From patchwork Mon Jul 6 11:33:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 31 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321203max; Mon, 6 Jul 2026 04:34:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ9ovKyEbJGjn+9QwEVntQ9zrpsq9HOWUnyMYuwYXnP83vySI8zwjTbMovBGooaHJqdHyCrHKLrDQtE=@openvpn.net X-Received: by 2002:a05:6830:488b:b0:7e6:eb9c:3781 with SMTP id 46e09a7af769-7eb7fd42fb5mr6758530a34.12.1783337677945; Mon, 06 Jul 2026 04:34:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337677; cv=none; d=google.com; s=arc-20260327; b=YVJO6+t3fmNqkswiB4DUc6DukkGbZQJQq/JvaXyklSQY/M2q1oHBEtSqEC2UNSArEE dVGHmdjl/GBKMELfM7h/MK+9nAj0DUucvQMXtTUXwih/zoHVuUOyhXcCjyq+ma7/nL5Z 94NRnkBGXVHVkjaulrVz1Mi9/W1t6ZPyRkoQGK8WS4BZyaOZCuCDUyvr7E/+nWAFOppk BafJy6qucst618MJIueRdup6BdDLO+T3A4ZMH8TFt5OmvhpYO+DIHoVQyZZDlBxffrc3 HBXqJOJQEdsCemvgMbuw8D1L4YFX4PeKivxVEJMHmXGNaJmBb/cFkBXW6xwwaHNf+cuk oyxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=FQlXuclLYmEUO4M76PfA0J+2hLQst454HrXe9p1sU/E=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=e1hm1n7ernckZtJul3kX23RQYqkZ9ShJ01aiHESZfnmiosQ64xd8aNx6XAczxXvQSE 8oklu4SUkoCGB7O5wGRxYOmpgcyl5YiIMX/kF0oP3xp3j+BkHHriwiwfgWiIcb3ELSZq bux+IEJ8GGZhvwCfsVFqysu5tpNKy3r1atm+6sohzpfkMtz66VkksKRslPWGeaJQH0Qm YrhN6hxEe9gBgZrvPjHBIRD+2zDvdANZKcMTZ/lRVuRwCvEtTSrjFmw7tdWPNhARL2hf WL1yRkSuJGZTJg4CWnZhvrlLO46tdkkmC1qTYaMrgSFr3CHKK9E9cDCOJ1pvf8m7fPVw OFHw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ols68Bx3; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=MTZK3Cts; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=bWchyaPP; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=B2pgx52b; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7eb544f3683si10420583a34.68.2026.07.06.04.34.37 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:37 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ols68Bx3; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=MTZK3Cts; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=bWchyaPP; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=B2pgx52b; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=FQlXuclLYmEUO4M76PfA0J+2hLQst454HrXe9p1sU/E=; b=Ols68Bx3WEA/1cMZm9lqDHPbzb d2Mrf6bHczcbWg3wxS2MIh17JUJDqW7NK2XMO8VsDWzStU+GK6+niWFeHx9mqDuuZ9p+3MF0GoL8X riAhrPg/VlE2DhLM8KKwJDIX2+nbhoafLtXxeDIPxyhpge8CSkbOXCxPJWHj8cVPZfD4=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghao-0003Ji-Sv; Mon, 06 Jul 2026 11:34:30 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wgham-0003Jb-2Y for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=HrheQwGnnmXTjE3E95q9a7x1dhjeCikJkANiXjR3w98=; b=MTZK3CtsdqEa08DZEvjorNULqa fQ/Cnd3FQ7gLDu7E7nl5E7pTxUmQlZC7sly1Xf0Q6y9UJM4PJY8HAJhqTKDF7OMxMj4mdsAsaCtvZ rhlsBMgHH2bV453Ms6i/f1lV8MxBxpRv5RfOvvzwJuPNPndWN8qawsmfDBZU2rxwTjOc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=HrheQwGnnmXTjE3E95q9a7x1dhjeCikJkANiXjR3w98=; b=b WchyaPPfCDgQ8lT2hzPl7o4XSYQtT7+kuriRmLUuJj/pPUefo5hnUJ43gs9UNLINWUjZHL2qnyZvk ZtH/v60fbMZ+3/FWiWxNx0+dK9Udg4BXHIZ0tLlHUh8P6sZQyl5wwn49reYrTsDiCn7xnYH1EY4fd s3GEquBRqh8WodGA=; Received: from mout-b-106.mailbox.org ([195.10.208.46]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghaj-0006jA-FG for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:28 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [10.196.197.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-106.mailbox.org (Postfix) with ESMTPS id 4gv2Lx2RkxzDsVk; Mon, 6 Jul 2026 13:34:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=HrheQwGnnmXTjE3E95q9a7x1dhjeCikJkANiXjR3w98=; b=B2pgx52b+jRN0xksqqabZl1NDIVCNGlKLSb994rl1bJODrQh+S9pDhMGJIbc03YUDSPfP6 UcZu8fmo9X+gYxULkGuwyBAwPcUDrKt0Jemf7HC54kN2QWblkLHEcjtaEBKAsQzoTcN3gC fKeAeIZnJDseOn/ayS4CpxRZKGLub4PMFQkV+vMqQFsVwqN8MqLWGEJtkFS+OHKDEyCyDp YbiPqX9PW1JzXtdTpjnQjimEPC7Ok0kqzWk7Or94NH+Dy4kjfm2gtolCiVRbzj3nUb+ORn WukoKDTwna4W7NGakEew8nAGBWI9+g7Isd7QDJSmMoebf80h2LgdD3cuYZRq1w== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:33:58 +0200 Message-ID: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hi, This series collects the ovpn fixes we discussed around key-slot handling, netlink key notifications, TCP initialization ordering, and teardown of deferred work. The first two patches were sent separately before. They are included here again so the whole set can be picked in the intended order. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghaj-0006jA-FG Subject: [Openvpn-devel] [PATCH ovpn net v5 0/6] ovpn: fix key and workqueue lifetime issues X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965089358741861 X-GMAIL-MSGID: 1869965089358741861 Hi, This series collects the ovpn fixes we discussed around key-slot handling, netlink key notifications, TCP initialization ordering, and teardown of deferred work. The first two patches were sent separately before. They are included here again so the whole set can be picked in the intended order. The last three patches fix lifetime problems where callback/workqueue cleanup could continue after the reference that pins netdev/module teardown had already been dropped. The series first makes crypto callbacks finish their own cleanup before releasing the peer, then moves ovpn work items to a module-owned workqueue that is drained during module exit, and finally defers key-slot AEAD transform freeing to that workqueue so crypto_free_aead() does not run from an RCU callback. This series is based on top of these pending ovpn net fixes, which are not included here: commit 746ed3312a64 ("ovpn: hold peer before scheduling keepalive work") commit 2e32df6613f3 ("ovpn: fix peer refcount leak in TCP error paths") Thanks, Ralf Lici Mandelbit Srl --- Changes since v4 https://lore.kernel.org/openvpn-devel/981d2ea51cca45138210aa52c6e5a0e55c0da7a0.1783099626.git.ralf@mandelbit.com/ - Include the NULL-slot and key-id notification fixes in this series so the whole set can be picked in order. - Add the TCP initialization ordering fix before the teardown/workqueue fixes. - Rebase the workqueue conversion on the pending keepalive and TCP deferred-work refcount fixes listed above. Ralf Lici (6): ovpn: fix NULL dereference when killing missing key ovpn: use nla_put_u32 for the key ID attribute in ovpn_nl_key_swap_notify ovpn: initialize TCP state before registering UAPI ovpn: finish crypto callback cleanup before peer release ovpn: run deferred work on a module-owned workqueue ovpn: defer key slot crypto freeing to workqueue drivers/net/ovpn/crypto.c | 25 +++++++++++-------------- drivers/net/ovpn/crypto.h | 3 +++ drivers/net/ovpn/crypto_aead.c | 20 ++++++++++++++------ drivers/net/ovpn/crypto_aead.h | 1 - drivers/net/ovpn/io.c | 10 +++++----- drivers/net/ovpn/main.c | 27 +++++++++++++++++++++++---- drivers/net/ovpn/netlink.c | 2 +- drivers/net/ovpn/ovpnpriv.h | 4 ++++ drivers/net/ovpn/peer.c | 8 ++++---- drivers/net/ovpn/tcp.c | 9 ++++----- 10 files changed, 69 insertions(+), 40 deletions(-)