tipc_named_node_up() builds a bulk of this node's cluster-scope service bindings for a peer that just came up and sends it with tipc_node_xmit(). Neither step tolerates an empty skb chain: named_distribute() finishes with buf_msg(skb_peek_tail(list)) to tag the last message, and for a same-host peer tipc_node_xmit() routes into tipc_lxc_xmit(), which reads buf_msg(skb_peek(list)). skb_peek*() returns NULL on an empty chain, so buf_msg(NULL) faults. The chain is empty in two cases: when cluster_scope itself is empty, and when named_distribute() bails out on an allocation failure without queueing any buffer. cluster_scope is legitimately empty during the window in tipc_net_finalize() between setting the node address, after which peers can link up and trigger tipc_named_node_up(), and tipc_nametbl_publish() inserting the first self-binding. A peer linking in that window crashes the node. It is reachable by an unprivileged user, who can gain CAP_NET_ADMIN in a private net namespace and drive TIPC there. Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] RIP: 0010:tipc_lxc_xmit (net/tipc/node.c:1629 net/tipc/msg.h:202) tipc_node_xmit (net/tipc/node.c:1718) tipc_named_node_up (net/tipc/name_distr.c:222) tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:2185) tipc_l2_rcv_msg (net/tipc/bearer.c:669) Distribute only when cluster_scope is non-empty, and send only when named_distribute() actually produced a buffer. An empty bulk carries no bindings, so not sending it changes nothing. tipc_node_xmit() does not touch cluster_scope, so move it out of cluster_scope_lock. Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") Reported-by: Xiang Mei Suggested-by: Tung Quang Nguyen Assisted-by: Claude:claude-opus-4-8 Cc: stable@vger.kernel.org Signed-off-by: Weiming Shi --- v3: - Guard tipc_node_xmit() with skb_queue_empty(&head) so an empty chain from a named_distribute() allocation failure is not sent either, and move it out of cluster_scope_lock since it does not use cluster_scope (Tung Quang Nguyen). v2: - Guard in tipc_named_node_up() instead of inside named_distribute(). net/tipc/name_distr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index ba4f4906e13b..888a87d769e7 100644 --- a/net/tipc/name_distr.c +++ b/net/tipc/name_distr.c @@ -218,9 +218,12 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) spin_unlock_bh(&tn->nametbl_lock); read_lock_bh(&nt->cluster_scope_lock); - named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); - tipc_node_xmit(net, &head, dnode, 0); + if (!list_empty(&nt->cluster_scope)) + named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); read_unlock_bh(&nt->cluster_scope_lock); + + if (!skb_queue_empty(&head)) + tipc_node_xmit(net, &head, dnode, 0); } /** -- 2.43.0