diff mbox series

[Openvpn-devel,net,v5,3/6] ovpn: initialize TCP state before registering UAPI

Message ID 8f7261c5719fd67b8f0da4d0e89f2c4517fa8168.1783336121.git.ralf@mandelbit.com
State New
Headers
Series ovpn: fix key and workqueue lifetime issues |

Commit Message

Ralf Lici July 6, 2026, 11:34 a.m. UTC 
  ovpn_tcp_init initializes the TCP proto and proto_ops templates used
when a TCP socket is attached to an ovpn peer but ovpn_init registers
the rtnl link ops and generic netlink family before initializing those
templates. Once either interface is visible, userspace can create an
ovpn device and configure a TCP socket while the TCP templates are still
zero-initialized.

Initialize the TCP templates before publishing the rtnl and netlink
interfaces, so externally reachable setup paths can only observe
initialized TCP state.

Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
New patch added in v5.

 drivers/net/ovpn/main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Comments

Sabrina Dubroca July 7, 2026, 11:04 a.m. UTC | #1 
This fix looks good, just a few small comments:

2026-07-06, 13:34:01 +0200, Ralf Lici wrote:
> ovpn_tcp_init initializes the TCP proto and proto_ops templates used
> when a TCP socket is attached to an ovpn peer but ovpn_init registers
> the rtnl link ops and generic netlink family before initializing those
> templates. Once either interface is visible, userspace can create an

If only the rtnl part is registered, we can create a netdevice but not
attach a socket to it, so the ovpn_tcp_* ops should not be reachable.

> ovpn device and configure a TCP socket while the TCP templates are still
> zero-initialized.
> 
> Initialize the TCP templates before publishing the rtnl and netlink
> interfaces, so externally reachable setup paths can only observe
> initialized TCP state.
> 
> Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
> Signed-off-by: Ralf Lici <ralf@mandelbit.com>
> ---
> New patch added in v5.
> 
>  drivers/net/ovpn/main.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c
> index 9993c1dfe471..c2c3af0c3c55 100644
> --- a/drivers/net/ovpn/main.c
> +++ b/drivers/net/ovpn/main.c
> @@ -233,8 +233,14 @@ static struct rtnl_link_ops ovpn_link_ops = {
>  
>  static int __init ovpn_init(void)
>  {
> -	int err = rtnl_link_register(&ovpn_link_ops);
> +	int err;
>  
> +	/* initialize the TCP protos before the module is exposed through rtnl
> +	 * or netlink
> +	 */

I don't think that comment adds much. The commit message explains why
this needs to be moved (and why this had to be moved, if someone
touches this later)

> +	ovpn_tcp_init();
> +
> +	err = rtnl_link_register(&ovpn_link_ops);
diff mbox series

Patch

diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c
index 9993c1dfe471..c2c3af0c3c55 100644
--- a/drivers/net/ovpn/main.c
+++ b/drivers/net/ovpn/main.c
@@ -233,8 +233,14 @@  static struct rtnl_link_ops ovpn_link_ops = {
 
 static int __init ovpn_init(void)
 {
-	int err = rtnl_link_register(&ovpn_link_ops);
+	int err;
 
+	/* initialize the TCP protos before the module is exposed through rtnl
+	 * or netlink
+	 */
+	ovpn_tcp_init();
+
+	err = rtnl_link_register(&ovpn_link_ops);
 	if (err) {
 		pr_err("ovpn: can't register rtnl link ops: %d\n", err);
 		return err;
@@ -246,8 +252,6 @@  static int __init ovpn_init(void)
 		goto unreg_rtnl;
 	}
 
-	ovpn_tcp_init();
-
 	return 0;
 
 unreg_rtnl: