diff mbox series

[Openvpn-devel,net,v2,1/2] ovpn: release key slot before peer in crypto callbacks

Message ID 567de7a9371ce72b0632158799dd11bb543cae08.1783068961.git.ralf@mandelbit.com
State Changes Requested
Headers
Series [Openvpn-devel,net,v2,1/2] ovpn: release key slot before peer in crypto callbacks |

Commit Message

Ralf Lici July 3, 2026, 9:06 a.m. UTC 
  Crypto completion callbacks release both key slot and peer references.
The peer reference pins the netdev. Once ovpn_peer_put drops the last
reference, netdev unregistration and module removal can complete on
another CPU while the callback is still running.

The subsequent ovpn_crypto_key_slot_put can then schedule an RCU
callback backed by module text after ovpn_cleanup rcu_barrier has
already run. The callback can later execute in freed module memory.

Release the key slot first, while the peer reference still blocks
teardown, and drop the peer reference as the last action.

Fixes: 8534731dbf2d ("ovpn: implement packet processing")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
New patch added in v2.

 drivers/net/ovpn/io.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c
index a6b777a9c2d9..9671ee6bea9b 100644
--- a/drivers/net/ovpn/io.c
+++ b/drivers/net/ovpn/io.c
@@ -204,10 +204,10 @@  void ovpn_decrypt_post(void *data, int ret)
 		ovpn_dev_dstats_rx_dropped(peer->ovpn->dev);
 	kfree_skb(skb);
 drop_nocount:
-	if (likely(peer))
-		ovpn_peer_put(peer);
 	if (likely(ks))
 		ovpn_crypto_key_slot_put(ks);
+	if (likely(peer))
+		ovpn_peer_put(peer);
 }
 
 /* RX path entry point: decrypt packet and forward it to the device */
@@ -302,10 +302,10 @@  void ovpn_encrypt_post(void *data, int ret)
 err:
 	if (unlikely(skb))
 		ovpn_dev_dstats_tx_dropped(peer->ovpn->dev);
-	if (likely(peer))
-		ovpn_peer_put(peer);
 	if (likely(ks))
 		ovpn_crypto_key_slot_put(ks);
+	if (likely(peer))
+		ovpn_peer_put(peer);
 	kfree_skb(skb);
 }