Tung Quang Nguyen [off-list ref] 于2026年7月9日周四 14:33写道：

quoted

Subject: [PATCH net] tipc: guard against empty buffer list in tipc_node_xmit()

tipc_node_xmit() dispatches a buffer list either to the bearer path via
tipc_link_xmit() or, when the destination node lives in a sibling network
namespace on the same host (n->peer_net set), to tipc_lxc_xmit(). The bearer
path returns early on an empty list, but tipc_node_xmit() does not, and
tipc_lxc_xmit() dereferences the first buffer without checking:

      struct tipc_msg *hdr = buf_msg(skb_peek(list));

named_distribute() can hand tipc_node_xmit() an empty list. It bails out early
when named_prepare_buf() fails its GFP_ATOMIC allocation, leaving the queue
empty, and tipc_named_node_up() then calls tipc_node_xmit() on it
unconditionally. On the intra-host container path skb_peek() returns NULL and
msg_user() reads through it.

The TIPC configuration ops are flagged GENL_UNS_ADMIN_PERM, so an
unprivileged user can reach this via
unshare(CLONE_NEWUSER|CLONE_NEWNET).

 Oops: general protection fault, probably for non-canonical address
0xdffffc000000001b
 KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
 CPU: 0 Comm: ksoftirqd/0
 RIP: 0010:tipc_lxc_xmit (net/tipc/msg.h:202 net/tipc/node.c:1629)
 Call Trace:
  tipc_node_xmit (net/tipc/node.c:1721)
  tipc_named_node_up (net/tipc/name_distr.c:223)
  tipc_node_write_unlock (net/tipc/node.c:428)
  tipc_rcv (net/tipc/node.c:2189)
  tipc_l2_rcv_msg (net/tipc/bearer.c:670)

Return early from tipc_node_xmit() when the list is empty.

Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
Reported-by: Xiang Mei <redacted>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <redacted>
---
net/tipc/node.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c index

8e4ef2630ae4..cd05269e5335 100644

--- a/net/tipc/node.c
+++ b/net/tipc/node.c

@@ -1695,6 +1695,9 @@ int tipc_node_xmit(struct net *net, struct

sk_buff_head *list,
      int bearer_id;
      int rc;

+      if (skb_queue_empty(list))
+              return 0;
+

Most callers of tipc_node_xmit() prepares准备 a non-empty list before calling except tipc_named_node_up().
So, it is not optimal to add this check in tipc_node_xmit().
I can see this issue needs to be addressed as part of your existing commit:
https://patchwork.kernel.org/project/netdevbpf/patch/20260706163024.1205930-2-bestswngs@gmail.com/

Please update above patch.

quoted

      if (in_own_node(net, dnode)) {
              tipc_loopback_trace(net, list);
              spin_lock_init(&list->lock);
--
2.43.0

Thanks for the review. I've updated the patches accordingly. I
accidentally changed the subject line in v3. It should have stayed the
same as v2:

v3: https://lore.kernel.org/all/20260709144718.64535-2-bestswngs@gmail.com/ (local)