[PATCH net] tipc: fix NULL deref in tipc_lxc_xmit() on node up

[PATCH net] tipc: fix NULL deref in tipc_lxc_xmit() on node up

[Weiming Shi]

tipc_named_node_up() builds a bulk of this node's cluster-scope service
bindings for a peer that just came up and sends it with tipc_node_xmit().
When cluster_scope is empty the bulk is an empty skb chain, and both
consumers dereference the head unconditionally: named_distribute() reads
buf_msg(skb_peek_tail(list)) to tag the last message, and for a same-host
peer tipc_node_xmit() routes into tipc_lxc_xmit(), which reads
buf_msg(skb_peek(list)). skb_peek*() returns NULL on an empty chain, so
buf_msg(NULL) faults.

cluster_scope is legitimately empty during the window in
tipc_net_finalize() between setting the node address, after which peers
can link up and trigger tipc_named_node_up(), and tipc_nametbl_publish()
inserting the first self-binding. A peer linking in that window crashes
the node. It is reachable by an unprivileged user, who can gain
CAP_NET_ADMIN in a private net namespace and drive TIPC there.

 Oops: general protection fault, probably for non-canonical address
 KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
 RIP: 0010:tipc_lxc_xmit (net/tipc/node.c:1629 net/tipc/msg.h:202)
  tipc_node_xmit (net/tipc/node.c:1718)
  tipc_named_node_up (net/tipc/name_distr.c:222)
  tipc_node_write_unlock (net/tipc/node.c:428)
  tipc_rcv (net/tipc/node.c:2185)
  tipc_l2_rcv_msg (net/tipc/bearer.c:669)

Skip the distribution when cluster_scope is empty; an empty bulk carries
no bindings, so not sending it changes nothing.

Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/tipc/name_distr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index ba4f4906e13b..495e46defddb 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -218,8 +218,10 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
 	spin_unlock_bh(&tn->nametbl_lock);
 
 	read_lock_bh(&nt->cluster_scope_lock);
-	named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
-	tipc_node_xmit(net, &head, dnode, 0);
+	if (!list_empty(&nt->cluster_scope)) {
+		named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
+		tipc_node_xmit(net, &head, dnode, 0);
+	}
 	read_unlock_bh(&nt->cluster_scope_lock);
 }
 
-- 
2.43.0

RE: [PATCH net] tipc: fix NULL deref in tipc_lxc_xmit() on node up

[Tung Quang Nguyen]

>Subject: [PATCH net] tipc: fix NULL deref in tipc_lxc_xmit() on node up
>
>tipc_named_node_up() builds a bulk of this node's cluster-scope service
>bindings for a peer that just came up and sends it with tipc_node_xmit().
>When cluster_scope is empty the bulk is an empty skb chain, and both
>consumers dereference the head unconditionally: named_distribute() reads
>buf_msg(skb_peek_tail(list)) to tag the last message, and for a same-host peer
>tipc_node_xmit() routes into tipc_lxc_xmit(), which reads
>buf_msg(skb_peek(list)). skb_peek*() returns NULL on an empty chain, so
>buf_msg(NULL) faults.
>
>cluster_scope is legitimately empty during the window in
>tipc_net_finalize() between setting the node address, after which peers can
>link up and trigger tipc_named_node_up(), and tipc_nametbl_publish()
>inserting the first self-binding. A peer linking in that window crashes the node.
>It is reachable by an unprivileged user, who can gain CAP_NET_ADMIN in a
>private net namespace and drive TIPC there.
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
> RIP: 0010:tipc_lxc_xmit (net/tipc/node.c:1629 net/tipc/msg.h:202)
>  tipc_node_xmit (net/tipc/node.c:1718)
>  tipc_named_node_up (net/tipc/name_distr.c:222)
>  tipc_node_write_unlock (net/tipc/node.c:428)
>  tipc_rcv (net/tipc/node.c:2185)
>  tipc_l2_rcv_msg (net/tipc/bearer.c:669)
>
>Skip the distribution when cluster_scope is empty; an empty bulk carries no
>bindings, so not sending it changes nothing.
>
>Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
>Reported-by: Xiang Mei <xmei5@asu.edu>
>Assisted-by: Claude:claude-opus-4-8
>Cc: stable@vger.kernel.org
>Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>---
> net/tipc/name_distr.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index
>ba4f4906e13b..495e46defddb 100644
>--- a/net/tipc/name_distr.c
>+++ b/net/tipc/name_distr.c
>@@ -218,8 +218,10 @@ void tipc_named_node_up(struct net *net, u32
>dnode, u16 capabilities)
> 	spin_unlock_bh(&tn->nametbl_lock);
>
> 	read_lock_bh(&nt->cluster_scope_lock);
>-	named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
>-	tipc_node_xmit(net, &head, dnode, 0);
>+	if (!list_empty(&nt->cluster_scope)) {
>+		named_distribute(net, &head, dnode, &nt->cluster_scope,
>seqno);
>+		tipc_node_xmit(net, &head, dnode, 0);
>+	}

Your existing patch already has this check, so please use it plus checking non-empty 'head' before calling tipc_node_xmit():
https://patchwork.kernel.org/project/netdevbpf/patch/20260706163024.1205930-2-bestswngs@gmail.com/


> 	read_unlock_bh(&nt->cluster_scope_lock);
> }
>
>--
>2.43.0
>