From patchwork Wed Oct 28 22:04:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 5524 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:340f:b0:118:2077:975e with SMTP id by15csp2320876lab; Wed, 28 Oct 2026 15:04:51 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBx1wpKW0XvFKbb9H+mNZB1HTpqAQWGGh6M4noGWBfXTbyagtn4nQha3mwREVzUHGvTuzA3+3npzo0I=@openvpn.net X-Received: by 2002:a05:6870:b3c5:b0:475:a112:1276 with SMTP id 586e51a60fabf-4a8bb6a4860mr2765730fac.35.1793225091437; Wed, 28 Oct 2026 15:04:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793225091; cv=none; d=google.com; s=arc-20260327; b=h6B1YTOIjK2UGeBqHfvGREK1Cer83V5n6H1Fc2cDUub+ZX797oTmTQRGVqjnaaXw1F Wl2yWwc5/3IDeUpQ+uMQPLVDa6T6kihxRdmZ+t3fVTfw0ZIaAwv5YxpN7gYGmLqV+QjR GUjgv+cmVcxDeo1pcT1ZKSXG4j6AFNLUNvwBAESN2fgXp9WYcsqXbE7tR+HDKufFPz6b 09rOCVOdMzIVpXnFpDTtL1G0odQDzhaY4FPQDWOLt9elu8QCGZhGrzzWKrSCfS1QVc6U GAqW+3XN/CLKjTaVs+NvVsqQFQsyxYEmPgbeF7i3slYZb1qFLTxUmxQMRFH04cnMZegr OFiA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=pikTnzXgTcsBzpG+yr+usBSlr+QEvldPIP3DsRuxESU=; fh=eHzqEHcY8ia46XQoTC058ljZO9XpcupiyvYgxf/Hobw=; b=ZOFLCZys8PsAbQsT7Li+t9uNeQufCeRThRkBH6Ks59JTMcK3JDQHLg9lT/cLX6FJ/j sqWwD0sRD56Z8UzQlyV+qdFSg3t5PClPHHidUa2yOnPyEJtv0/hpe9cwS6fGApAzvCdv ABVUMqxJOkbBpIPzfvur6OtfyVJxijTCGC/F/OFh2IXy7V+6UcbNJ2smubr8tEwzMhPe T/2o81pRiYqC+ym60wMegnMax7f4TC98krLanBvnJ48r8ifbPXObsL1t7MsLQhi3r5uf GffiMavKYJ/8cQsfgPP615e7eAq5TohGnOFk7r3nFBJrjTyb6MXsK8i4ljI4f/fY6BDQ bwWQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=eASls4pK; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hHw4ntY1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=FP3zf0ws; dkim=neutral (body hash did not verify) header.i=@unstable.cc header.s=MBO0001 header.b=zOmZeaQW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a8b79be6c7si5977854fac.255.2026.10.28.15.04.51 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2026 15:04:51 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=eASls4pK; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hHw4ntY1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=FP3zf0ws; dkim=neutral (body hash did not verify) header.i=@unstable.cc header.s=MBO0001 header.b=zOmZeaQW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Unsubscribe-Post:List-Owner; bh=pikTnzXgTcsBzpG+yr+usBSlr+QEvldPIP3DsRuxESU=; b=eASls4pKz32c/e5ftlMFTc2yQX gq1p6J2MfVuUCm2+f8fNRMHRQ5r7Nog4e1rnwZhN9idUukwgT/rkUtQCA59Wl0l9LZAAmmYwH/ZOp ufr7p90OrgHuPHXPbH8PuVXR9+gluOZOXhLoyTEa6NB5VCmQMllqMKYRfsQzcJoVx4os=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xMBlJ-000000002Zc-2RaS; Wed, 28 Oct 2026 22:04:49 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xMBlI-000000002ZU-1R24 for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 22:04:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=bbh7ro44JUZscSvhfLF662noRd/zDD1qgxDlfqHkslM=; b=hHw4ntY1lK9tcdFMtMn0iwEke3 DzH3/SWmqc2lWr9lD8ZIDjdEn9cLf0+zkQgcqEv6p5Ak6zPFkWlvdx75grYN2FhoDfwWbhiLciJvx +1Bq5eiS/7h8PlTyQewwVfOadslGLwxNKPeKRaUai5q4Dot1Mdqz+HQ1rki037/v9bbs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=bbh7ro44JUZscSvhfLF662noRd/zDD1qgxDlfqHkslM=; b=FP3zf0wsmTePsfcdKJ97p0cx3B rb8NL30bxfoVMu6GkgCLTQIQEExVypTrdXgI7img1P8OzZfoqbc0FcDdhS8HQ9mt6nWWGJLN1GspY QoQvnLHIdEDvfGiWdrLIoE1Kvc+kAi8XOQZdtZ6UxUmwv7O3oCgv2dAxuG7edUjF/Fe8=; Received: from mout-p-102.mailbox.org ([80.241.56.152]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xMBlF-000000004KX-2hO2 for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 22:04:48 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4jFLxd1KBLzKnB8; Wed, 28 Oct 2026 23:04:37 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unstable.cc; s=MBO0001; t=1793225077; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=bbh7ro44JUZscSvhfLF662noRd/zDD1qgxDlfqHkslM=; b=zOmZeaQWQhAa00nQ5Gp3+f+x+qbwM/jaSdzwYM3FiuwYDzDI0Pb6ceqqgEJFjji+p/Irdx lqxqHNJuDEEbEz4bA3VYCE7xf4oCQS7UUKCz01Hw3hD6vC5TNVWmGaBG/zWkVIXB11pruB 3c1yv6IbuNtodiDYxNF98M/gOs/HBg/ekf7VUKcQI2caywtqqRPrU0c+B00J0Z5/RDN9hy aGPFDoNBj7rxdP0FVx6xLMh7Yh2wAeJjdXL1MyKyBoHKWHeAP7vR1+631ZQF93dCqeZCeW YtK7AejclTpUVgP4OKt1MrLuc5WIwhrYtmRsbW2txVUJrVYhpjQVE8sCnQ4Mvw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of a@unstable.cc designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=a@unstable.cc From: Antonio Quartulli To: openvpn-devel@lists.sourceforge.net Date: Wed, 28 Oct 2026 23:04:30 +0100 Message-ID: <20261028220430.968756-1-a@unstable.cc> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jFLxd1KBLzKnB8 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Antonio Quartulli If the outer packets of a TCP peer are routed into the ovpn interface, ovpn_net_xmit() selects that same peer and ovpn_tcp_send_skb() tries to take sk->sk_lock.slock, which the TCP transmit path alrea [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1xMBlF-000000004KX-2hO2 Subject: [Openvpn-devel] [PATCH ovpn net] ovpn: drop packets looping back into their own TCP transport socket X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Antonio Quartulli , stable@vger.kernel.org Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880332793550584742 X-GMAIL-MSGID: 1880332793550584742 From: Antonio Quartulli If the outer packets of a TCP peer are routed into the ovpn interface, ovpn_net_xmit() selects that same peer and ovpn_tcp_send_skb() tries to take sk->sk_lock.slock, which the TCP transmit path already holds. The CPU deadlocks. Drop such packets in ovpn_net_xmit(). Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Cc: stable@vger.kernel.org Reported-by: Bernhard Schmidt Closes: https://lore.kernel.org/openvpn-devel/auJj5Ld6uMjPb2eS@fliwatuet.svr02.mucip.net/ Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Antonio Quartulli --- drivers/net/ovpn/io.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index f14eb4e6c46a..57cdea45dce7 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -349,6 +349,31 @@ static void ovpn_send(struct ovpn_priv *ovpn, struct sk_buff *skb, ovpn_peer_put(peer); } +/** + * ovpn_skb_is_looping - check if skb comes from the peer's own socket + * @peer: the peer the skb is about to be sent to + * @skb: the packet to check + * + * Return: true if @skb was generated by the transport socket of @peer, + * false otherwise + */ +static bool ovpn_skb_is_looping(struct ovpn_peer *peer, + const struct sk_buff *skb) +{ + struct ovpn_socket *sock; + bool ret; + + if (!skb->sk) + return false; + + rcu_read_lock(); + sock = rcu_dereference(peer->sock); + ret = sock && sock->sk == skb->sk; + rcu_read_unlock(); + + return ret; +} + /* Send user data to the network */ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) @@ -386,6 +411,13 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) } goto drop_no_peer; } + + if (unlikely(ovpn_skb_is_looping(peer, skb))) { + net_warn_ratelimited("%s: recursive routing detected, dropping TCP packet to peer %u\n", + netdev_name(ovpn->dev), peer->id); + goto drop; + } + /* dst was needed for peer selection - it can now be dropped */ skb_dst_drop(skb);