From nobody Sat Feb 7 22:54:54 2026 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E23ED2AD00 for ; Sun, 1 Feb 2026 02:31:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769913111; cv=none; b=ASpAiB164k+eJXzvB+TondK2tWN6lKHLzBscbYKYl5Ms3rrCLEeAl3RYRA2BGo9IXXQ+3ZIirPWJoqyVIClIhWmlYRzOM8P1DXYcP8/UJM2sbZsBakkCHiTXN6iGxTqlDtkF6QWHg0wUKUuXLSX8WGnT/PcixRo4gTnY8psXn30= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769913111; c=relaxed/simple; bh=P04Udl47SmPZXoATQ1Lie2U25c245r4i0LY7PHDWLd8=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=nytaU0rlFg3SLugJMJqHUvqfNn6TZGMhk3pBMU8m/W57bqGAa9yFp7ZP+7Mm/A1JNg5DjkKkh6fONnbbWZkrxwxRp1ImFYib4xIV/rtbAQMnNvO08GlGOGu47pZyMsV4PUK+7HDMV+9cuCG9rvEtoZPZtn6ce7iUKTANSrHro4k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=TT1L4xzC; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="TT1L4xzC" Received: from pps.filterd (m0109334.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6110XY5h2519036 for ; Sat, 31 Jan 2026 18:31:49 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=s2048-2025-q2; bh=OAC/V1F2BIgxmBCsY8 UC/ej6Q3r57b1MljZREsGPMcc=; b=TT1L4xzCAMkTt87PswBSNtX4XrZOfknLmS 0EJJVUp7o85ZU6w3V2Up8jQsORQ43AZn5esNdblxw8TkajcfgG9GV2lnL0WcD9Z8 NjzxJNfXA98QQPbaP1zKjyYocBl5XADHszLbcvjoT0l1oTXL2HZz6IXc7OOsb5c2 1aphJkklxjgXW60ki7tJzz2jzkWBKrPHqJe8bnfXqfz68xvRjdT5AqwWV4exXSTb SkuXEKK+FmMr4hNihB+1hQgiNMWMutwQ6ddYft6ZLeRHV9DBOlKaSU59lVMKunti dgdoGdKMsz9Meixgl+NJDRjw1PkhQxzerRidby421f6QN4AFQM6w== Received: from mail.thefacebook.com ([163.114.134.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4c1hwjvuef-7 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Sat, 31 Jan 2026 18:31:49 -0800 (PST) Received: from twshared18017.01.snb2.facebook.com (2620:10d:c085:208::7cb7) by mail.thefacebook.com (2620:10d:c08b:78::2ac9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.35; Sun, 1 Feb 2026 02:31:46 +0000 Received: by devbig010.atn3.facebook.com (Postfix, from userid 224791) id 3D14C776A37; Sat, 31 Jan 2026 18:21:28 -0800 (PST) From: Daniel Hodges To: Jon Maloy , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni CC: Simon Horman , Ying Xue , Tuong Lien , , , , Daniel Hodges , Subject: [PATCH] tipc: fix RCU dereference race in tipc_aead_users_dec() Date: Sat, 31 Jan 2026 18:21:28 -0800 Message-ID: <20260201022128.2658251-1-hodgesd@meta.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FB-Internal: Safe X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjAxMDAxOCBTYWx0ZWRfX6WB58YDexPcN rVZWGBrfEYjmvo27JwISAoCtPLBWvGBw2/YEYlBVEVzOertypwA2acZ2yWmtjc2nqhQHPBPwJYB rzrceJqsEWqFdUdZE6FYny3ltzK+6S7VewuLmIRoVbjIyveKBCgGZEifGDz+zklaeX73uVlVp8o 39SnkuXPMt+1DdzH2y4S+dpI/k0KTc8yWVmIiunqJyRx4YXN8IY3l2lIG7kieKghVm5NhzmSByB tQfcPZjlDlHTK4i2ge2fVIDWq4ZH1Q2naLC+S6Sg+Z1Wl7nZU6xmokYEjCFEDphfZs2e6qEVUef BFhta6AG3UXjA1y08kg2UXa0mIOdl+GT6NipcSBK1a/4+TjyiLHghKmmGxhO3Gi2IpYjzBHLdV8 3FaCy4tvIT3TfQUqUuelol/KHFH5/lR15+uCECwAuQs/JdjoLKXDsbKXSZXodGTMUvhVz1F84k3 ImJUUPlSHnGJO7Z6AvA== X-Proofpoint-ORIG-GUID: SVatrmATuMTGjBAXt_M0eQEylgv7kV3E X-Authority-Analysis: v=2.4 cv=BLu+bVQG c=1 sm=1 tr=0 ts=697ebb15 cx=c_pps a=CB4LiSf2rd0gKozIdrpkBw==:117 a=CB4LiSf2rd0gKozIdrpkBw==:17 a=vUbySO9Y5rIA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VwQbUJbxAAAA:8 a=VabnemYjAAAA:8 a=IXhiNiqVbw2M4zCeobAA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-GUID: SVatrmATuMTGjBAXt_M0eQEylgv7kV3E X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-01_01,2026-01-30_04,2025-10-01_01 Content-Type: text/plain; charset="utf-8" tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store in 'tmp' for the NULL check, and again inside the atomic_add_unless() call. Use the already-dereferenced 'tmp' pointer consistently, matching the correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set(). Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Cc: stable@vger.kernel.org Signed-off-by: Daniel Hodges Reviewed-by: Eric Dumazet --- net/tipc/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index 970db62bd029..a3f9ca28c3d5 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -453,21 +453,21 @@ static void tipc_aead_users_inc(struct tipc_aead __rc= u *aead, int lim) rcu_read_unlock(); } =20 static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim) { struct tipc_aead *tmp; =20 rcu_read_lock(); tmp =3D rcu_dereference(aead); if (tmp) - atomic_add_unless(&rcu_dereference(aead)->users, -1, lim); + atomic_add_unless(&tmp->users, -1, lim); rcu_read_unlock(); } =20 static void tipc_aead_users_set(struct tipc_aead __rcu *aead, int val) { struct tipc_aead *tmp; int cur; =20 rcu_read_lock(); tmp =3D rcu_dereference(aead); --=20 2.47.3