From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f178.google.com (mail-dy1-f178.google.com [74.125.82.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73B882F8EB1 for ; Tue, 16 Jun 2026 12:28:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781612888; cv=none; b=nJuxCINygk51o4U7FN1TKR41Tp+2b9xcOFS36k5R7Gm4xdkSMsiH1HwG6fAZemaFCGnv1SAFphqpX86F33KuMl+Ak35TDd2qCWttoZo/Rxam4GgfhtCjSYRZG5gQ++mzV9P0c89z8F1zsCBOBGYBNR3yxpND4RxoyzGyzaQXsYE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781612888; c=relaxed/simple; bh=4ant24vn2jdRTX21sRflYNjD3h7p5KzuvQMevvhFwIo=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=symPS3Wxd0Zh0WYDB72VWkcjpRF0Tff6iarakyI43y+UKk201pvP7niZ5n1ZHK/Zst6j+C4U3gn7aY9V2aI8sHFzi11fetbom2YFProY6vDUsDR6jxYi9fCuzZ6G18rBMxqbP3cBZ2CYIgi8HQT3fFQx6O3Dvm6YmRZNpiB4Wro= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MkSL+J4j; arc=none smtp.client-ip=74.125.82.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MkSL+J4j" Received: by mail-dy1-f178.google.com with SMTP id 5a478bee46e88-30bbe98c3f0so536289eec.0 for ; Tue, 16 Jun 2026 05:28:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781612886; x=1782217686; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=lyGPjaguuOxKf2tsRvxeo5mNta1TX/zd4QKLI95WEYw=; b=MkSL+J4js4a+RQXENDWkRsY/bB9uByckzfHnWY9IrC/2e8XrVoLxaGYKu+7/hTQqt6 Z1ahvjmrX5Bso66affsb/Oa4VRtWI4EyGIh+V7b0qWDjmDv/gSENbILaqrQ5+KhBvIxW GPmlFxKgfanqs6DMMZz5I3oF8bVw7i9Q9/qDSp1Amekrz0QiLf9SnxAmUY7WXYJcgcDz hv8DYEutdy4ihdxlqOlJQNUDyTozrRS3uuQx+wErJ5pNLcUCdHcFmMkmYXauUv4pzZ5F 6CH7xWBXwTvti7lXMhkUIW8+gtjPAszF9cleoyDdEpg1PAgvh6jBRN/hKF3+XX/zgud4 wJLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781612886; x=1782217686; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=lyGPjaguuOxKf2tsRvxeo5mNta1TX/zd4QKLI95WEYw=; b=MLX6TdyhfAY9UnzsKp/vLd/g9ck/XmJ2AENcCvBc4irmZ/IjvKLgzRY9U2aUkhgBpA p1gIP5wC6EjzWzWewLVrz4rEPlABwb8583u1Y0j8OuxbjTAfNLY0HBjabgUuM4WWQ+Sz OwPnRphQ69w0MRmZf2dj5mTDcHBOdcIcMRVcZMgwaCNCmo+3HQcPBI/3maNOKQdq2O1/ J4SJaJiOl/4+dNvL3VTVakKwIVxug8Fm9ezU2UHjE5l7nqi8ssuNQnUbNHQk8eRD36Bj E3rg7y0e8lIcHMXuT1IUYYvi89anuWSycC+f6egXXdjIM5+QzCxptIT8XBUfmlFnU6W4 XpWg== X-Forwarded-Encrypted: i=1; AFNElJ8936HSwfTA+wUeIrewObZL90az8EWDRzpoCePtdY6BPh5hsnvHZjQXFAIjQfH2gtB/J8NCzDifqo9Znu0=@vger.kernel.org X-Gm-Message-State: AOJu0YyDFz5n8aESbSD9aykwu2GRn9lMF/L/pwdDnW1onW9lQXFAJj5G 0rEKHsxvekAyR5fPRwlAzoV3kfjrjEMhBl5PlpknLXerh3uRZ8Mz28L5lt56fLQ2360= X-Gm-Gg: Acq92OE0uMWTcFNRjCikALZVcBAZs9uj5EZZCLlkKqZvNoUhAv0mPTge6OqPV/w/EZ5 dgSN1eI9rxHtU8VGuUv/C7fvwfIMqyANF8TKzME7s6HTQbUiNT2IKRM159wMs8SRLiDmSPPaJuR teTGOY7b9ijPB1oy7WEK9xPmCjUYq5/xI1REzePv6yfE49y1ELFw5Pr1A9WHs8JqVlpzOnD1fSB pKe3sAsEcL2FRENWnOrbIJwlnhgkMSIRfU8kDiDFHE8V5Bg1C0mRnGVmgo4zh7bfWYJ6/t4XGJf wqMXws/EZxbER395SZDeMdCzmjSZTJ8Ab9/GOxy32pxQntl92PoKmGX5YAE8QmC81HqylKfc7V5 gwWFLU+AS+etPZLkgRBjV+kWxiC2pwx6ZIsq+IU56QC0cqmUczdB0DEXuBRXyatuJbSEVqGuDfZ /UFUOmZbfnMUdzEoh4C5XBtFWhu8pMDprsABkZP2Is/E9ez+WVjl7a9RHacfVZbw== X-Received: by 2002:a05:7300:7309:b0:304:188d:d0be with SMTP id 5a478bee46e88-3082009b9eemr10717310eec.16.1781612886330; Tue, 16 Jun 2026 05:28:06 -0700 (PDT) Received: from localhost ([198.176.50.157]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3081eb9a2e7sm18658588eec.30.2026.06.16.05.28.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 16 Jun 2026 05:28:05 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 16 Jun 2026 20:28:01 +0800 Message-Id: Cc: "Simon Horman" , "netdev@vger.kernel.org" , "tipc-discussion@lists.sourceforge.net" , "linux-kernel@vger.kernel.org" , "Xiang Mei" , "Jon Maloy" , "David S . Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" Subject: Re: [PATCH net] tipc: fix use-after-free of discoverer in tipc_disc_rcv() From: "Weiming Shi" To: "Tung Quang Nguyen" , "Weiming Shi" X-Mailer: aerc 0.21.0 References: <20260610153349.2546041-2-bestswngs@gmail.com> In-Reply-To: On Fri Jun 12, 2026 at 4:53 PM CST, Tung Quang Nguyen wrote: >>Subject: [PATCH net] tipc: fix use-after-free of discoverer in tipc_disc_= rcv() >> >>bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), b= ut >>tipc_disc_rcv() still dereferences b->disc in RX softirq under >>rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). >> >>L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_me= dia(), >>but the UDP bearer defers that call to the >>cleanup_bearer() workqueue, so the discoverer is freed with no grace >>period: >> >> BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:14= 9) >>Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 >> tipc_disc_rcv (net/tipc/discover.c:149) >> tipc_rcv (net/tipc/node.c:2126) >> tipc_udp_recv (net/tipc/udp_media.c:391) >> udp_rcv (net/ipv4/udp.c:2643) >> ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by tas= k 181: >> kfree (mm/slub.c:6565) >> bearer_disable (net/tipc/bearer.c:418) >> tipc_nl_bearer_disable (net/tipc/bearer.c:1001) >> >>The bearer is freed with kfree_rcu(); free the discoverer the same way. >>Add an rcu_head to struct tipc_discoverer and free it and its skb from an= RCU >>callback. >> >>Reachable from an unprivileged user namespace: the TIPCv2 genl family is >>netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs >>CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. >> >>Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash >>values") >>Reported-by: Xiang Mei >>Assisted-by: Claude:claude-opus-4-8 >>Signed-off-by: Weiming Shi >>--- >> net/tipc/discover.c | 13 +++++++++++-- >> 1 file changed, 11 insertions(+), 2 deletions(-) >> >>diff --git a/net/tipc/discover.c b/net/tipc/discover.c index >>3e54d2df5683a..34dbe5ad10e09 100644 >>--- a/net/tipc/discover.c >>+++ b/net/tipc/discover.c >>@@ -58,6 +58,7 @@ >> * @skb: request message to be (repeatedly) sent >> * @timer: timer governing period between requests >> * @timer_intv: current interval between requests (in ms) >>+ * @rcu: RCU head for deferred freeing >> */ >> struct tipc_discoverer { >> u32 bearer_id; >>@@ -69,6 +70,7 @@ struct tipc_discoverer { >> struct sk_buff *skb; >> struct timer_list timer; >> unsigned long timer_intv; >>+ struct rcu_head rcu; >> }; >> >> /** >>@@ -382,6 +384,14 @@ int tipc_disc_create(struct net *net, struct tipc_be= arer >>*b, >> return 0; >> } >> >>+static void tipc_disc_free_rcu(struct rcu_head *rp) { >>+ struct tipc_discoverer *d =3D container_of(rp, struct tipc_discoverer, >>+rcu); > > This line is long (over 80 columns). Please break it into 2 lines (refer = to linux/Documentation/process/coding-style.rst). > >>+ >>+ kfree_skb(d->skb); >>+ kfree(d); >>+} >>+ >> /** >> * tipc_disc_delete - destroy object sending periodic link setup request= s >> * @d: ptr to link dest structure >>@@ -389,8 +399,7 @@ int tipc_disc_create(struct net *net, struct tipc_bea= rer >>*b, void tipc_disc_delete(struct tipc_discoverer *d) { >> timer_shutdown_sync(&d->timer); >>- kfree_skb(d->skb); >>- kfree(d); >>+ call_rcu(&d->rcu, tipc_disc_free_rcu); >> } >> >> /** >>-- >>2.43.0 >> Hi, I=E2=80=99m sorry for taking so long to respond. The v2 version has already= been sent.