[PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()

[PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()

[Weiming Shi]

tipc_node_xmit() dispatches a buffer list either to the bearer path via
tipc_link_xmit() or, when the destination node lives in a sibling network
namespace on the same host (n->peer_net set), to tipc_lxc_xmit(). The
bearer path returns early on an empty list, but tipc_node_xmit() does not,
and tipc_lxc_xmit() dereferences the first buffer without checking:

	struct tipc_msg *hdr = buf_msg(skb_peek(list));

named_distribute() can hand tipc_node_xmit() an empty list. It bails out
early when named_prepare_buf() fails its GFP_ATOMIC allocation, leaving
the queue empty, and tipc_named_node_up() then calls tipc_node_xmit() on
it unconditionally. On the intra-host container path skb_peek() returns
NULL and msg_user() reads through it.

The TIPC configuration ops are flagged GENL_UNS_ADMIN_PERM, so an
unprivileged user can reach this via unshare(CLONE_NEWUSER|CLONE_NEWNET).

  Oops: general protection fault, probably for non-canonical address 0xdffffc000000001b
  KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
  CPU: 0 Comm: ksoftirqd/0
  RIP: 0010:tipc_lxc_xmit (net/tipc/msg.h:202 net/tipc/node.c:1629)
  Call Trace:
   tipc_node_xmit (net/tipc/node.c:1721)
   tipc_named_node_up (net/tipc/name_distr.c:223)
   tipc_node_write_unlock (net/tipc/node.c:428)
   tipc_rcv (net/tipc/node.c:2189)
   tipc_l2_rcv_msg (net/tipc/bearer.c:670)

Return early from tipc_node_xmit() when the list is empty.

Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/tipc/node.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 8e4ef2630ae4..cd05269e5335 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
 	int bearer_id;
 	int rc;
 
+	if (skb_queue_empty(list))
+		return 0;
+
 	if (in_own_node(net, dnode)) {
 		tipc_loopback_trace(net, list);
 		spin_lock_init(&list->lock);
-- 
2.43.0

RE: [PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()

[Tung Quang Nguyen]

>Subject: [PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()
>
>tipc_node_xmit() dispatches a buffer list either to the bearer path via
>tipc_link_xmit() or, when the destination node lives in a sibling network
>namespace on the same host (n->peer_net set), to tipc_lxc_xmit(). The bearer
>path returns early on an empty list, but tipc_node_xmit() does not, and
>tipc_lxc_xmit() dereferences the first buffer without checking:
>
>	struct tipc_msg *hdr = buf_msg(skb_peek(list));
>
>named_distribute() can hand tipc_node_xmit() an empty list. It bails out early
>when named_prepare_buf() fails its GFP_ATOMIC allocation, leaving the queue
>empty, and tipc_named_node_up() then calls tipc_node_xmit() on it
>unconditionally. On the intra-host container path skb_peek() returns NULL and
>msg_user() reads through it.
>
>The TIPC configuration ops are flagged GENL_UNS_ADMIN_PERM, so an
>unprivileged user can reach this via
>unshare(CLONE_NEWUSER|CLONE_NEWNET).
>
>  Oops: general protection fault, probably for non-canonical address
>0xdffffc000000001b
>  KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
>  CPU: 0 Comm: ksoftirqd/0
>  RIP: 0010:tipc_lxc_xmit (net/tipc/msg.h:202 net/tipc/node.c:1629)
>  Call Trace:
>   tipc_node_xmit (net/tipc/node.c:1721)
>   tipc_named_node_up (net/tipc/name_distr.c:223)
>   tipc_node_write_unlock (net/tipc/node.c:428)
>   tipc_rcv (net/tipc/node.c:2189)
>   tipc_l2_rcv_msg (net/tipc/bearer.c:670)
>
>Return early from tipc_node_xmit() when the list is empty.
>
>Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
>Reported-by: Xiang Mei <xmei5@asu.edu>
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>---
> net/tipc/node.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/net/tipc/node.c b/net/tipc/node.c index
>8e4ef2630ae4..cd05269e5335 100644
>--- a/net/tipc/node.c
>+++ b/net/tipc/node.c
>@@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct
>sk_buff_head *list,
> 	int bearer_id;
> 	int rc;
>
>+	if (skb_queue_empty(list))
>+		return 0;
>+

Most callers of tipc_node_xmit() prepares a non-empty list before calling except tipc_named_node_up().
So, it is not optimal to add this check in tipc_node_xmit().
I can see this issue needs to be addressed as part of your existing commit:
https://patchwork.kernel.org/project/netdevbpf/patch/20260706163024.1205930-2-bestswngs@gmail.com/

Please update above patch.

> 	if (in_own_node(net, dnode)) {
> 		tipc_loopback_trace(net, list);
> 		spin_lock_init(&list->lock);
>--
>2.43.0
>

Re: [PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()

[Weiming Shi]

Tung Quang Nguyen <tung.quang.nguyen@est.tech> 于2026年7月9日周四 14:33写道：
>
> >Subject: [PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()
> >
> >tipc_node_xmit() dispatches a buffer list either to the bearer path via
> >tipc_link_xmit() or, when the destination node lives in a sibling network
> >namespace on the same host (n->peer_net set), to tipc_lxc_xmit(). The bearer
> >path returns early on an empty list, but tipc_node_xmit() does not, and
> >tipc_lxc_xmit() dereferences the first buffer without checking:
> >
> >       struct tipc_msg *hdr = buf_msg(skb_peek(list));
> >
> >named_distribute() can hand tipc_node_xmit() an empty list. It bails out early
> >when named_prepare_buf() fails its GFP_ATOMIC allocation, leaving the queue
> >empty, and tipc_named_node_up() then calls tipc_node_xmit() on it
> >unconditionally. On the intra-host container path skb_peek() returns NULL and
> >msg_user() reads through it.
> >
> >The TIPC configuration ops are flagged GENL_UNS_ADMIN_PERM, so an
> >unprivileged user can reach this via
> >unshare(CLONE_NEWUSER|CLONE_NEWNET).
> >
> >  Oops: general protection fault, probably for non-canonical address
> >0xdffffc000000001b
> >  KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
> >  CPU: 0 Comm: ksoftirqd/0
> >  RIP: 0010:tipc_lxc_xmit (net/tipc/msg.h:202 net/tipc/node.c:1629)
> >  Call Trace:
> >   tipc_node_xmit (net/tipc/node.c:1721)
> >   tipc_named_node_up (net/tipc/name_distr.c:223)
> >   tipc_node_write_unlock (net/tipc/node.c:428)
> >   tipc_rcv (net/tipc/node.c:2189)
> >   tipc_l2_rcv_msg (net/tipc/bearer.c:670)
> >
> >Return early from tipc_node_xmit() when the list is empty.
> >
> >Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
> >Reported-by: Xiang Mei <xmei5@asu.edu>
> >Assisted-by: Claude:claude-opus-4-8
> >Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> >---
> > net/tipc/node.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> >diff --git a/net/tipc/node.c b/net/tipc/node.c index
> >8e4ef2630ae4..cd05269e5335 100644
> >--- a/net/tipc/node.c
> >+++ b/net/tipc/node.c
> >@@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct
> >sk_buff_head *list,
> >       int bearer_id;
> >       int rc;
> >
> >+      if (skb_queue_empty(list))
> >+              return 0;
> >+
>
> Most callers of tipc_node_xmit() prepares准备 a non-empty list before calling except tipc_named_node_up().
> So, it is not optimal to add this check in tipc_node_xmit().
> I can see this issue needs to be addressed as part of your existing commit:
> https://patchwork.kernel.org/project/netdevbpf/patch/20260706163024.1205930-2-bestswngs@gmail.com/
>
> Please update above patch.
>
> >       if (in_own_node(net, dnode)) {
> >               tipc_loopback_trace(net, list);
> >               spin_lock_init(&list->lock);
> >--
> >2.43.0
> >
>

Thanks for the review. I've updated the patches accordingly. I
accidentally changed the subject line in v3. It should have stayed the
same as v2:

v3: https://lore.kernel.org/all/20260709144718.64535-2-bestswngs@gmail.com/