kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/tipc
History
Charalampos Mitrodimas c762fc79d7 net: tipc: fix refcount warning in tipc_aead_encrypt 
[ Upstream commit f29ccaa07c ]

syzbot reported a refcount warning [1] caused by calling get_net() on
a network namespace that is being destroyed (refcount=0). This happens
when a TIPC discovery timer fires during network namespace cleanup.

The recently added get_net() call in commit e279024617 ("net/tipc:
fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to
hold a reference to the network namespace. However, if the namespace
is already being destroyed, its refcount might be zero, leading to the
use-after-free warning.

Replace get_net() with maybe_get_net(), which safely checks if the
refcount is non-zero before incrementing it. If the namespace is being
destroyed, return -ENODEV early, after releasing the bearer reference.

[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2

Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
Fixes: e279024617 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done")
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-19 15:32:15 +02:00
..
addr.c tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
addr.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
bcast.c net: tipc: avoid possible garbage value 2024-09-13 20:03:43 -07:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c net/tipc: replace deprecated strcpy with strscpy 2024-08-29 12:33:14 -07:00
bearer.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-17 11:39:10 +01:00
core.h tipc: Remove unused struct declaration 2024-07-12 03:41:32 +01:00
crypto.c net: tipc: fix refcount warning in tipc_aead_encrypt 2025-06-19 15:32:15 +02:00
crypto.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
diag.c sock_diag: add module pointer to "struct sock_diag_handler" 2024-01-23 15:13:54 +01:00
discover.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
discover.h tipc: some cleanups in the file discover.c 2018-03-23 13:12:17 -04:00
eth_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
group.c tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
group.h tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
ib_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
Kconfig net: tipc: remove redundant 'bool' from CONFIG_TIPC_{MEDIA_UDP,CRYPTO} 2024-02-07 13:18:43 +00:00
link.c tipc: fix memory leak in tipc_link_xmit 2025-04-20 10:15:06 +02:00
link.h tipc: Remove unused declaration tipc_link_build_bc_sync_msg() 2023-08-09 13:03:14 -07:00
Makefile tipc: rename the module name diag to tipc_diag 2024-02-06 13:47:36 +01:00
monitor.c tipc: fix NULL pointer dereference in tipc_mon_reinit_self() 2025-05-02 07:59:02 +02:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c tipc: fix a possible memleak in tipc_buf_append 2024-05-01 18:39:44 -07:00
msg.h net: tipc: remove unused static inlines 2022-01-27 13:53:27 +00:00
name_distr.c net/tipc: Remove unused struct distr_queue_item 2022-09-29 18:48:32 -07:00
name_distr.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
name_table.c tipc: cleanup unused function 2022-06-17 11:43:57 +01:00
name_table.h tipc: cleanup unused function 2022-06-17 11:43:57 +01:00
net.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
net.h tipc: Remove unused function declarations 2023-08-03 12:51:45 +02:00
netlink.c tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING 2023-11-01 22:26:37 -07:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
netlink_compat.c tipc: Remove redundant call to TLV_SPACE() 2023-11-17 02:27:27 +00:00
node.c tipc: force a dst refcount before doing decryption 2024-06-18 15:08:57 +02:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c net/tipc: make use of the helper macro LIST_HEAD() 2024-09-06 18:10:21 -07:00
socket.h tipc: add stricter control of reserved service types 2020-10-30 08:19:18 -07:00
subscr.c tipc:subscr.c: fix a spelling mistake 2021-06-10 13:48:43 -07:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
topsrv.c net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
trace.c net/tipc: fix various kernel-doc warnings 2020-12-01 15:37:46 -08:00
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
udp_media.c tipc: fix NULL deref in cleanup_bearer() 2024-12-19 18:13:12 +01:00
udp_media.h tipc: implement configuration of UDP media MTU 2018-04-20 11:04:05 -04:00