Re: [PATCH net 2/2] tipc: fix NULL pointer dereference in named_distribute()

[Paolo Abeni <pabeni@redhat.com>]

On 10/28/26 04:36, Tung Nguyen wrote:
> +/**
> + * tipc_nametb_insert_self_node_pub - insert publication of node's self address
> + * @net: network namespace
> + *
> + * Return:
> + * * 0          - Success
> + * * -ENOBUFS   - No buffer space is available
> + *
> + */
> +int tipc_nametb_insert_self_node_pub(struct net *net)
> +{
> +	struct name_table *nt = tipc_name_table(net);
> +	struct tipc_net *tn = tipc_net(net);
> +	struct tipc_socket_addr sk;
> +	struct service_range *sr;
> +	struct tipc_service *sc;
> +	bool sc_created = false;
> +	struct publication *p;
> +	struct tipc_uaddr ua;
> +	int err = 0;
> +
> +	sk.ref = 0;
> +	sk.node = tn->node_addr;
> +	tipc_uaddr(&ua, TIPC_SERVICE_RANGE, TIPC_CLUSTER_SCOPE,
> +		   TIPC_NODE_STATE, tn->node_addr, tn->node_addr);
> +	sc = tipc_service_find(net, &ua);
> +	if (!sc) {
> +		sc = tipc_service_create(net, &ua);
> +		if (!sc)
> +			return -ENOBUFS;
> +		sc_created = true;
> +	}
> +
> +	spin_lock_bh(&sc->lock);
> +	sr = tipc_service_find_range(sc, &ua);
> +	/* 1. tipc_net_finalize_work() is not scheduled because of namespace
> +	 *    teardown.
> +	 * 2. Or tipc_net_finalize() ---> tipc_nametbl_publish() has failed
> +	 *    to insert node self address publication into nt->cluster_scope
> +	 *    due to memory allocation failure.
> +	 * 3. Or tipc_net_finalize() ---> tipc_nametbl_publish() has not
> +	 *    executed yet.
> +	 */
> +	if (!sr) {
> +		p = tipc_publ_create(&ua, &sk, tn->node_addr);
> +		if (!p)
> +			goto error;
> +
> +		if (!tipc_service_insert_publ(net, sc, p, &err)) {
> +			kfree(p);
> +			goto error;
> +		}
> +
> +		list_add_tail(&p->binding_node, &nt->cluster_scope);
> +		goto exit;
> +error:
> +		if (sc_created) {

The above is a bit ugly. AFAICS you avoid the unneeded label `exit`
moving this error path, label included, after the `return 0;` statement.

Also sashiko complains look legit.

/P