Re: [PATCH net v2] tipc: fix use-after-free of broadcast reception link at node release

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Mon, 19 Oct 2026 18:43:52 +0800 you wrote:
> When the last reference to a tipc_node is dropped, the node itself is
> deferred to the RCU callback tipc_node_free(), but the nested broadcast
> reception link, n->bc_entry.link, is kfree()d synchronously in
> tipc_node_kref_release(), before call_rcu(), and the pointer is never
> cleared.  Readers that obtained the node from node_list and then
> dereference bc_entry.link deep into the link (tipc_link_name() in
> tipc_nl_node_reset_link_stats(), bcl->name/stats in
> tipc_nl_add_bc_link() on the link dump path) therefore touch freed
> memory although the enclosing node stays alive for a full grace period.
> The sibling per-bearer links get "kfree + NULL" under the node write
> lock in tipc_node_clear_links(); the broadcast entry was missed.
> 
> [...]

Here is the summary with links:
  - [net,v2] tipc: fix use-after-free of broadcast reception link at node release
    https://git.kernel.org/netdev/net/c/473167593f42

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html