From patchwork Fri Jan 30 17:32:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 4747 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:6911:b0:80a:3855:ce6a with SMTP id o17csp349952map; Fri, 30 Jan 2026 09:33:46 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCXGDOKzrqh4d+oeBQWEIPuCB2Z4IRwtsw+u/rjhqsWcABqYEI6njh2h4HsNKvddXHkgae0RlOdbPLE=@openvpn.net X-Received: by 2002:a05:6820:4c0a:b0:659:9a49:8eff with SMTP id 006d021491bc7-6630f01b564mr1567907eaf.16.1769794425851; Fri, 30 Jan 2026 09:33:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1769794425; cv=none; d=google.com; s=arc-20240605; b=Wt3JiXzJUCtCgG84qjyWs7qD29nnvWvCFfo0JNzFcmiK9THwen31FNQuUy+2b2plYd 2QSHqMx68DrxoyoEOsIdOk/egoQ/1ury+/07jO2JWTGamXGdlQZnExf3pSztwLYh7ZwH kAn509NwXCJJu6xxO3pZ0Pe2ED0FiX3xwfjVYhj6t7ZhDaILUFw5T0W+RxcAGoEkG1jk J7n3+rNbnUdC52aTaIhWoGbL6OBctCeL8CzqfFy3d2pYLYBPTlbzSbMl0iX3LZzcEDXi 7V9HSaFRDiIZ6Qz0kJLvycVD+BSb7Q8HDARGSPYzp/px9TEm6LfQ3g+5Kqcp4LpjoTtp TCyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=t42s8t1+M3NlF2eHyUZqGnsn+gC9kfCmVe2QZu2elok=; fh=bDmbXayvKcQuWZaaz4JM7kgnS3MJBk3QUq2ehqNuBVc=; b=Xw+eEx15t2+GeNtvBlZ7nRlFc4aZWI4Wzya76VTZgfWwTiacZ/wwJuPsLmkBNzBd4b 9ifpYb1qr+RUoet2grEEhpfXWaq4iCpnKIUFP/8JSI+iRcHh2c5uK3cXKMiTvy3g4KCr 4Ao4/WfWqtag31N6o2kkhENMCLv+ksZxQNh0LH+t+BnUXZlPO+69itW36QRrVLykVPWn 6TFVfwg2axYurcs5Q0lDdISq/nFBoAbDJ1tOUpreuGBchCwgMMvZQDkek4I7du8qoTMO VaXZB8qet4sDV8B8ezF1QnT01RMrwydaYKwk10jHoKg1vxx+9iNqQGUZo15YQPtGD1Db q14Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=jGlA4d9U; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=guuy031m; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fBmXEWp2; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=google header.b=fWG5X+ST; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dara=neutral header.i=@openvpn.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-662f9a3abcfsi4908215eaf.57.2026.01.30.09.33.45 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Jan 2026 09:33:45 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=jGlA4d9U; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=guuy031m; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fBmXEWp2; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=google header.b=fWG5X+ST; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dara=neutral header.i=@openvpn.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=t42s8t1+M3NlF2eHyUZqGnsn+gC9kfCmVe2QZu2elok=; b=jGlA4d9UZb0v5OdGoNvcuH9RG+ VId/DcrhUwjmcwiCZWjw8GlI6U2jO4FbiVcjElGwgXEL27AcvbmMUa8DIEa2GFyvnRTnkt3HMUed8 000xvAmryX0AQgs7bR8GvjaFXSfYnmTJvvne8U6gjXc5STkun5zKZo0r3vUUGt6j1GB8=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1vlsNK-0007EG-JF; Fri, 30 Jan 2026 17:33:42 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1vlsNJ-0007EA-0O for openvpn-devel@lists.sourceforge.net; Fri, 30 Jan 2026 17:33:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=nFYWSGBGZDppA82BfqGscnheXYcKAxVEt4g4OPuZEDk=; b=guuy031mMsEa47CYZT5JYO0W/z BuI7JMidHIUteYPxNeeDqc4rRUzrEm2x5FfeLYkD+lpAbEjAeYcx1s9mnLDnMoVUN1Al/+kf3e5/c WN4v+vtnLuC9nuqnFUoav3JjPmGkHmIu4WrytalCesfAfpvspEowKLJ/TcqNCPqgJ6FE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=nFYWSGBGZDppA82BfqGscnheXYcKAxVEt4g4OPuZEDk=; b=fBmXEWp2Q/+xG9rstUOulO7Htk 2M5kmKUc3KoiFkSugggtNJtxEp6VCRdW20wvEpsTt5ddypLx0QxqB+K5APKeGsHhHxH2/7g/TZ8rd JtHDh0iCg/TUs/YFeIiImgqS0rY54RUFCn2xHZtekw172UHzppMxpny90xC11+/e9wqA=; Received: from mail-wm1-f45.google.com ([209.85.128.45]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.95) id 1vlsNI-0006Hp-IB for openvpn-devel@lists.sourceforge.net; Fri, 30 Jan 2026 17:33:40 +0000 Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4806dffc64cso18287155e9.1 for ; Fri, 30 Jan 2026 09:33:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=google; t=1769794409; x=1770399209; darn=lists.sourceforge.net; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=nFYWSGBGZDppA82BfqGscnheXYcKAxVEt4g4OPuZEDk=; b=fWG5X+STN/cp7QeT1Klf3ZBDJ9N0OiTym0vixNtFs2NjhcTXPmV3Awosd6q+k/3UFb RtOwXXYFowR7jF0oGFikRqxrN1oapLrjg/SlopTtQrGghyK65MKLfZTwu43ZCN+Y0rMe vzQWVEZ5fqwgB8TW+jxV0ZXDEpcvktrOnwHlrbxc9a2zWqa+63QHU83rNV0Zl4M0Wk+W tdMO11HQIP/xQ/e2Iqw+TnrwKiglEtiNunuBnzIIr9/C7pmNk3B507T6TpPnb/AnSBsm sgkTkkvR959crzr+V8jcICsJWDoxEU3Ue4ouSlYsuKZ1xDB9Q41msDWjCh0dTMOjXP2e XyPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769794409; x=1770399209; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=nFYWSGBGZDppA82BfqGscnheXYcKAxVEt4g4OPuZEDk=; b=dWDFycJM6GaZKV4ZJSiqTK9/a2EJOBzoeURNJYG5qGl7mH5lGv7rdjvDhbNVII3P+o U1w7/D+YanmUQfI9dIHGp/Ym7vAvKx94z352qWwR7j/SrMMpzrVpd/Nz17g9/WJjoFeI xlrsD3MflLMr724Nz1P/a7r28VDKOVQno8lXyCBRcmVIlAIleFHm9MX5tBZskp2VSYjz sbADUt7HacaDP9NYCA65nybSix/8yLDTJev8zhDvEx1p+/0xqFFhicn7/0/0CdZILj81 gxKR+i+dfkd1ASRf2PLr1lhRejZiZ5J/UljsT8ziVGUuzixs0B150nOAghyRPXvkbZNS 0wxQ== X-Gm-Message-State: AOJu0Ywn6XvpwUNZZQyMtjVPhD/8DmUGejmSgulqGGyDHO5MYMR9MupH X2mFYZNK4SJW9V5sudsDp+sScKZ3zeCm1cIZaMvrNbEA5kAErokh8rMphe9ZqwCR2s4bqdEu1Li X+KMl X-Gm-Gg: AZuq6aIauAXZqaWYGy/y0GB9DenbL9bWYLPOFVqpk1c315Fsh4n1gVA6FQAOnnLArKu EW9TcWBVvjYynxjDPI0axI1UWxVCVcfHkmA51VGplnVu3gsWEXsDOr856OpBFxrgplLSHVtsGPZ o90x+hMiS/9hlu/3923UVm8dDTWhFjDt3m0KmIx9koqFUrwI8TAZjH9UbRgWImmcMo0Hth6cYV+ 3Qs8bwvxh9hAywRFzu0UKzluQBJgcQmSiAz7BS9q31Tku8w3aRDhi8BLMUxcM4a7kQigwR0MVFt qSVY/Civwe/q24DbK5wRKywfHgMu2cOAMjma1dod4alSV76Up730SSK2WSPWjKMJvOa3reJsngs DpNISuVVg3+LxSEo8f1ZZXMr7vOQU/ulK9UZ+aXgPRgokQdOLGVaU3cfnEZNxXbGg6CrfUmylZy H0wNUTUQ== X-Received: by 2002:a05:600c:1e89:b0:47e:e72b:1fce with SMTP id 5b1f17b1804b1-482db4b5e04mr40349925e9.37.1769794408688; Fri, 30 Jan 2026 09:33:28 -0800 (PST) Received: from fedora ([2a01:e11:600c:d1a0:3dc8:57d2:efb7:51a8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-482e047d863sm22090605e9.1.2026.01.30.09.33.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Jan 2026 09:33:28 -0800 (PST) From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 30 Jan 2026 18:32:49 +0100 Message-ID: <20260130173250.664943-2-ralf@mandelbit.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260130173250.664943-1-ralf@mandelbit.com> References: <20260130173250.664943-1-ralf@mandelbit.com> MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: mandelbit.com] 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.128.45 listed in wl.mailspike.net] X-Headers-End: 1vlsNI-0006Hp-IB Subject: [Openvpn-devel] [PATCH ovpn net v3 2/3] ovpn: fix possible use-after-free in ovpn_net_xmit X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sabrina Dubroca Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1855763959745775515?= X-GMAIL-MSGID: =?utf-8?q?1855763959745775515?= When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skb_dst_drop (even though all segments produced by skb_gso_segment will have a dst attached), - ovpn_peer_stats_increment_tx. Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca --- Changes since v2: - moved peer selection and skb_dst_drop before skb_gso_segment - added goto to drop the peer reference on error - stopped using 'skb' after building 'skb_list' and switched to skb_list.next for the stats update Changes since v1: - this is a new patch that replaces the previous "ovpn: use sk_buff_head properly in ovpn_net_xmit" drivers/net/ovpn/io.c | 52 ++++++++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 21 deletions(-) diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index 3e9e7f8444b3..f70c58b10599 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -365,7 +365,27 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) /* verify IP header size in network packet */ proto = ovpn_ip_check_protocol(skb); if (unlikely(!proto || skb->protocol != proto)) - goto drop; + goto drop_no_peer; + + /* retrieve peer serving the destination IP of this packet */ + peer = ovpn_peer_get_by_dst(ovpn, skb); + if (unlikely(!peer)) { + switch (skb->protocol) { + case htons(ETH_P_IP): + net_dbg_ratelimited("%s: no peer to send data to dst=%pI4\n", + netdev_name(ovpn->dev), + &ip_hdr(skb)->daddr); + break; + case htons(ETH_P_IPV6): + net_dbg_ratelimited("%s: no peer to send data to dst=%pI6c\n", + netdev_name(ovpn->dev), + &ipv6_hdr(skb)->daddr); + break; + } + goto drop_no_peer; + } + /* dst was needed for peer selection - it can now be dropped */ + skb_dst_drop(skb); if (skb_is_gso(skb)) { segments = skb_gso_segment(skb, 0); @@ -396,34 +416,24 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) __skb_queue_tail(&skb_list, curr); } - skb_list.prev->next = NULL; - /* retrieve peer serving the destination IP of this packet */ - peer = ovpn_peer_get_by_dst(ovpn, skb); - if (unlikely(!peer)) { - switch (skb->protocol) { - case htons(ETH_P_IP): - net_dbg_ratelimited("%s: no peer to send data to dst=%pI4\n", - netdev_name(ovpn->dev), - &ip_hdr(skb)->daddr); - break; - case htons(ETH_P_IPV6): - net_dbg_ratelimited("%s: no peer to send data to dst=%pI6c\n", - netdev_name(ovpn->dev), - &ipv6_hdr(skb)->daddr); - break; - } - goto drop; + /* no segments survived: don't jump to 'drop' because we already + * incremented the counter for each failure in the loop + */ + if (unlikely(skb_queue_empty(&skb_list))) { + ovpn_peer_put(peer); + return NETDEV_TX_OK; } - /* dst was needed for peer selection - it can now be dropped */ - skb_dst_drop(skb); + skb_list.prev->next = NULL; - ovpn_peer_stats_increment_tx(&peer->vpn_stats, skb->len); + ovpn_peer_stats_increment_tx(&peer->vpn_stats, skb_list.next->len); ovpn_send(ovpn, skb_list.next, peer); return NETDEV_TX_OK; drop: + ovpn_peer_put(peer); +drop_no_peer: dev_dstats_tx_dropped(ovpn->dev); skb_tx_error(skb); kfree_skb_list(skb);