tipc_node_xmit() passes @list to tipc_lxc_xmit(), which dereferences buf_msg(skb_peek(list)) without checking, so an empty list causes a NULL pointer dereference. named_distribute() can hand it an empty list when a bulk allocation fails. tipc_link_xmit() was already guarded in commit b77413446408 ("tipc: fix NULL deref in tipc_link_xmit()"); guard tipc_node_xmit() itself so the tipc_lxc_xmit() path is covered too. Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi --- net/tipc/node.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 97aa970a0d83..fc241e7b0c1f 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list, int bearer_id; int rc; + if (skb_queue_empty(list)) + return 0; + if (in_own_node(net, dnode)) { tipc_loopback_trace(net, list); spin_lock_init(&list->lock); -- 2.43.0