From patchwork Fri Jul 3 12:15:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5087 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp2034437max; Fri, 3 Jul 2026 05:16:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ8XNKor0e4DDBPxQOl2XarrtDPvVYEqCAW+pfxL5iidEs/5W3Aniph5kq2QQule0dn0U/zw1eGy3c8=@openvpn.net X-Received: by 2002:a05:6820:1786:b0:6a1:fd87:5323 with SMTP id 006d021491bc7-6a309bb859fmr5652535eaf.52.1783081000411; Fri, 03 Jul 2026 05:16:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783081000; cv=none; d=google.com; s=arc-20260327; b=I/PV0vQyxVccYp0uiePhlWXHI3xMBoURw3lXl4U9v9WJLo1Qw1XwMIpNoyltOnGqbC oLtq9M4hulj5Fv504Tg9cUA+JDAgRbk7deQ7x+lgLrC3UNxf4thpmXI2l4OSqQSwbLaD 9tZKPqJ7X3vKdTTkBYYfzQJ+UVHz16xqZttMRtd0NicvaAaUluTUuog2Ggpt9IoHv7ic /fxRPu1gfDQ+hoiE7zRKCao6+K5pugsHyDW7YjWbQ0MvskvY8xmWyGVf+QPQwZBUICXB w3iJPVvmhqkDV9uK2CgrfLtTUzEaSze+hn+1Rza2sszLNdOs/UyZSU0iOZGmmPvIHqf8 QEBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=N3mMJ1+O5S73tKXGVdV+PkxAAfykmToEagtmbETUzo0=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=kJjgNxdkPkJw3RDjQPchiP2GkLbFnW1qvs9RV//iTYyvQyrDRNsbHKvWuWtJMJniQy NCN3GwTxtN84OlWKjN3aFAjnH+46bkvP/dDBXDboj58T1CTpNHD5ecogmKRz1Kdo7HUe Vm6ygy3p97qtzvYrFkGmt+kfDAOR/8Rb1QLsrTa46FbBmpYaQJBvAFFvw6M3L3MM43A1 /h1KIagaKswZfE1bj044zeEYFBtSaWMn8Sb+ksvP67cHP4tX843SZeJTcj5EHaa44x/S n7vfKgKWuvylcjxvTjzz171doQzKTalDTPFoGE0tefNpWgMoyK/yFHqgtXGkdS3wZpvG hz/Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=M87RJNh5; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZYg+bpMQ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=AKF+9WW6; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=lFeZ+fBF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-44cfbc029a1si1321304fac.288.2026.07.03.05.16.40 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Jul 2026 05:16:40 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=M87RJNh5; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZYg+bpMQ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=AKF+9WW6; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=lFeZ+fBF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=N3mMJ1+O5S73tKXGVdV+PkxAAfykmToEagtmbETUzo0=; b=M87RJNh5tJU7vMGdQimfN2s7IP a9qsHMVKNYRrD+JQyh3tXBflRd7gxEe7d0PmhYMqvRlkC30TQ9j3LlL1qaph5mK5DaDSIn+66nn4b KG3KaoqRAvAv8KGkUFvgXfBs2ruhhKHwpqOSDoIqXbXXDPsy+FoV95NjiN3eThof30nk=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wfcon-0004Kn-I7; Fri, 03 Jul 2026 12:16:30 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wfcok-0004Kg-Jb for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=IFfM+ZVJqhdiX8l56EWH5BAALm2i8XRXRZszaDJCxeQ=; b=ZYg+bpMQXsZKAgs4lwlvc8SWVT nThGXFFLRjE5aBGqBqus+QywRhSutAbOkHiEzrkQGkphBewaSWqq7vFkznw1xUABZl6rxeJH3MXgU 8q4GeAR2TS5zVDWCKzMmqeiVGCt7n3fRg1wiu9kXCNQaRMlj/j80bbyprx9HmcUjvess=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=IFfM+ZVJqhdiX8l56EWH5BAALm2i8XRXRZszaDJCxeQ=; b=A KF+9WW6CDCZboPUXpo54MNGnPelw1kLZBcLIDtupVjrHuy0pH72tKEfSHL2i+0L6is/qEoqwglqey JFMVOy2kf/Ld6XkT1wcv05YS8Qh1auph7gDLqFT0oSk5ptMXFbFg0Mun1TQFqZcS6+69e4F2nqtXn mFmZWGOVVIQSW9II=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wfcoi-0006yV-OU for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:27 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4gsCQg3TFfz9xm0; Fri, 3 Jul 2026 14:16:11 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783080971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=IFfM+ZVJqhdiX8l56EWH5BAALm2i8XRXRZszaDJCxeQ=; b=lFeZ+fBFaIMkqeDMlXBHLhNnegwnuHtzCqkwP7tk59PEkgXdZQDgOEZVFCDiGf/L0kajpc 3h8PlDa3hkjxeA492MSM3dhPdj7QT2gC6iexhWCbimMlY2BnHMcnFmnVT7I+NZrSJSzPYO +nQRqiLlDqhllUNI7HtKwrWJX05DUswnXPMR29NfgB+avqr5uVwcEs6MUFQWNYfLxJZkBJ L6xfVQsj7s9LYJ33IQjACFpOXdHuScvMJqtwf1er/55qGCBtifRf9rieNRmDtqZg52fF13 w6/lRdjsmXU25h/lm6az6gfgUSeowBD97xfkQ1LK4Ebc8C99JdoNo6NsBjEfDQ== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 3 Jul 2026 14:15:55 +0200 Message-ID: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4gsCQg3TFfz9xm0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progr [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [195.10.208.50 listed in wl.mailspike.net] X-Headers-End: 1wfcoi-0006yV-OU Subject: [Openvpn-devel] [PATCH ovpn net v3 1/3] ovpn: finish crypto callback cleanup before peer release X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869695943035066360 X-GMAIL-MSGID: 1869695943035066360 Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action. Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Ralf Lici --- Changes since v2 https://lore.kernel.org/openvpn-devel/567de7a9371ce72b0632158799dd11bb543cae08.1783068961.git.ralf@mandelbit.com/ - Also free the remaining TX skb before dropping the peer reference, so crypto callbacks do not continue cleanup after peer release. drivers/net/ovpn/io.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index a6b777a9c2d9..e5f2775392d7 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -204,10 +204,10 @@ void ovpn_decrypt_post(void *data, int ret) ovpn_dev_dstats_rx_dropped(peer->ovpn->dev); kfree_skb(skb); drop_nocount: - if (likely(peer)) - ovpn_peer_put(peer); if (likely(ks)) ovpn_crypto_key_slot_put(ks); + if (likely(peer)) + ovpn_peer_put(peer); } /* RX path entry point: decrypt packet and forward it to the device */ @@ -302,11 +302,11 @@ void ovpn_encrypt_post(void *data, int ret) err: if (unlikely(skb)) ovpn_dev_dstats_tx_dropped(peer->ovpn->dev); - if (likely(peer)) - ovpn_peer_put(peer); + kfree_skb(skb); if (likely(ks)) ovpn_crypto_key_slot_put(ks); - kfree_skb(skb); + if (likely(peer)) + ovpn_peer_put(peer); } static bool ovpn_encrypt_one(struct ovpn_peer *peer, struct sk_buff *skb) From patchwork Fri Jul 3 12:15:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5085 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp2034423max; Fri, 3 Jul 2026 05:16:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ/aTEFxLArWy6vHIZGBeTS9Duk3bNpLWyJK/fuzCeDQgA8B5MT75n0izlooc85fcZJsa2Ed3QGtCcc=@openvpn.net X-Received: by 2002:a05:6830:82fb:b0:7e7:8dc0:3951 with SMTP id 46e09a7af769-7eb48af3f25mr6477966a34.8.1783080999906; Fri, 03 Jul 2026 05:16:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783080999; cv=none; d=google.com; s=arc-20260327; b=XpIYm6TAzrkMc6KP40uwi69aYUUtP3lF0vGYNR5bf1e6M+kE6vAAJqNSRl/LhDrlX6 05bNaf+IKuxYo0VfU13ISr7yFDJcyvhDwk+R6Sm2X2w/T3N/tlwDqr4GEpbarTz4XhuQ wulE1BGAhhO9FffHT4aNXeesBw9jFTIA2iREM2fNuQVDoQJOAdEDVme+nommwr6ed7gF jLQKNprxcy08sBh7TozlNNzeQ5+wlOYftc04xKC8IjBJSXmiFUv5fys7l1ooCkamg5PD j6AugMxJ3piWHIfb4UY7wVzJfz6G52DWIOcMvp1vENPsFig/OZEzPLyn5KzB+nM6zUAY FhEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=5+EpXGst+eiiBCBF0DGoNSpprx059MorTw3BbE1lLsY=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=qHGQfs7W+eIUsFGDqownM/AnpE9fDYunwnHT48orCxDqk8kJRgro8B2KJBBZpy6XD9 +3EuU/ClsXPGceFOASZbxsC4Ivu4ciM2/PbxY0NE14zceBd5MBkPAAGcJvF6SPSjneWo gbh3q1SGS8alrnc7zsHn0jRpja0w2VwXXzljMEkZ4rCRE08qQQyp88VHu4sovniOrdVV EgbilZ1ZvZChXTLa8wbNlFMbwdLda6UQiYglWcFOzUGGGW8TrWZTxwXrUlZ2Y6HWi2/t 0swFGI9UzkRGgnqQw54fj37QjXecZcF2z7Y4Yylhyuz+FO0SDEnyCdoK9efSvRdF2RK3 vEQg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NlE5U507; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=EziAzrLv; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PUTkZYrh; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=d1sDHAm9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7eb545aff71si4772625a34.135.2026.07.03.05.16.39 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Jul 2026 05:16:39 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NlE5U507; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=EziAzrLv; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PUTkZYrh; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=d1sDHAm9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=5+EpXGst+eiiBCBF0DGoNSpprx059MorTw3BbE1lLsY=; b=NlE5U507Yi5Qfrr1LuRQgLQipv Q63MLxK8MXgtSO6pkKzPVFxCbnuWnTIKCLipwVu8mTnhJG9F7eA1NEBPpK71Qt2aZ0+uY+fAGRw9w wykKxA516quAKWMSuD5m/efRPkrtPcwBj3wzdZWB9TDlNphJNqui86lnC+X2vBGUTNxk=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wfcor-0008Gj-89; Fri, 03 Jul 2026 12:16:33 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wfcol-0008GZ-WF for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=MtmDcZMLv9OA7oZjiFSfXAbilkohKAeTvfIagh0wmK0=; b=EziAzrLvuEP+0otHYWQ/9e7RdO dXNVpjqSoqiGev/VSilcWlZ+oza9/murFWHXnRiW6pk7vpNjw4V0S94zE1RYL5gR1ssijTfoVf7Nn Uv3ongHaW6huXJlO5C+K6yW7APywP49Ge52ZdHFxlSh5bxuij9o63bIPwNZouF2KZlw0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=MtmDcZMLv9OA7oZjiFSfXAbilkohKAeTvfIagh0wmK0=; b=PUTkZYrhmy3hsqw8XbTR1ZCKYr 7VPGrsI8zRFQ+7YlmTzFYhSAmctdocis97YZGlfz7mEJM5BvQBmGVn/4V0TZerYHz6LZ8IAzqMZM9 G479+Df+dfw7cwvfXgR3cwDvM7roS9uHZObOhvD1kcWBKcRzYHkfMKaOLCR5xOZ74V9o=; Received: from mout-b-201.mailbox.org ([195.10.208.61]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wfcoj-0006yf-RJ for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:27 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-201.mailbox.org (Postfix) with ESMTPS id 4gsCQj2VY6zDsGD; Fri, 3 Jul 2026 14:16:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783080973; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MtmDcZMLv9OA7oZjiFSfXAbilkohKAeTvfIagh0wmK0=; b=d1sDHAm9BXhEIK0WjeL0pDUmTLYdOD51A1XbLm89cUJrhq/uV+GTO2vWP5NEUNMbKulOrb RBuCJZCXDDWFR9Yl6xe0TUtUTAWltnd5794FblOm+1JHyoO2mFnmnoPLyUolRPV7IvS+fl kMMwgsyQ9YB8iUItqIz4RweufTFQvO1HuILOex1UhrjeArWwvucyydEgNmyCi/VDbCO9dD Mz29eA4XhJKvEjh47vtPk5qWsz7ibtZyUlsaqIMwRm/UbWG2aAK2ts2W1gK741ODDCfMzU 8tbTRNFu/kQYSi5Bu6LT6WuV4EaKGEJ/8wn0rqiYbG1jOBsDyzAlOsuGQ/jQGw== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 3 Jul 2026 14:15:56 +0200 Message-ID: <49f38f89340e18ed30543d3990a7a7e20595b6af.1783080055.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn_peer_release can run from ovpn module execution context. For example, ovpn_peer_keepalive_send passes its peer reference to ovpn_xmit_special, which may drop the final peer reference before the w [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wfcoj-0006yf-RJ Subject: [Openvpn-devel] [PATCH ovpn net v3 2/3] ovpn: defer peer netdev reference release to RCU X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869695942371439916 X-GMAIL-MSGID: 1869695942371439916 ovpn_peer_release can run from ovpn module execution context. For example, ovpn_peer_keepalive_send passes its peer reference to ovpn_xmit_special, which may drop the final peer reference before the worker returns. The peer reference owns a netdev reference. Releasing that netdev reference synchronously in ovpn_peer_release can unblock netdev unregistration and module removal while the caller is still executing ovpn text. Keep the netdev reference until the peer RCU release callback. That callback already performs the final peer cleanup after active users have left their RCU read-side sections, and dropping the netdev reference there prevents module teardown from passing the netdev-ref boundary while the final peer-put caller is still running. Fixes: 80747caef33d ("ovpn: introduce the ovpn_peer object") Signed-off-by: Ralf Lici --- New patch added in v3. drivers/net/ovpn/peer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index a09d61296425..d274e901cba1 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -347,6 +347,7 @@ static void ovpn_peer_release_rcu(struct rcu_head *head) * perform it in the RCU callback, when all contexts are done */ dst_cache_destroy(&peer->dst_cache); + netdev_put(peer->ovpn->dev, &peer->dev_tracker); kfree(peer); } @@ -361,7 +362,6 @@ static void ovpn_peer_release(struct ovpn_peer *peer) ovpn_bind_reset(peer, NULL); spin_unlock_bh(&peer->lock); call_rcu(&peer->rcu, ovpn_peer_release_rcu); - netdev_put(peer->ovpn->dev, &peer->dev_tracker); } /** From patchwork Fri Jul 3 12:15:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5086 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp2034429max; Fri, 3 Jul 2026 05:16:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ8qX7q8PkxIZ5gKOdb86JajJmnV20e8chhr9UgbV7AqA8YMpCHRAWYyzLSpHcku7egDlC59QJJaOVg=@openvpn.net X-Received: by 2002:a05:6808:1801:b0:48f:bc94:9a83 with SMTP id 5614622812f47-497e1d2ec69mr2279791b6e.21.1783081000090; Fri, 03 Jul 2026 05:16:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783081000; cv=none; d=google.com; s=arc-20260327; b=oxJTE9es52OVh6paGJX5UcYBYYkhqVSORRPtj5/rwEjGWhNI0A9eOiBLeJ630LMIIt N6MUORNxm8T4Ki9tstkC5eUqaPRQhbY5ZQnpVJ+ks70NDNEAXM+DisABDBLEJXUrAIE/ 3vKHIx6QS0i8fOaZFHbHsCMFx9Aft9Uwo4EdCADkn4n4Duixz8ChDl41Gp9DbfaGBU0C /Jy4g+f3ocIl1zyZXk8MtxC1TyCXGeTPYT0c52eFJzxTK67vSK+vHb3tKuJHmeZW7Nt2 r4rqhvTLgLdI55NaH6TJWSdj0rVMZX+B7i3dNFvTD6LAV5an8CZ7dHuUC4hCT2RdtK0X /5Qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=zQplJI1sf7eOxIIUZ2THEuBemxIvY8ma6uPLuw6HfKo=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=k6Jhgi2PCfBkAxZVekSiWWs8E+TfBdLbfZGS61zm0JJvdy9oVQIOMmIjZ/BeKX6rM7 3wfYjsSwKXiV0gwNhWdXYnbL9YMDKcZPFdj5FFDk2AXk7yIkysLpbmy7ON21wjSJKcML 2LWQNmt8IVmRqU5Ph3OVKek2xfTmOEvRJ+9Xlw6sNQhYOLUrqmm+cm3SPe0ija4gJPA1 Wpv7BPX+BQH1FDKC1om6akZFjEDWxHvbSraSVzJrGZatC7QN8RSQj3iQR+Xed7tgHZgl ZL5PGUXFEO38HFJYuHRgMQuTHSIMEMUr+kmqvlUuag/ch+NClayN82tezUbzuj1epkTS fjrQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Jl6bF6+z; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Ts+6maPB; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Cqhw6bD9; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=LuuUpVAr; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-497d17d04bcsi3935334b6e.8.2026.07.03.05.16.39 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Jul 2026 05:16:40 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Jl6bF6+z; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Ts+6maPB; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Cqhw6bD9; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=LuuUpVAr; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=zQplJI1sf7eOxIIUZ2THEuBemxIvY8ma6uPLuw6HfKo=; b=Jl6bF6+ztw9ucI/3eEyN8qxJIU 5aWAyDKV34CpvxqycReAF78w3Ke8gt06YQDaz3unbAGXfZb+StLwlbkVOVDGdRHpglKvQ0Ebkr2/a jGq7asL7xGxvC8Cz0Vj2QLAMBYfQ8rHrKAcmg2UFs/zqgo2rZbh+7P+ilnkg+gvgTqrg=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wfcou-0005Xl-0R; Fri, 03 Jul 2026 12:16:33 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wfcos-0005Xd-1C for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=6LpY93VaxjXbodNdQ5fkiPzcsvsYdbLJBR/tpniFzew=; b=Ts+6maPBUhvV66wD3twXRtY9Wv JtW8uCdHR57/gDxznvrrqweTHczVP3rN7KfK8J9b0VFeuqWRGNaA9C0usl3joBhM8cXVEHJCX7jtH Jz4XNctb5G7Db4Nkb0Ve0GNeo9a29yYZp7TE+0As+qg1gDiI8kC1wgsRU0NPHEIZveHE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=6LpY93VaxjXbodNdQ5fkiPzcsvsYdbLJBR/tpniFzew=; b=Cqhw6bD9c2qFqQqCsPgxTlQK3n 54MJjNlXDwKEqRXT9uPTIJaoOh8TcGdRTjROaHlMc0kxZWRqLhabyXfc6GHneMcep17IGe25ArhDj P/LzpPqrzhejsGfa/Y0JsERnWWKNEybf2NC6iHX93dGX4q3F6MrKmTxQl/ehtxw1DAT8=; Received: from mout-b-201.mailbox.org ([195.10.208.61]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wfcom-0006yl-5s for openvpn-devel@lists.sourceforge.net; Fri, 03 Jul 2026 12:16:31 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-201.mailbox.org (Postfix) with ESMTPS id 4gsCQl1FlnzDsDV; Fri, 3 Jul 2026 14:16:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783080975; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6LpY93VaxjXbodNdQ5fkiPzcsvsYdbLJBR/tpniFzew=; b=LuuUpVArNYbcDcAJEPgZbvXTmfTSGRQaSKPPQj2XmBK5Na81H6YUNS4ysXY2kkxpq2fkZW a0Emxyiyr0hVA3oJ83iYAbnoxuzqA4Aw1pl9yIeu3AciOwc1YgIwIWVuwhPP/Ud3qzzSb1 8sdOSOBTiD+3vOLC5QXq5GO//IRLlt1Qi/pk31AmNWvNZ3AwnWSYnEodSPifh1NOajt7SL 68gxgPLbgfNInA7ymJKZyRpkUjgbW0TNV59a9oggZw3cV6tuV22RMMrX8c8m6ejffBoY+G quCE7SoPt5wPNzcN099xbQHypz2zMETrljVRcdSEsYWBw6uxlWlNc/srdzhjkw== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 3 Jul 2026 14:15:57 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn_crypto_key_slot_release currently schedules an RCU callback to destroy the key slot. That callback calls into AEAD teardown and frees the crypto transforms. RCU callbacks run in atomic context, but crypto transform teardown is not guaranteed to be atomic-safe. Some AEAD driver exit paths may wait for hardware or take sleepable locks, so calling them from [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1wfcom-0006yl-5s Subject: [Openvpn-devel] [PATCH ovpn net v3 3/3] ovpn: defer key slot crypto freeing to workqueue X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869695943105111042 X-GMAIL-MSGID: 1869695943105111042 ovpn_crypto_key_slot_release currently schedules an RCU callback to destroy the key slot. That callback calls into AEAD teardown and frees the crypto transforms. RCU callbacks run in atomic context, but crypto transform teardown is not guaranteed to be atomic-safe. Some AEAD driver exit paths may wait for hardware or take sleepable locks, so calling them from the RCU callback can trigger sleeping-in-atomic bugs. Queue key slot destruction on an ovpn-owned workqueue when the slot refcount reaches zero. A system workqueue would not be drained by ovpn module exit, so use a module-owned workqueue that is destroyed before the final rcu_barrier. This relies on the previous crypto-completion fix: callbacks now queue key-slot release before dropping the peer reference that can unblock module teardown. ovpn_crypto_config_get was the only lockless path that queried the transform without holding the slot. Take a temporary slot reference there before reading the algorithm, preserving the invariant that AEAD transforms are only reachable by key-slot kref holders. Bypassing call_rcu for crypto teardown is safe because the AEAD transforms are only used by key-slot kref holders. Once the kref reaches zero, no transform user remains. The slot memory still needs RCU protection because lockless readers may have observed the slot before they failed to acquire the kref, so the worker releases the transforms from process context and then frees the slot with kfree_rcu. Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Ralf Lici --- Changes since v2 https://lore.kernel.org/openvpn-devel/b5dfebec718f230783ff47aa354c3b3fa1aa2ed7.1783068961.git.ralf@mandelbit.com/ - Reword the message to note the dependency on patch 1. Changes since v1 https://lore.kernel.org/openvpn-devel/350f6b48c363dde5a8d0bdf7a1b9fd2abb8b1034.1783057762.git.ralf@mandelbit.com/ - Fix a potential AEAD transform UAF in ovpn_crypto_config_get by holding a slot kref while reading the cipher algorithm. drivers/net/ovpn/crypto.c | 25 ++++++++++++++++++------- drivers/net/ovpn/crypto.h | 7 +++++++ drivers/net/ovpn/crypto_aead.c | 20 ++++++++++++++------ drivers/net/ovpn/crypto_aead.h | 1 - drivers/net/ovpn/main.c | 15 +++++++++++++-- 5 files changed, 52 insertions(+), 16 deletions(-) diff --git a/drivers/net/ovpn/crypto.c b/drivers/net/ovpn/crypto.c index 8cb7078a1d93..3147d01e87c4 100644 --- a/drivers/net/ovpn/crypto.c +++ b/drivers/net/ovpn/crypto.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include "ovpnpriv.h" @@ -18,12 +19,21 @@ #include "crypto_aead.h" #include "crypto.h" -static void ovpn_ks_destroy_rcu(struct rcu_head *head) +static struct workqueue_struct *ovpn_wq; + +int ovpn_crypto_workqueue_init(void) { - struct ovpn_crypto_key_slot *ks; + ovpn_wq = alloc_workqueue("ovpn", 0, 0); + if (!ovpn_wq) + return -ENOMEM; + + return 0; +} - ks = container_of(head, struct ovpn_crypto_key_slot, rcu); - ovpn_aead_crypto_key_slot_destroy(ks); +void ovpn_crypto_workqueue_destroy(void) +{ + destroy_workqueue(ovpn_wq); + ovpn_wq = NULL; } void ovpn_crypto_key_slot_release(struct kref *kref) @@ -31,7 +41,7 @@ void ovpn_crypto_key_slot_release(struct kref *kref) struct ovpn_crypto_key_slot *ks; ks = container_of(kref, struct ovpn_crypto_key_slot, refcount); - call_rcu(&ks->rcu, ovpn_ks_destroy_rcu); + queue_work(ovpn_wq, &ks->free_work); } /* can only be invoked when all peer references have been dropped (i.e. RCU @@ -201,14 +211,15 @@ int ovpn_crypto_config_get(struct ovpn_crypto_state *cs, rcu_read_lock(); ks = rcu_dereference(cs->slots[idx]); - if (!ks) { + if (!ks || !ovpn_crypto_key_slot_hold(ks)) { rcu_read_unlock(); return -ENOENT; } + rcu_read_unlock(); keyconf->cipher_alg = ovpn_aead_crypto_alg(ks); keyconf->key_id = ks->key_id; - rcu_read_unlock(); + ovpn_crypto_key_slot_put(ks); return 0; } diff --git a/drivers/net/ovpn/crypto.h b/drivers/net/ovpn/crypto.h index 0e284fec3a75..249d7e4de130 100644 --- a/drivers/net/ovpn/crypto.h +++ b/drivers/net/ovpn/crypto.h @@ -10,6 +10,8 @@ #ifndef _NET_OVPN_OVPNCRYPTO_H_ #define _NET_OVPN_OVPNCRYPTO_H_ +#include + #include "pktid.h" #include "proto.h" @@ -45,6 +47,7 @@ struct ovpn_crypto_key_slot { struct ovpn_pktid_recv pid_recv ____cacheline_aligned_in_smp; struct ovpn_pktid_xmit pid_xmit ____cacheline_aligned_in_smp; + struct work_struct free_work; struct kref refcount; struct rcu_head rcu; }; @@ -121,6 +124,10 @@ ovpn_crypto_key_slot_primary(const struct ovpn_crypto_state *cs) void ovpn_crypto_key_slot_release(struct kref *kref); +int ovpn_crypto_workqueue_init(void); + +void ovpn_crypto_workqueue_destroy(void); + static inline void ovpn_crypto_key_slot_put(struct ovpn_crypto_key_slot *ks) { kref_put(&ks->refcount, ovpn_crypto_key_slot_release); diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 8f07c418622b..332975527734 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -9,6 +9,7 @@ #include #include +#include #include #include #include @@ -380,14 +381,19 @@ static struct crypto_aead *ovpn_aead_init(const char *title, return ERR_PTR(ret); } -void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks) +static void ovpn_aead_crypto_key_slot_free(struct ovpn_crypto_key_slot *ks) { - if (!ks) - return; - crypto_free_aead(ks->encrypt); crypto_free_aead(ks->decrypt); - kfree(ks); +} + +static void ovpn_aead_crypto_key_slot_free_work(struct work_struct *work) +{ + struct ovpn_crypto_key_slot *ks; + + ks = container_of(work, struct ovpn_crypto_key_slot, free_work); + ovpn_aead_crypto_key_slot_free(ks); + kfree_rcu(ks, rcu); } struct ovpn_crypto_key_slot * @@ -420,6 +426,7 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) ks->encrypt = NULL; ks->decrypt = NULL; + INIT_WORK(&ks->free_work, ovpn_aead_crypto_key_slot_free_work); kref_init(&ks->refcount); ks->key_id = kc->key_id; @@ -453,7 +460,8 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) return ks; destroy_ks: - ovpn_aead_crypto_key_slot_destroy(ks); + ovpn_aead_crypto_key_slot_free(ks); + kfree(ks); return ERR_PTR(ret); } diff --git a/drivers/net/ovpn/crypto_aead.h b/drivers/net/ovpn/crypto_aead.h index 65a2ff307898..fae3b585a43b 100644 --- a/drivers/net/ovpn/crypto_aead.h +++ b/drivers/net/ovpn/crypto_aead.h @@ -22,7 +22,6 @@ int ovpn_aead_decrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, struct ovpn_crypto_key_slot * ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc); -void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks); enum ovpn_cipher_alg ovpn_aead_crypto_alg(struct ovpn_crypto_key_slot *ks); diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 9993c1dfe471..10f61377bd54 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -18,6 +18,7 @@ #include #include "ovpnpriv.h" +#include "crypto.h" #include "main.h" #include "netlink.h" #include "io.h" @@ -233,13 +234,20 @@ static struct rtnl_link_ops ovpn_link_ops = { static int __init ovpn_init(void) { - int err = rtnl_link_register(&ovpn_link_ops); + int err; + err = ovpn_crypto_workqueue_init(); if (err) { - pr_err("ovpn: can't register rtnl link ops: %d\n", err); + pr_err("ovpn: can't allocate workqueue: %d\n", err); return err; } + err = rtnl_link_register(&ovpn_link_ops); + if (err) { + pr_err("ovpn: can't register rtnl link ops: %d\n", err); + goto destroy_wq; + } + err = ovpn_nl_register(); if (err) { pr_err("ovpn: can't register netlink family: %d\n", err); @@ -252,6 +260,8 @@ static int __init ovpn_init(void) unreg_rtnl: rtnl_link_unregister(&ovpn_link_ops); +destroy_wq: + ovpn_crypto_workqueue_destroy(); return err; } @@ -259,6 +269,7 @@ static __exit void ovpn_cleanup(void) { ovpn_nl_unregister(); rtnl_link_unregister(&ovpn_link_ops); + ovpn_crypto_workqueue_destroy(); rcu_barrier(); }