* Re: [PATCH] tipc: fix RCU dereference race in tipc_aead_users_dec()
[not found] <20260201022128.2658251-1-hodgesd@meta.com>
@ 2026-02-01 9:48 ` Eric Dumazet
2026-02-03 1:48 ` Jakub Kicinski
1 sibling, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2026-02-01 9:48 UTC (permalink / raw)
To: Daniel Hodges
Cc: Jon Maloy, David S . Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, Ying Xue, Tuong Lien, netdev, tipc-discussion,
linux-kernel, stable
On Sun, Feb 1, 2026 at 3:31 AM Daniel Hodges <hodgesd@meta.com> wrote:
>
> tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store
> in 'tmp' for the NULL check, and again inside the atomic_add_unless()
> call.
>
> Use the already-dereferenced 'tmp' pointer consistently, matching the
> correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set().
>
> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
> Cc: stable@vger.kernel.org
>
> Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] tipc: fix RCU dereference race in tipc_aead_users_dec()
[not found] <20260201022128.2658251-1-hodgesd@meta.com>
2026-02-01 9:48 ` [PATCH] tipc: fix RCU dereference race in tipc_aead_users_dec() Eric Dumazet
@ 2026-02-03 1:48 ` Jakub Kicinski
1 sibling, 0 replies; 2+ messages in thread
From: Jakub Kicinski @ 2026-02-03 1:48 UTC (permalink / raw)
To: Daniel Hodges
Cc: Jon Maloy, David S . Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Ying Xue, Tuong Lien, netdev, tipc-discussion,
linux-kernel, stable
On Sat, 31 Jan 2026 18:21:28 -0800 Daniel Hodges wrote:
> tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store
> in 'tmp' for the NULL check, and again inside the atomic_add_unless()
> call.
>
> Use the already-dereferenced 'tmp' pointer consistently, matching the
> correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set().
>
> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
> Cc: stable@vger.kernel.org
>
> Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Somehow this didn't reach patchwork, please resend, and while you do
that please remove the empty line between cc stable and you sob.
^ permalink raw reply [flat|nested] 2+ messages in thread