RE: [PATCH net v2] tipc: read le->link under the node lock in tipc_node_link_down()

[Tung Quang Nguyen]

>A KASAN reproducer for this issue is available if requested.

Yes, please send me the reproducer.
It would be good if I can verify the fix at my side.

>
>v2:
> - Take &n->links[bearer_id] under tipc_node_write_lock() as well.
> - Use tipc_node_write_unlock_fast() on the NULL link path.
> - Decode the KASAN report with scripts/decode_stacktrace.sh, re-taken on
>   7.2.0-rc5-00284-gaf39eb111ce6.
>
>v1: https://lore.kernel.org/netdev/20260731102145.33622-1-
>juny24602@xxxxxxxxx/
>
> net/tipc/node.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
>diff --git a/net/tipc/node.c b/net/tipc/node.c index
>8e4ef2630ae4..683a136e53ef 100644
>--- a/net/tipc/node.c
>+++ b/net/tipc/node.c
>@@ -1061,18 +1061,23 @@ static void __tipc_node_link_down(struct
>tipc_node *n, int *bearer_id,
>
> static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool
>delete)  {
>-	struct tipc_link_entry *le = &n->links[bearer_id];
> 	struct tipc_media_addr *maddr = NULL;
>-	struct tipc_link *l = le->link;
> 	int old_bearer_id = bearer_id;
>+	struct tipc_link_entry *le;
> 	struct sk_buff_head xmitq;
>-
>-	if (!l)
>-		return;
>+	struct tipc_link *l;
>
> 	__skb_queue_head_init(&xmitq);
>
>+	/* Synchronize the link lookup with bearer teardown. */
> 	tipc_node_write_lock(n);
>+	le = &n->links[bearer_id];
>+	l = le->link;
>+	if (!l) {
>+		tipc_node_write_unlock_fast(n);
>+		return;
>+	}
>+
> 	if (!tipc_link_is_establishing(l)) {
> 		__tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
> 	} else {
>--
>2.55.0
>