RE: [PATCH net v8 2/3] tipc: fix NULL deref in deferred bulk distribution on publish failure

[Tung Quang Nguyen]

>Subject: [PATCH net v8 2/3] tipc: fix NULL deref in deferred bulk distribution on
>publish failure
>
>tipc_net_finalize() does not check the return value of tipc_nametbl_publish().
>If the publish fails, for example on a GFP_ATOMIC allocation failure, the node
>state name never lands in cluster_scope, but tn->finalized is still set. A worker
>deferred by
>tipc_named_node_up() then wakes and calls named_distribute() with an
>empty list. That replays the same unguarded buf_msg(skb_peek_tail(list)) tail
>stamp, this time on the tipc_node_dist_bulk workqueue:
>
> KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
> RIP: 0010:named_distribute (net/tipc/name_distr.c:200)
> Workqueue: events tipc_node_dist_bulk
> Call Trace:
>  tipc_named_dist_cluster_scope (net/tipc/name_distr.c:267)
>  tipc_node_dist_bulk (net/tipc/node.c:403)
>  process_one_work
>  worker_thread
> Kernel panic - not syncing: Fatal exception in interrupt
>
>Check the publish result and warn on failure, but still set finalized, otherwise
>deferred workers would sleep forever. In
>tipc_named_dist_cluster_scope() re-check cluster_scope after the wait and
>skip the distribution when it is empty. This is a permanent condition, so return
>0 instead of an error, otherwise the link would be bounced forever. Also guard
>the tail stamp in named_distribute() itself, so a caller that misses the
>precondition gets a warning and a link reset through the existing -ENOBUFS
>path instead of a crash.
>
>Reproducing this needs an allocation failure during finalize, so I verified it by
>stubbing out the publish call: both nodes log the failure, the workers skip the
>distribution, no crash, no link flap.
>The normal path is unchanged with the same two-node test.
>
>Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
>Reported-by: Xiang Mei <xmei5@xxxxxxx>
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
Please drop this patch because sashiko reports the same issue for patch 1/3: https://sashiko.dev/#/patchset/20260718092544.785289-1-bestswngs%40gmail.com