named_distribute() stamps the last_bulk flag on the tail skb of the
publication list. When the list is empty no skb is enqueued and the tail
access dereferences NULL. tipc_named_node_up() hits this on an empty
cluster_scope, which happens with a node-id configuration where
cluster_scope is populated only later by tipc_net_finalize(). It is
reachable by an unprivileged user over a UDP bearer in a user+net
namespace.

Patch 1 guards tipc_node_xmit() against an empty list, so the allocation-
failure path in named_distribute() cannot pass an empty list down to
tipc_lxc_xmit(), which has the same tail-of-empty-list deref.

Patch 2 emits an item-less bulk when the publication list is empty, so the
peer still receives the last_bulk flag and does not stall this node's later
name updates.

Changes in v3:
 - Split into two patches; add patch 1 to guard tipc_node_xmit() against
   the tipc_lxc_xmit() deref reachable via the allocation-failure path.
 - Break out of the build loop on allocation failure instead of returning,
   so the last_bulk flag is still applied to the last queued skb.

Changes in v2:
 - Instead of returning early on an empty cluster_scope (which would stall
   the peer, since it waits for a bulk with the last_bulk flag before
   accepting later name updates), emit an item-less bulk so the peer opens
   normally.

Thanks to Tung Quang Nguyen for the review of v1.

Weiming Shi (2):
  tipc: guard against empty list in tipc_node_xmit()
  tipc: fix NULL deref in tipc_named_node_up() on empty publication list

 net/tipc/name_distr.c | 16 +++++++++++++++-
 net/tipc/node.c       |  3 +++
 2 files changed, 18 insertions(+), 1 deletion(-)


base-commit: 4595d2c77ea4bfe4ae0efa38770a59ee5d2f06d3
-- 
2.43.0