_empty(list)) { > > >+ skb = named_prepare_buf(net, PUBLICATION, 0, dnode); > > >+ if (!skb) { > > >+ pr_warn("Bulk publication failure\n"); > > >+ return; > > >+ } > > >+ hdr = buf_msg(skb); > > >+ msg_set_bc_ack_invalid(hdr, true); > > >+ msg_set_bulk(hdr); > > >+ msg_set_non_legacy(hdr); > > >+ __skb_queue_tail(list, skb); > > >+ } > > As I explained before, this approach is wrong because > > 1. It does not handle memory allocation failure. > > 2. It breaks receiving peer by sending non-data message to that peer in case skb is not NULL. > > > > Could you please test below patch to see if it fixes the NULL dereference issue you reported ? > > Hi , > Tested your patch, it fixes the NULL dereference I reported. No more > panic with an empty cluster_scope . > > One new bug found during testing: if tipc_nametbl_publish() fails in > tipc_net_finalize(), the node is > still marked finalized, so the deferred worker wakes up and calls > named_distribute() with an empty list, > hitting the same NULL dereference. > > I have the fix ready and sent it out: > > https://lore.kernel.org/all/20260717183047.2725959-1-bestswngs@gmail.com/ > https://lore.kernel.org/all/20260717183047.2725959-2-bestswngs@gmail.com/ > https://lore.kernel.org/all/20260717183047.2725959-3-bestswngs@gmail.com/ > > Thanks, > Weiming Shi > Hi, The v5 I sent earlier was incomplete. It only carried the two follow-up patches and depended on Tung's patch from this thread as its base, which made the series hard to apply on its own. I have resent the series as v6: https://lore.kernel.org/all/20260717185701.2828080-1-bestswngs@gmail.com/ Sorry for the noise. > > > > --- > > net/tipc/core.c | 1 + > > net/tipc/core.h | 2 ++ > > net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++---- > > net/tipc/name_distr.h | 3 ++- > > net/tipc/net.c | 2 ++ > > net/tipc/node.c | 34 ++++++++++++++++++++++++++++-- > > 6 files changed, 83 insertions(+), 7 deletions(-) > > > > diff --git a/net/tipc/core.c b/net/tipc/core.c > > index 315975c3be81..9e81be4f01cf 100644 > > --- a/net/tipc/core.c > > +++ b/net/tipc/core.c > > @@ -61,6 +61,7 @@ static int __net_init tipc_init_net(struct net *net) > > tn->trial_addr = 0; > > tn->addr_trial_end = 0; > > tn->capabilities = TIPC_NODE_CAPABILITIES; > > + atomic_set(&tn->finalized, 0); > > INIT_WORK(&tn->work, tipc_net_finalize_work); > > memset(tn->node_id, 0, sizeof(tn->node_id)); > > memset(tn->node_id_string, 0, sizeof(tn->node_id_string)); > > diff --git a/net/tipc/core.h b/net/tipc/core.h > > index 9ce5f9ff6cc0..76768844c808 100644 > > --- a/net/tipc/core.h > > +++ b/net/tipc/core.h > > @@ -145,6 +145,8 @@ struct tipc_net { > > struct work_struct work; > > /* The numbers of work queues in schedule */ > > atomic_t wq_count; > > + /* flag to indicate work has finished */ > > + atomic_t finalized; > > }; > > > > static inline struct tipc_net *tipc_net(struct net *net) > > diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c > > index ba5f4906e13b..8a1692dbd243 100644 > > --- a/net/tipc/name_distr.c > > +++ b/net/tipc/name_distr.c > > @@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p) > > * @pls: linked list of publication items to be packed into buffer chain > > * @seqno: sequence number for this message > > */ > > -static void named_distribute(struct net *net, struct sk_buff_head *list, > > +static int named_distribute(struct net *net, struct sk_buff_head *list, > > u32 dnode, struct list_head *pls, u16 seqno) > > { > > struct publication *publ; > > @@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > > skb = named_prepare_buf(net, PUBLICATION, msg_rem, > > dnode); > > if (!skb) { > > + __skb_queue_purge(list); > > pr_warn("Bulk publication failure\n"); > > - return; > > + return 1; > > } > > hdr = buf_msg(skb); > > msg_set_bc_ack_invalid(hdr, true); > > @@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > > hdr = buf_msg(skb_peek_tail(list)); > > msg_set_last_bulk(hdr); > > msg_set_named_seqno(hdr, seqno); > > + > > + return 0; > > } > > > > /** > > @@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, > > * @dnode: destination node > > * @capabilities: peer node's capabilities > > */ > > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > > { > > struct name_table *nt = tipc_name_table(net); > > struct tipc_net *tn = tipc_net(net); > > @@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) > > spin_unlock_bh(&tn->nametbl_lock); > > > > read_lock_bh(&nt->cluster_scope_lock); > > - named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); > > + /* tipc_net_finalize_work() has not finished inserting self address to > > + * name table yet. > > + */ > > + if (unlikely(list_empty(&nt->cluster_scope))) { > > + read_unlock_bh(&nt->cluster_scope_lock); > > + return 1; > > + } > > + > > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { > > + read_unlock_bh(&nt->cluster_scope_lock); > > + return -ENOBUFS; > > + } > > + > > tipc_node_xmit(net, &head, dnode, 0); > > read_unlock_bh(&nt->cluster_scope_lock); > > + return 0; > > +} > > + > > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode) > > +{ > > + struct name_table *nt = tipc_name_table(net); > > + struct tipc_net *tn = tipc_net(net); > > + struct sk_buff_head head; > > + u16 seqno; > > + > > + __skb_queue_head_init(&head); > > + wait_var_event(&tn->finalized, atomic_read(&tn->finalized)); > > + spin_lock_bh(&tn->nametbl_lock); > > + seqno = nt->snd_nxt; > > + spin_unlock_bh(&tn->nametbl_lock); > > + > > + read_lock_bh(&nt->cluster_scope_lock); > > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) { > > + read_unlock_bh(&nt->cluster_scope_lock); > > + return -ENOBUFS; > > + } > > + tipc_node_xmit(net, &head, dnode, 0); > > + read_unlock_bh(&nt->cluster_scope_lock); > > + > > + return 0; > > } > > > > /** > > diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h > > index c677f6f082df..cadf4e8c3e66 100644 > > --- a/net/tipc/name_distr.h > > +++ b/net/tipc/name_distr.h > > @@ -69,7 +69,8 @@ struct distr_item { > > > > struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ); > > struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ); > > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); > > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities); > > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode); > > void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq, > > u16 *rcv_nxt, bool *open); > > void tipc_named_reinit(struct net *net); > > diff --git a/net/tipc/net.c b/net/tipc/net.c > > index 7e65d0b0c4a8..4c144e720ac1 100644 > > --- a/net/tipc/net.c > > +++ b/net/tipc/net.c > > @@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr) > > tipc_sk_reinit(net); > > tipc_mon_reinit_self(net); > > tipc_nametbl_publish(net, &ua, &sk, addr); > > + atomic_inc(&tn->finalized); > > + wake_up_var(&tn->finalized); > > } > > > > void tipc_net_finalize_work(struct work_struct *work) > > diff --git a/net/tipc/node.c b/net/tipc/node.c > > index 8e4ef2630ae4..c5b0a98324c3 100644 > > --- a/net/tipc/node.c > > +++ b/net/tipc/node.c > > @@ -145,6 +145,8 @@ struct tipc_node { > > #ifdef CONFIG_TIPC_CRYPTO > > struct tipc_crypto *crypto_rx; > > #endif > > + /* Work item for bulk distribution of cluster scope publications */ > > + struct work_struct work; > > }; > > > > /* Node FSM states and events: > > @@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp) > > #ifdef CONFIG_TIPC_CRYPTO > > tipc_crypto_stop(&n->crypto_rx); > > #endif > > + cancel_work_sync(&n->work); > > kfree(n); > > } > > > > @@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n) > > write_unlock_bh(&n->lock); > > } > > > > +static void tipc_node_dist_bulk(struct work_struct *work) > > +{ > > + struct tipc_node *node = container_of(work, struct tipc_node, work); > > + > > + if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) { > > + u32 bearer_id = node->link_id & 0xffff; > > + > > + tipc_node_link_down(node, bearer_id, false); > > + } > > + > > + tipc_node_put(node); > > +} > > + > > static void tipc_node_write_unlock(struct tipc_node *n) > > __releases(n->lock) > > { > > @@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n) > > if (flags & TIPC_NOTIFY_NODE_DOWN) > > tipc_publ_notify(net, publ_list, node, n->capabilities); > > > > - if (flags & TIPC_NOTIFY_NODE_UP) > > - tipc_named_node_up(net, node, n->capabilities); > > + if (flags & TIPC_NOTIFY_NODE_UP) { > > + int rc = 0; > > + > > + rc = tipc_named_node_up(net, node, n->capabilities); > > + /* Defer bulk distribution to work queue */ > > + if (rc > 0) { > > + tipc_node_get(n); > > + schedule_work(&n->work); > > + } else if (rc < 0) { > > + /* Bring the link down to start over bulk distribution > > + * when the link is up again. > > + */ > > + tipc_node_link_down(n, bearer_id, false); > > + } > > + } > > > > if (flags & TIPC_NOTIFY_LINK_UP) { > > tipc_mon_peer_up(net, node, bearer_id); > > @@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id, > > INIT_LIST_HEAD(&n->list); > > INIT_LIST_HEAD(&n->publ_list); > > INIT_LIST_HEAD(&n->conn_sks); > > + INIT_WORK(&n->work, tipc_node_dist_bulk); > > skb_queue_head_init(&n->bc_entry.namedq); > > skb_queue_head_init(&n->bc_entry.inputq1); > > __skb_queue_head_init(&n->bc_entry.arrvq); ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-07-17 19:01 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-07-16 19:02 [PATCH net v4 0/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 1/2] tipc: guard against empty list in tipc_node_xmit() Weiming Shi 2026-07-16 19:02 ` [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list Weiming Shi 2026-07-17 9:48 ` Tung Quang Nguyen 2026-07-17 18:34 ` Weiming Shi 2026-07-17 19:00 ` Weiming Shi
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox