named_distribute() builds the bulk messages for @pls into @list and then dereferences the tail skb: hdr = buf_msg(skb_peek_tail(list)); msg_set_last_bulk(hdr); If @pls is empty no skb is enqueued, skb_peek_tail() returns NULL, and msg_set_last_bulk() writes through buf_msg(NULL). tipc_named_node_up() passes &nt->cluster_scope. With a node-id configuration the TIPC_NODE_STATE name is published by tipc_net_finalize() from a work item, which sets the node address before publishing the name. The node accepts links once the address is set, so a link that comes up before the publish runs named_distribute() on an empty cluster_scope: KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df] RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196) tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221) tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:2185) tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal exception in interrupt TIPC genl ops use GENL_UNS_ADMIN_PERM, so an unprivileged user can reach this from a user+net namespace. Return early in tipc_named_node_up() when cluster_scope is empty, so named_distribute() is not called with an empty list. Fixes: cad2929dc432 ("tipc: update a binding service via broadcast") Reported-by: Xiang Mei Suggested-by: Tung Quang Nguyen Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi --- v2: - Return early in tipc_named_node_up() when cluster_scope is empty, instead of guarding the tail access inside named_distribute(). net/tipc/name_distr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index ba4f4906e13b..60ccaa862162 100644 --- a/net/tipc/name_distr.c +++ b/net/tipc/name_distr.c @@ -218,6 +218,10 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities) spin_unlock_bh(&tn->nametbl_lock); read_lock_bh(&nt->cluster_scope_lock); + if (list_empty(&nt->cluster_scope)) { + read_unlock_bh(&nt->cluster_scope_lock); + return; + } named_distribute(net, &head, dnode, &nt->cluster_scope, seqno); tipc_node_xmit(net, &head, dnode, 0); read_unlock_bh(&nt->cluster_scope_lock); -- 2.43.0