Charalampos Mitrodimas f29ccaa07c net: tipc: fix refcount warning in tipc_aead_encrypt ... syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Fixes: e279024617 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net> Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech> Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2025-05-29 12:07:26 +02:00
..
addr.c
addr.h
bcast.c	net: tipc: avoid possible garbage value	2024-09-13 20:03:43 -07:00
bcast.h
bearer.c	net/tipc: replace deprecated strcpy with strscpy	2024-08-29 12:33:14 -07:00
bearer.h
core.c
core.h	tipc: Remove unused struct declaration	2024-07-12 03:41:32 +01:00
crypto.c	net: tipc: fix refcount warning in tipc_aead_encrypt	2025-05-29 12:07:26 +02:00
crypto.h
diag.c	sock_diag: add module pointer to "struct sock_diag_handler"	2024-01-23 15:13:54 +01:00
discover.c
discover.h
eth_media.c
group.c
group.h
ib_media.c
Kconfig	net: tipc: remove redundant 'bool' from CONFIG_TIPC_{MEDIA_UDP,CRYPTO}	2024-02-07 13:18:43 +00:00
link.c	tipc: Removing deprecated strncpy()	2025-04-15 13:37:14 +02:00
link.h
Makefile	tipc: rename the module name diag to tipc_diag	2024-02-06 13:47:36 +01:00
monitor.c	tipc: fix NULL pointer dereference in tipc_mon_reinit_self()	2025-04-22 18:43:57 -07:00
monitor.h
msg.c	tipc: fix a possible memleak in tipc_buf_append	2024-05-01 18:39:44 -07:00
msg.h
name_distr.c
name_distr.h
name_table.c	net: tipc: remove one synchronize_net() from tipc_nametbl_stop()	2024-12-06 17:41:28 -08:00
name_table.h	net: tipc: remove one synchronize_net() from tipc_nametbl_stop()	2024-12-06 17:41:28 -08:00
net.c
net.h
netlink.c	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING	2023-11-01 22:26:37 -07:00
netlink.h
netlink_compat.c	tipc: Remove redundant call to TLV_SPACE()	2023-11-17 02:27:27 +00:00
node.c	tipc: Removing deprecated strncpy()	2025-04-15 13:37:14 +02:00
node.h
socket.c	net/tipc: make use of the helper macro LIST_HEAD()	2024-09-06 18:10:21 -07:00
socket.h
subscr.c	treewide: Switch/rename to timer_delete[_sync]()	2025-04-05 10:30:12 +02:00
subscr.h
sysctl.c	net: Remove ctl_table sentinel elements from several networking subsystems	2024-05-03 13:29:42 +01:00
topsrv.c
topsrv.h
trace.c
trace.h	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
udp_media.c	tipc: fix NULL deref in cleanup_bearer()	2024-12-05 17:36:22 -08:00
udp_media.h