[PATCH net v5 0/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list

[Weiming Shi <bestswngs@gmail.com>]

This series continues the fix for the NULL dereference in
tipc_named_node_up() on an empty publication list, on top of Tung
Nguyen's RFC that defers bulk distribution to a workqueue. Jon asked
us to test that approach. It fixes the reported bug in our two-node
QEMU setup (veth pair, UDP bearers, node-id addressing), both with an
unprivileged user namespace and as root.

These two patches fix two issues found during that testing.

Patch 1/2: tipc_net_finalize() does not check the return value of
tipc_nametbl_publish(). If the publish fails, for example on a
GFP_ATOMIC allocation failure, the node is finalized but cluster_scope
stays empty. The deferred worker then calls named_distribute() with an
empty list and hits the same NULL dereference, this time on the
workqueue. With this patch the worker re-checks the list and skips
cleanly, no crash and no link flap. The tail stamp in
named_distribute() also gets an empty-queue guard.

Patch 2/2: a repeated NODE_UP while the bulk work is pending takes a
node reference that is never dropped, because schedule_work() returns
false when the work is already queued. Found by flapping the bearer
during the defer window. One reference is leaked per repeated
NODE_UP.

Changes in v5:
 - Replace the item-less bulk approach with Tung's defer-to-workqueue
   approach, which Jon asked us to test and which fixes the reported
   bug in our testing.
 - Patch 1/2: handle tipc_nametbl_publish() failure in finalize, and
   guard the tail stamp in named_distribute() against an empty list.
 - Patch 2/2: fix the node reference leak when the defer work is
   already pending.

Note: this series applies on top of Tung Nguyen's RFC "tipc: fix
NULL deref in tipc_named_node_up() on empty publication list".
Tested against eb3f4b7426cf plus the RFC.

Weiming Shi (2):
  tipc: fix NULL deref in tipc_named_node_up() on empty publication list
  tipc: fix node reference leak when defer work is already pending

 net/tipc/name_distr.c | 11 +++++++++++
 net/tipc/net.c        |  3 ++-
 net/tipc/node.c       |  3 ++-
 3 files changed, 15 insertions(+), 2 deletions(-)

-- 
2.43.0