diff mbox series

[Openvpn-devel,net,v6,3/6] ovpn: initialize TCP state before registering UAPI

Message ID e7af10c8c2e2ece17a3861d03959336238205fe4.1785318038.git.ralf@mandelbit.com
State Superseded
Headers
Series [Openvpn-devel,net,v6,1/6] ovpn: fix NULL dereference when killing missing key |

Commit Message

Ralf Lici July 29, 2026, 10:21 a.m. UTC 
  ovpn_tcp_init initializes the TCP proto and proto_ops templates used
when a TCP socket is attached to an ovpn peer, but ovpn_init registers
the generic netlink family before initializing those templates. Once the
family is visible, userspace can create an ovpn device and configure a
TCP socket while the TCP templates are still zero-initialized.

Initialize the TCP templates before publishing the netlink interfaces,
so externally reachable setup paths can only observe initialized TCP
state.

Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
Changes since v5 https://lore.kernel.org/openvpn-devel/8f7261c5719fd67b8f0da4d0e89f2c4517fa8168.1783336121.git.ralf@mandelbit.com/
- Reword the message and drop the extra comment in the code (Sabrina).

New patch added in v5.

 drivers/net/ovpn/main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Antonio Quartulli Aug. 6, 2026, 11:56 p.m. UTC | #1 
Hi,

On 29/07/2026 12:21, Ralf Lici wrote:
> ovpn_tcp_init initializes the TCP proto and proto_ops templates used
> when a TCP socket is attached to an ovpn peer, but ovpn_init registers
> the generic netlink family before initializing those templates. Once the
> family is visible, userspace can create an ovpn device and configure a
> TCP socket while the TCP templates are still zero-initialized.
> 
> Initialize the TCP templates before publishing the netlink interfaces,
> so externally reachable setup paths can only observe initialized TCP
> state.
> 
> Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
> Signed-off-by: Ralf Lici <ralf@mandelbit.com>

This patch was dropped in favour of another patch of mine which was 
basically colliding on the same change.

The mentioned patch has already landed in net.

Regards,
diff mbox series

Patch

diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c
index 9993c1dfe471..5093a3b5aba6 100644
--- a/drivers/net/ovpn/main.c
+++ b/drivers/net/ovpn/main.c
@@ -233,8 +233,11 @@  static struct rtnl_link_ops ovpn_link_ops = {
 
 static int __init ovpn_init(void)
 {
-	int err = rtnl_link_register(&ovpn_link_ops);
+	int err;
 
+	ovpn_tcp_init();
+
+	err = rtnl_link_register(&ovpn_link_ops);
 	if (err) {
 		pr_err("ovpn: can't register rtnl link ops: %d\n", err);
 		return err;
@@ -246,8 +249,6 @@  static int __init ovpn_init(void)
 		goto unreg_rtnl;
 	}
 
-	ovpn_tcp_init();
-
 	return 0;
 
 unreg_rtnl: