Charalampos Mitrodimas f29ccaa07c net: tipc: fix refcount warning in tipc_aead_encrypt ... syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Fixes: e279024617 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net> Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech> Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2025-05-29 12:07:26 +02:00
..
addr.c
addr.h
bcast.c	net: tipc: avoid possible garbage value	2024-09-13 20:03:43 -07:00
bcast.h
bearer.c	net/tipc: replace deprecated strcpy with strscpy	2024-08-29 12:33:14 -07:00
bearer.h
core.c
core.h
crypto.c	net: tipc: fix refcount warning in tipc_aead_encrypt	2025-05-29 12:07:26 +02:00
crypto.h
diag.c
discover.c
discover.h
eth_media.c
group.c
group.h
ib_media.c
Kconfig
link.c	tipc: Removing deprecated strncpy()	2025-04-15 13:37:14 +02:00
link.h
Makefile
monitor.c	tipc: fix NULL pointer dereference in tipc_mon_reinit_self()	2025-04-22 18:43:57 -07:00
monitor.h
msg.c
msg.h
name_distr.c
name_distr.h
name_table.c	net: tipc: remove one synchronize_net() from tipc_nametbl_stop()	2024-12-06 17:41:28 -08:00
name_table.h	net: tipc: remove one synchronize_net() from tipc_nametbl_stop()	2024-12-06 17:41:28 -08:00
net.c
net.h
netlink_compat.c
netlink.c
netlink.h
node.c	tipc: Removing deprecated strncpy()	2025-04-15 13:37:14 +02:00
node.h
socket.c	net/tipc: make use of the helper macro LIST_HEAD()	2024-09-06 18:10:21 -07:00
socket.h
subscr.c	treewide: Switch/rename to timer_delete[_sync]()	2025-04-05 10:30:12 +02:00
subscr.h
sysctl.c
topsrv.c
topsrv.h
trace.c
trace.h
udp_media.c	tipc: fix NULL deref in cleanup_bearer()	2024-12-05 17:36:22 -08:00
udp_media.h