Daniel Hodges 43bc12f6d6 tipc: fix RCU dereference race in tipc_aead_users_dec() ...

[ Upstream commit 6a65c0cb0f ]

tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store
in 'tmp' for the NULL check, and again inside the atomic_add_unless()
call.

Use the already-dereferenced 'tmp' pointer consistently, matching the
correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set().

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Link: https://patch.msgid.link/20260203145621.17399-1-git@danielhodges.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-04 07:21:53 -05:00

..

addr.c

…

addr.h

…

bcast.c

…

bcast.h

…

bearer.c

…

bearer.h

…

core.c

…

core.h

…

crypto.c

tipc: fix RCU dereference race in tipc_aead_users_dec()

2026-03-04 07:21:53 -05:00

crypto.h

…

diag.c

…

discover.c

…

discover.h

…

eth_media.c

…

group.c

…

group.h

…

ib_media.c

…

Kconfig

…

link.c

…

link.h

…

Makefile

…

monitor.c

…

monitor.h

…

msg.c

…

msg.h

…

name_distr.c

…

name_distr.h

…

name_table.c

tipc: fix duplicate publication key in tipc_service_insert_publ()

2026-03-04 07:21:33 -05:00

name_table.h

…

net.c

…

net.h

…

netlink_compat.c

…

netlink.c

…

netlink.h

…

node.c

…

node.h

…

socket.c

…

socket.h

…

subscr.c

…

subscr.h

…

sysctl.c

…

topsrv.c

…

topsrv.h

…

trace.c

…

trace.h

…

udp_media.c

…

udp_media.h

…