Re: [PATCH net] tipc: protect received keys from concurrent flush

[Jérémy Jean]

On 2026-10-02 14:09, Tung Quang Nguyen wrote:
> > Subject: [PATCH net] tipc: protect received keys from concurrent flush
> >
> > tipc_crypto_key_synch() can queue the RX worker again while it is 
> > still using rx-
> > > skey. If tipc_crypto_key_flush() cancels that queued work, it frees 
> > > the key
> > without waiting for the running worker. The worker can then read freed
> > memory or free the key a second time. Racing key exchange with key 
> > flush
> > triggers KASAN:
> >
> >  [   12.986077] BUG: KASAN: double-free in
> > tipc_crypto_key_flush+0x401/0x530
> >  [   12.987937] Free of addr ff11000002268080 by task peer/112
> >  ...
> >  [   12.991938]  kfree+0x163/0x430
> >  ...
> >  [   12.991983]  tipc_crypto_key_flush+0x401/0x530
> >  ...
> >  [   12.992152]  tipc_nl_node_flush_key+0x174/0x210
> Please update your changelog with decoded stack trace.

You mean the full trace including the parts I snipped?

> Do you have a reproducer ?

Yes, I have.

Jérémy