[PATCH net v3] tipc: fix NULL deref in tipc_lxc_xmit() on node up

[PATCH net v3] tipc: fix NULL deref in tipc_lxc_xmit() on node up

[Weiming Shi]

tipc_named_node_up() builds a bulk of this node's cluster-scope service
bindings for a peer that just came up and sends it with tipc_node_xmit().
Neither step tolerates an empty skb chain: named_distribute() finishes
with buf_msg(skb_peek_tail(list)) to tag the last message, and for a
same-host peer tipc_node_xmit() routes into tipc_lxc_xmit(), which reads
buf_msg(skb_peek(list)). skb_peek*() returns NULL on an empty chain, so
buf_msg(NULL) faults.

The chain is empty in two cases: when cluster_scope itself is empty, and
when named_distribute() bails out on an allocation failure without
queueing any buffer. cluster_scope is legitimately empty during the
window in tipc_net_finalize() between setting the node address, after
which peers can link up and trigger tipc_named_node_up(), and
tipc_nametbl_publish() inserting the first self-binding. A peer linking
in that window crashes the node. It is reachable by an unprivileged
user, who can gain CAP_NET_ADMIN in a private net namespace and drive
TIPC there.

 Oops: general protection fault, probably for non-canonical address
 KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
 RIP: 0010:tipc_lxc_xmit (net/tipc/node.c:1629 net/tipc/msg.h:202)
  tipc_node_xmit (net/tipc/node.c:1718)
  tipc_named_node_up (net/tipc/name_distr.c:222)
  tipc_node_write_unlock (net/tipc/node.c:428)
  tipc_rcv (net/tipc/node.c:2185)
  tipc_l2_rcv_msg (net/tipc/bearer.c:669)

Distribute only when cluster_scope is non-empty, and send only when
named_distribute() actually produced a buffer. An empty bulk carries no
bindings, so not sending it changes nothing. tipc_node_xmit() does not
touch cluster_scope, so move it out of cluster_scope_lock.

Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Suggested-by: Tung Quang Nguyen <tung.quang.nguyen@est.tech>
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
v3:
 - Guard tipc_node_xmit() with skb_queue_empty(&head) so an empty chain
   from a named_distribute() allocation failure is not sent either, and
   move it out of cluster_scope_lock since it does not use cluster_scope
   (Tung Quang Nguyen).
v2:
 - Guard in tipc_named_node_up() instead of inside named_distribute().
 net/tipc/name_distr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index ba4f4906e13b..888a87d769e7 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -218,9 +218,12 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
 	spin_unlock_bh(&tn->nametbl_lock);
 
 	read_lock_bh(&nt->cluster_scope_lock);
-	named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
-	tipc_node_xmit(net, &head, dnode, 0);
+	if (!list_empty(&nt->cluster_scope))
+		named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
 	read_unlock_bh(&nt->cluster_scope_lock);
+
+	if (!skb_queue_empty(&head))
+		tipc_node_xmit(net, &head, dnode, 0);
 }
 
 /**
-- 
2.43.0