From patchwork Mon Jul 6 11:33:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5091 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321228max; Mon, 6 Jul 2026 04:34:39 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rov8bsC7TAB9PB+0TO1qGiicf5aDt0NrGyRX2DiUVFaqpsYFX2jBcHRxvANiWR2tZ/FOswlamlH0+c=@openvpn.net X-Received: by 2002:a05:6870:3272:b0:448:4eb3:b87e with SMTP id 586e51a60fabf-44d182e9e19mr6218551fac.27.1783337679293; Mon, 06 Jul 2026 04:34:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337679; cv=none; d=google.com; s=arc-20260327; b=d5ADKJe74tLqESV4WwJie1uwZkjsOxkS8MiU4Rev2G03IloBskf4bfT25gbUWdHFRW q1thYna10JShaFAfAg5eeggGzIF5t/S+eZ8WUqnGQJoo4SwxTsGGgEaFkQS24SsqAQuh pK/aIBgT4zPodcyQGq7tGlR8PILxyqoYAgNcbrg4tWH0YvrWP9Ygf2BEuK9tLAUjHwVK MASRDU+rvap0BijEFpgUF2Mj6dZe5T7z9uN1e9BefqtpK/yCSMov8d3FJgqGWfKCz4hq qul8ijNTYWStRHPwjhOupx6qDE0jgVGhSRIsLAjBTnnxC60kh2R8gVgUs5x8ri+9c2AK Gucw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=N4kSnmDCLOQt/zZqzatHcgV5fBoi13OyZVJO/0W1JyE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=p7LOvUPTlI5m+MNFiaONcJeG9J6007HD7eCkNU/jaVl+fgq7GRj2Yn1jrpL2zo2abc rVGo3CcVy/mlPljdhwQXPrV9dH5nQZGjM9myfIn6aGKF8OAE69Fsq4VSCngzNQbk5Ggm GiqgKb6jZK1masAeGWrK7slERrSMAPxclqe+ZM9cBX8VBCkIsVW1h/xk0+aghPORKYd/ iyz0OV1LCI1VmNXHCBJyMT+jDhAdZYJPgvKkfmMRpH1es0D7ev9zezmgsbroVCDTrVJm Iido+Tnx3rZR+XAHCujNaUVkIojzVhVnpgQIkjD/gTDuI8DgfdOJ/TQMuM5wKexSL2FE ENog==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=lQ2M1LSw; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=DYtuZoYq; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Zxg+ygn0; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=LqewURx9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-44d30639a09si4869104fac.126.2026.07.06.04.34.39 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:39 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=lQ2M1LSw; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=DYtuZoYq; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Zxg+ygn0; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=LqewURx9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=N4kSnmDCLOQt/zZqzatHcgV5fBoi13OyZVJO/0W1JyE=; b=lQ2M1LSwuDMc7GW0Jp9hyQeOur Mj9rfOJx42sK/2JBpUxkM24gHtf3w6rRv2Y6dHX4oxaoQ4PoKXbsft3bunEALvmiEf9Qbk/ZNYKMI MExuNXdHwFu3vuNjBdY0AW2bLTzx9Hd3gqQeGTZvxlHYY8BvpEIFy4SosL+QRyMEykvE=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghat-0001KK-9K; Mon, 06 Jul 2026 11:34:36 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghar-0001KB-Ak for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=vYkAXVlwWnFwk4Pg9jQnNOpzSSm0BPWUf0P489QL93U=; b=DYtuZoYqS1HAxxForlKlpQZqiM r8hWgxhQiY1BgP4XZocNdQRslBuVDH0tx9N9Yn+oAzpa5+T43ojkhxIFsp2D6hoIGujrZ5ZEd2uAr YI3YgsjP5YHB21uLpKFry9VGbNolIe/o7AOSovqWWVmgmeEclEgHOfU7CEd3OStJozwc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=vYkAXVlwWnFwk4Pg9jQnNOpzSSm0BPWUf0P489QL93U=; b=Zxg+ygn0GSjxQMkBzL0hNA/ixV h8CbTFpZ396fXogw2sPfpvBL0n+gXXBiOLKQGIFZnSBbl9Wen5Yh1mfIgPC7XiP8s1Hiu/TIFTQ7o koiYsXR/M3ENoSrM9SpP/j6+mZCtD9x+Im5LEFA8rR97AeubtLpCeBd2OmzgYygd6VOw=; Received: from mout-b-110.mailbox.org ([195.10.208.55]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghap-0006lM-UI for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:34 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [10.196.197.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4gv2Ly6gJ0zB1Ct; Mon, 6 Jul 2026 13:34:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337658; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vYkAXVlwWnFwk4Pg9jQnNOpzSSm0BPWUf0P489QL93U=; b=LqewURx9g7iTWrNBQxeI4cZSRrZ84ShgpQzuRZ6XcCg49pcNq1TY/jfvid9/n98pZgalQx 3WE7hHWOyTFYRLomgJTSziQIStp2rrUIV0bonli7ikyH+ov84Uuisn7p0chJnxPBowW9zW apmRQy6egqumMqnekGReLOCNPS8xUukqDjazDpjFRrDw43GTSKvWvbt199Qg2GcSbuW58r VP0OxXlq0N7MbIzGjq4ELIiBPWb8NzuMBn8xqWBhJFiAOIboZ5iU6Na/nN5Q4fekBewixD iH33SeJ4YGOvatG12lqNJ9js1/0HubEKJflP9NKQCbERevXOiYCrCc8FBwql5A== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:33:59 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be ask [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghap-0006lM-UI Subject: [Openvpn-devel] [PATCH ovpn net v5 1/6] ovpn: fix NULL dereference when killing missing key X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965090188861785 X-GMAIL-MSGID: 1869965090188861785 ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present. Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches. Fixes: 89d3c0e4612a ("ovpn: kill key and notify userspace in case of IV exhaustion") Signed-off-by: Ralf Lici --- Changes since v4 of this series https://lore.kernel.org/openvpn-devel/981d2ea51cca45138210aa52c6e5a0e55c0da7a0.1783099626.git.ralf@mandelbit.com/ - Add this previously posted standalone fix to the series so the whole set can be picked in order. - No changes since v2 of the original single patch https://lore.kernel.org/openvpn-devel/19318904cf077d067cd4ec628a22bab03ed7dd29.1782993857.git.ralf@mandelbit.com/ Changes since v1 of the original single patch https://lore.kernel.org/openvpn-devel/9fc33e6f9fae10b9e372a3e06934d697edf5b024.1782829171.git.ralf@mandelbit.com/ - Remove unnecessary braces around single-statement if/else branches. drivers/net/ovpn/crypto.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/crypto.c b/drivers/net/ovpn/crypto.c index 90580e32052f..8cb7078a1d93 100644 --- a/drivers/net/ovpn/crypto.c +++ b/drivers/net/ovpn/crypto.c @@ -58,15 +58,19 @@ void ovpn_crypto_state_release(struct ovpn_crypto_state *cs) bool ovpn_crypto_kill_key(struct ovpn_crypto_state *cs, u8 key_id) { struct ovpn_crypto_key_slot *ks = NULL; + struct ovpn_crypto_key_slot *tmp; spin_lock_bh(&cs->lock); - if (rcu_access_pointer(cs->slots[0])->key_id == key_id) { + tmp = rcu_access_pointer(cs->slots[0]); + if (tmp && tmp->key_id == key_id) ks = rcu_replace_pointer(cs->slots[0], NULL, lockdep_is_held(&cs->lock)); - } else if (rcu_access_pointer(cs->slots[1])->key_id == key_id) { + else + tmp = rcu_access_pointer(cs->slots[1]); + + if (!ks && tmp && tmp->key_id == key_id) ks = rcu_replace_pointer(cs->slots[1], NULL, lockdep_is_held(&cs->lock)); - } spin_unlock_bh(&cs->lock); if (ks) From patchwork Mon Jul 6 11:34:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5095 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321280max; Mon, 6 Jul 2026 04:34:42 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ+DNmm6LbmFO/avYnjKKHzlqZE5VfBPAZGcWNxISN594d2okChaKczZVxNOV3rjTsQA//MLpc6WcO0=@openvpn.net X-Received: by 2002:a05:6808:1809:b0:491:177:c22d with SMTP id 5614622812f47-49fde4edae8mr38009b6e.36.1783337681850; Mon, 06 Jul 2026 04:34:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337681; cv=none; d=google.com; s=arc-20260327; b=mCT1vfiVSdMJsCXi0Qrck05IlEDqvT17hSh5G1YoutEJW/xCENqSp0VL8bgNF3SAk4 o2FTtdaESzvApeq4KpfzqMyA5vGQO6FFu0mhsZIyEvb6N0RY7YTb7JIz1cdXqlwYaUy+ BARUQdjFfu6RGFyYVhG0irwUKDEfMTegUgW8P5cht83l+8KnaRJ9G2JCbAYoWU2eZUdQ bsdFEr57o+UjQfP7L1PzTMy8PhaqldhQB+Mu26g6rj+M+JkBlDMudErOY/ugOq/8sQc7 fwBsFnPxDxrcIEsTfll8c0PZwpTxR1SqyIXnnP5QZ3X+IDioUhHcisO91fIaUK/BW+BC nc6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=snf86ACK7pR/66YC38aPi3X1DEvpWi3gjafw99J7Jq4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=fAkE1oWtV18oJCKR6Tt+mNWOJSZBUkOT+ftjiym1W7iLoK+QUcUmEgVuQBxQucD6R/ SfG9Uuth8c2jikVyhegI3wUVeiVgqpiUwwhAKv3SvvOeMcEl7RGDWjavJipatV4X/Xnf FU5mk7HM0q+/1slm/JwH+62+wO1cGgC97wYefh3J+O7qLoq+X7addgT4UpgcE1emcPnI s6ABSenJRhaPeafTD0hgu8x6ZHjMAR9gLKCDyOnlYxWXhcptLDDIZ9T1UeI+UNFNYoyx Erf9H08HOW/FF/WdBX5Wfy5DGwlg38qO/lG6xHW8sJRDIADSkmgmW3RffERE7N/UPO+K Fipw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=aiDRlPan; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="hljvTr/a"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fOofZ4zc; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Y5PqyC+n; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-497d1bff3c2si9219632b6e.72.2026.07.06.04.34.41 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:41 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=aiDRlPan; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="hljvTr/a"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fOofZ4zc; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Y5PqyC+n; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=snf86ACK7pR/66YC38aPi3X1DEvpWi3gjafw99J7Jq4=; b=aiDRlPanEB2sIxpKVLgTEp8OrU IJRfgDwEDu3Wr71MLsuV5cURoIQaHMis9ORaTedWJc0iqoIctcsgs2YLTr7h8zx0lu2N2gB3sd4N5 x0O4z9rgj2QWt6acFEkzjY6Dt5EdQUJBF9Ue6OMc1R+5bofWOgJcoi2+2w410c5umYDw=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghaz-0000Qf-4z; Mon, 06 Jul 2026 11:34:38 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghax-0000QR-4u for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=3ZkA9c6PszFdxD78qgW/7qFDfcs1CN1vNs0EKzltPtk=; b=hljvTr/a+qjpb5L+EGNjVHyQwK XEzfc3bO7Gm09o4QpJmXRDxFdpKtmD69/e0Xl7c23wpxF73FrPlg7yIfcf4A1YRIXFYqpU8ORnx3Q YXRdjE2A8ByWB5BodixJMxc03gxJoN4xELeKVsWN3E6E6ImIBF57wgjY55xKrtvd/6NE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=3ZkA9c6PszFdxD78qgW/7qFDfcs1CN1vNs0EKzltPtk=; b=fOofZ4zcwueEJEvG186rvwPi16 PuIp7McOmFV1PJru1TIw7zKWIkKzyxK9vpOQZl3wVR5qI8bZ2wVkSJhTud79ka93cotV6jNfW3bgV RIpJ+pHx7seGEfCHWJxP7b3KpW/kFVGRvcJix53NX9h7KA2QPMqJrrQgl7gY5UA/lhFM=; Received: from mout-b-112.mailbox.org ([195.10.208.42]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghar-0006lt-F1 for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:36 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-112.mailbox.org (Postfix) with ESMTPS id 4gv2M03kSlzDvmW; Mon, 6 Jul 2026 13:34:20 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337660; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3ZkA9c6PszFdxD78qgW/7qFDfcs1CN1vNs0EKzltPtk=; b=Y5PqyC+nhRhHUklfTbgKiGAHmWTG5gwjqaN/0UD3hSSzRQDxLQjdnH7e5N2pBZ0LkFIkZR r9kHxkM2Mzm1QyssqOOHLAdpZzGn1lJDjfAsDLUwbvSWCEXABptmnHVQNFbI4En18fxGDq A1KI+e2OM/+BlvHt4sAuYeJrI0USid7ASPwVSWFw4hB7SbugNgvxPb258nSYu/xFHKYIni 32tx5nxpp/XG6b4t7rmSV9MvqJaLDoU5peBoMaru+2LGv+kSe7AWAhkcuBaALPAKCy7eXp iC5yp6l1Er+SgZFWMM9FF0ZawgLNBEDPnmihINI336nNJ6y171bPb6Vd+bXC0g== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:34:00 +0200 Message-ID: <6e44855f0fcd704da43dd83b42a1236cb804c76e.1783336121.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4gv2M03kSlzDvmW X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Currently, in ovpn_nl_key_swap_notify, the OVPN_A_KEYCONF_KEY_ID attribute is packed as a 16-bit value despite being defined as a 32-bit u32 attribute in the YAML policy. Fix this inconsistency by using nla_put_u32. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghar-0006lt-F1 Subject: [Openvpn-devel] [PATCH ovpn net v5 2/6] ovpn: use nla_put_u32 for the key ID attribute in ovpn_nl_key_swap_notify X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965092953386530 X-GMAIL-MSGID: 1869965092953386530 Currently, in ovpn_nl_key_swap_notify, the OVPN_A_KEYCONF_KEY_ID attribute is packed as a 16-bit value despite being defined as a 32-bit u32 attribute in the YAML policy. Fix this inconsistency by using nla_put_u32. Fixes: 89d3c0e4612a ("ovpn: kill key and notify userspace in case of IV exhaustion") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca --- Changes since v4 of this series https://lore.kernel.org/openvpn-devel/981d2ea51cca45138210aa52c6e5a0e55c0da7a0.1783099626.git.ralf@mandelbit.com/ - Add this previously posted standalone fix to the series so the whole set can be picked in order. - No changes since v1 of the original single patch https://lore.kernel.org/openvpn-devel/8577555cc95646d0bd58a5b78e59c7e6a9b1a0c6.1783058844.git.ralf@mandelbit.com/ drivers/net/ovpn/netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 4c66c1ec497e..abf038206a62 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -1335,7 +1335,7 @@ int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id) if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id)) goto err_cancel_msg; - if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id)) + if (nla_put_u32(msg, OVPN_A_KEYCONF_KEY_ID, key_id)) goto err_cancel_msg; nla_nest_end(msg, k_attr); From patchwork Mon Jul 6 11:34:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5094 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321264max; Mon, 6 Jul 2026 04:34:41 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rq4GjXW2XFKqpf66+Cv6TcWvSVvBZPm2UP/lHpSpbkkiVLWbic49XopHGdNl5S6nXLO/hxrTOQZrJk=@openvpn.net X-Received: by 2002:a05:6870:f62a:b0:448:7e61:93a9 with SMTP id 586e51a60fabf-44d18347255mr4812288fac.23.1783337681116; Mon, 06 Jul 2026 04:34:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337681; cv=none; d=google.com; s=arc-20260327; b=VM3h65TDEXLcI7CgUHQYjzmlQqiGHLsMRQpc81nM2aTDq2owqdqi0lY6JIaswolQ5Z GBDl7gM7Yxe8vBPVmMhzGklkG7Z0Q+oIVr+ctY05qR2a5skFCie8MirLBEpsAq4/5bRS K3jKNIySx3gJfFjVVuOvvv6esAgFYhlXimHlv6w3bZjrSIGloJcUHthVX/2Ka0pXQwwW +dzEdIYRvDcC2NgvsRtEkuBp/XzmGAkrh1KZlOm7j2GCqhzq+Q1B4rio5hUJiVGXkacb zgL3vzJjIuGBwgweLWdsTn+OyfaWk6FI4uec1RjJZzAreY9T1DHks91St33HGrJzZdYi 5OYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=DloSsKR8VqCaWPSFvkUMpWgOs46pS1qoWzHAwe+2iA0=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=UtIACtDXwl6FPjLsxd6sxCgOczteU1hKzTOlReUpR8iSeSegfgYG39vlYjHtGpc+7k 2o27IZTOnHTwIBgWbvOz1DxI/uWZeSUrZXFgBcy3qw53u+V4GwUTnq6a4nIHv0vGDMSn t3qB39lPpApLVehjoVOqlN5ozKr25CdKladW+k8985syDN1VbKVTrHR6gJFajsf9PHrK 6K4ftq6jYcxU6MroA63kEJRYfKSiPogF95aqDWErba5WVFTOuTW8jA/ten+3hkecCBVj bpvSlkH3PiP/K9AyWP845pB8rqluftkq+8YtIugv++NnwFh3E6uem6JAifdLclDZwf/Q 5c6w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=RIppAwYd; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="BBI/RL2t"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ZRSSw2mO; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=boMrpmP8; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-44cfb6572absi8229085fac.86.2026.07.06.04.34.40 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:41 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=RIppAwYd; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="BBI/RL2t"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ZRSSw2mO; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=boMrpmP8; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DloSsKR8VqCaWPSFvkUMpWgOs46pS1qoWzHAwe+2iA0=; b=RIppAwYdF1pH7BZoZslph16Y8T UFeNeMocxBzXTOjJlB+uUou/94nZG9mnmr9XhP1eGzoKuuHFnEinl/H99EJrb34n1zmwCL/nthUGo weB17SyPsp0o+UL1g3WN0d55EBuBPrB13DJ8sLa5zf0WNjORjN8P3pIPTo+k1MRrtoxE=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghaw-0003K7-6v; Mon, 06 Jul 2026 11:34:38 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghau-0003Jy-17 for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=SN6qKq3nUv1NvP40f2gUOtp7ZmlmgEK8Y53JvCU9ukc=; b=BBI/RL2tPoKS2sjtDFyzjTX9td 4/MIsOK3/DEyDuMt0R+EtgXUtXUo409zFpqG7KhDdSbtmyG2lEY0OPSWjEwKUEm/EniDvr3Ty2pcT uVVUzetpLVE2LvgOcMcYSrM7iw5Dr0xWCoMcM1avxLJ5c5Sr0GrLxV4z9rAUHdV97R6A=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=SN6qKq3nUv1NvP40f2gUOtp7ZmlmgEK8Y53JvCU9ukc=; b=ZRSSw2mOCgY97ZGRvKAk3fIKif HJlyFd6VX2LB5QTqUTfJsixZxGkxwrg0DAAqWzglC1DElvN35n7JzwniZky2kM8hVC14MqSEN1O5j XHtxweolIT0Y1MeAgA696GgYQ29LTVexT1VAhkC3uFFBQt9WkAKZzT0glRqMsxX6zdUg=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghar-0006m0-OC for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:35 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [10.196.197.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4gv2M202grz9xlp; Mon, 6 Jul 2026 13:34:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337662; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SN6qKq3nUv1NvP40f2gUOtp7ZmlmgEK8Y53JvCU9ukc=; b=boMrpmP8Zi4NhoROntn1Ysak8gX5dVw9PGf7vuzZst5DxkwZQcSS67d1F6xELg8XhZ7K4J 1z6iAB1p7mKwl5uO6w5Lnsp4Gp6Ne7eY13uhLdAAH9oE9L8pkEm4H+9UYrHVcoz52NdAyk PI6f/q0ZkwAsbDw5MiW4zSA0DAQJGv0/qaiIOmmiontFluUWJfJ/3zSzs4GoZQcZtddssH ZlezvZPFRO5ECnxwVTepSvE70gOHm1DyFtY1oRgnGhgJ65+XQwypaFGeJBWCxLOoi1PXVK WEsKAE29sQ6LqxWv56SCYIHoYGiXh1YBUHyWr9VZog5XhAoWfRrr0OLSTz4XKQ== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:34:01 +0200 Message-ID: <8f7261c5719fd67b8f0da4d0e89f2c4517fa8168.1783336121.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn_tcp_init initializes the TCP proto and proto_ops templates used when a TCP socket is attached to an ovpn peer but ovpn_init registers the rtnl link ops and generic netlink family before initializ [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1wghar-0006m0-OC Subject: [Openvpn-devel] [PATCH ovpn net v5 3/6] ovpn: initialize TCP state before registering UAPI X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965092605358330 X-GMAIL-MSGID: 1869965092605358330 ovpn_tcp_init initializes the TCP proto and proto_ops templates used when a TCP socket is attached to an ovpn peer but ovpn_init registers the rtnl link ops and generic netlink family before initializing those templates. Once either interface is visible, userspace can create an ovpn device and configure a TCP socket while the TCP templates are still zero-initialized. Initialize the TCP templates before publishing the rtnl and netlink interfaces, so externally reachable setup paths can only observe initialized TCP state. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici --- New patch added in v5. drivers/net/ovpn/main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 9993c1dfe471..c2c3af0c3c55 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -233,8 +233,14 @@ static struct rtnl_link_ops ovpn_link_ops = { static int __init ovpn_init(void) { - int err = rtnl_link_register(&ovpn_link_ops); + int err; + /* initialize the TCP protos before the module is exposed through rtnl + * or netlink + */ + ovpn_tcp_init(); + + err = rtnl_link_register(&ovpn_link_ops); if (err) { pr_err("ovpn: can't register rtnl link ops: %d\n", err); return err; @@ -246,8 +252,6 @@ static int __init ovpn_init(void) goto unreg_rtnl; } - ovpn_tcp_init(); - return 0; unreg_rtnl: From patchwork Mon Jul 6 11:34:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5092 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321230max; Mon, 6 Jul 2026 04:34:39 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ8SuQNIDe4pmfQDDn5bfqahBA+t938qBbpoZbtcckcTkiEluxlTiwGNI28cWl02xWSuoGLixYkLITY=@openvpn.net X-Received: by 2002:a05:6830:3747:b0:7e9:b4d1:78ab with SMTP id 46e09a7af769-7eb7ff6ad32mr6093064a34.25.1783337679600; Mon, 06 Jul 2026 04:34:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337679; cv=none; d=google.com; s=arc-20260327; b=Kk7GwoU3Rq00+1RLo/EMRngwacu8UkMWfE1uB+itCJkSZunAUlUD6Feqik5M+bGST1 nuGWPnekyEfYWf38HpsNA3eD+4mQLlaAD6b6IsLJwWqBIa6POF2uHwRk8V0MjEVJ8zDZ du/fMnnUKw9Z2FwOQxr15klN8MRInlUAVjfBQ/8LF9qVtXEaS5qb0MEIH4JODQXj31ya 7CAX8Ka7Yb/kRk/zb3R44qfsefty3SWbjSUk6bP5irXZDshiCq3MVLCmCeM+yS5Hinlj zb8WZtGbwJ7+RKqaATspjSKuxrLhXu/nilWei8gpNTOvSLYXlxWL0wPQxjyZMXkoYFTt rTxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=dFzOe1HUqGwvYdoGKqVjJMY2/ZoZFRiv+Xl8WWtvN8E=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=XVW3tucYLWDpaxMsnul4wnAMADFgnrXGbMpxrLMrXJ976uQMTa3Dpv1uQ1Io/0x+JC OqgzpIEaj4TbiKJNLYRGnf0M1tC4WwBfxgg0X1IcYQeIuUkjXud1znijnE7wGkQPgZk4 ttCbwU/tdBAL0C2lS9gyTfsccX+Emqj0/7g+IbN2OtuLEw7tXer5x007EeATj3HCPWFY Estlf67lhX4eE53xJB5h3BzrXsEE1l6o9aktsjN1Vxn+OGA94zutb6WT1/9Y66rTd4lj XFXySPgFDDPT1mSPrW0jz4/DO5ST1DGIHlQV2QgA8j3ARjjm2RWAVdiVU9a9KcZKe/2x dqCA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=TsT704Vz; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Z4IrFuWK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Ca9lzq23; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=TGtVDTkK; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7eb5432c928si10445049a34.62.2026.07.06.04.34.39 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:39 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=TsT704Vz; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Z4IrFuWK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Ca9lzq23; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=TGtVDTkK; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=dFzOe1HUqGwvYdoGKqVjJMY2/ZoZFRiv+Xl8WWtvN8E=; b=TsT704VzxQ5e2KXh6ZgVqlTmzY twgzv5NGLeezBvUtuQ1RCTij2S9QT5jF08TXDsDMss5/PfG57c133jCQv6WNy0T82tVOsanXYVxAW 6ZkVqmf4OndIiGoplXgmDkgkJdgh4vZX4ks11yzhzzigcCjpUpiU25vkrFDDKkz610TQ=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghaw-0000QH-Ql; Mon, 06 Jul 2026 11:34:36 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghau-0000Q2-Dt for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=znaVAEp1GjJ5F9cr/8ySktkMRUAeu1VFMZA29PBiBEY=; b=Z4IrFuWKYRdApDwlihu61U+G4H 0YZOcfX1pdNprLg7lr3AsVPoZgkjaTdSDJeiLhZ2+E89abXNrSEXCyLtriU3VrKVRc0oDKSdaKL5Y N/ZNsYKFxmp7sxmaBJmbLsngzFdRKojlEFeYbYQVyRcggPoJshWQIOAGO/osEdbopdmE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=znaVAEp1GjJ5F9cr/8ySktkMRUAeu1VFMZA29PBiBEY=; b=Ca9lzq2304mMscNFPfXHT1PK9E E6ScXUS1OvgCdzkivHgRMQPXrl36a5doaauSnJ+TX3FgELG9mcHL5tg6EQN18Zcj5AztVY9xv8Q1M y7yCd20tPwIGQ7r56iGR9TW13JYVMoqkuzFHE9XitfrFTzbhg+zeWamxfw6pU47/mDKY=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghao-0006l0-Ob for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:33 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [10.196.197.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4gv2M32jHTz9y7m; Mon, 6 Jul 2026 13:34:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337663; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=znaVAEp1GjJ5F9cr/8ySktkMRUAeu1VFMZA29PBiBEY=; b=TGtVDTkKiHhW0vpqGQE9FyJuqqDLDUX1YPE/vEPzPHYPRB+tisnIqVjKY7sWiOt5+1qj7/ DvJE2/Lo6Mt3V3CS/vV+7QYYhFTUDNCPjvHG+jfNnCvif9gHPK0HEuydBblfz+VaZK6QeT lnbDa46NKdPM+zdS3FMNT4bd3LqFoRoUkM7+FaY6wZ6+sOjVUWPCg0lAwjtmhcv9V2tpMi 7/OLzORjsOtAJjZU63XIjrMdyHHjsg8Vi0d4BVp5G2HVpo0lzSvcWl9N6t2HimyYwqewQO 1tIsg1ArWb8JqEVQV5eZtZsftfW3ihfBnEKh6BzDmjBeOUDw3Zo5+/SSSD4MFA== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:34:02 +0200 Message-ID: <7336c4c945f4d8f816b57da2525c8f7b037cfa46.1783336121.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progr [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghao-0006l0-Ob Subject: [Openvpn-devel] [PATCH ovpn net v5 4/6] ovpn: finish crypto callback cleanup before peer release X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965090536567874 X-GMAIL-MSGID: 1869965090536567874 Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action. Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Ralf Lici --- No changes since v4 https://lore.kernel.org/openvpn-devel/981d2ea51cca45138210aa52c6e5a0e55c0da7a0.1783099626.git.ralf@mandelbit.com/ No changes since v3 https://lore.kernel.org/openvpn-devel/f367b736f2597edb1677794173997d5a0f9f599c.1783080055.git.ralf@mandelbit.com/ Changes since v2 https://lore.kernel.org/openvpn-devel/567de7a9371ce72b0632158799dd11bb543cae08.1783068961.git.ralf@mandelbit.com/ - Also free the remaining TX skb before dropping the peer reference, so crypto callbacks do not continue cleanup after peer release. drivers/net/ovpn/io.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index a6b777a9c2d9..e5f2775392d7 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -204,10 +204,10 @@ void ovpn_decrypt_post(void *data, int ret) ovpn_dev_dstats_rx_dropped(peer->ovpn->dev); kfree_skb(skb); drop_nocount: - if (likely(peer)) - ovpn_peer_put(peer); if (likely(ks)) ovpn_crypto_key_slot_put(ks); + if (likely(peer)) + ovpn_peer_put(peer); } /* RX path entry point: decrypt packet and forward it to the device */ @@ -302,11 +302,11 @@ void ovpn_encrypt_post(void *data, int ret) err: if (unlikely(skb)) ovpn_dev_dstats_tx_dropped(peer->ovpn->dev); - if (likely(peer)) - ovpn_peer_put(peer); + kfree_skb(skb); if (likely(ks)) ovpn_crypto_key_slot_put(ks); - kfree_skb(skb); + if (likely(peer)) + ovpn_peer_put(peer); } static bool ovpn_encrypt_one(struct ovpn_peer *peer, struct sk_buff *skb) From patchwork Mon Jul 6 11:34:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5093 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321257max; Mon, 6 Jul 2026 04:34:41 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rp4D0OrZ+wCjjGy21YkF6JayuskvssN75EmxtEBemt22Z6XW97ASSUGE9Fp4ZHCmMLw5r0wJ5ldCH0=@openvpn.net X-Received: by 2002:a05:6870:cb88:b0:43d:2e43:9e49 with SMTP id 586e51a60fabf-44d181521e8mr4884672fac.19.1783337680854; Mon, 06 Jul 2026 04:34:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337680; cv=none; d=google.com; s=arc-20260327; b=Jiaj5pFoUAW4lDF20fi/8d0gm/cY1Zi/RODKnFrn+cj3IYFteNuA6BgAs9y70bBL6Y 9RcGs0cP48lp9vXGUWqkksi/O2yuRpjAFSLu4IJ0uwcuFumKoBqGKFNQnJTGZVvj8p/q p/k4OgsB8ODh2odW5dSNoFf0q6A7kUKugKbfYX4kLEnO+lgInyKID47Yoo/cGLNJamrG 4cghAabZRGutR90mZAhmZvpe5WrbrwceB40eaDmTHbBeO2ef1JQqzmfXckMksfgvpymD rCr0VabRBqeXzKsgMhUIfgkepCRieFwQmW4eZIcHiEbgMS2Mo55Lq9ThaD+yMMZnPlku JNbg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=Iz9cSUrze07kmfKjdizFhKXXHOjXXG7k6B+mmBsozxU=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=rW/AnUv2cuR2f5F0VgZ/ahYDHdE7bdlBiPqXQCLVdvg4WbU+QDwTcaOR0CLD2A2Bor Nl/apAbtwJCaTc/zGJBNdVOuaHX7YaiagUrBpVnxQhoo1ZXVYIQUrKva46L4/rc2LD7y jk/aSLInZY7CTaNHCsxOFGfr/40S7zqGF9QJ2eVEaZ9EMjF8y4dZ8TTrulEXMVEFuFe9 CwYFFCyEjwoyk/bqSkSAJmTfUfd+lRzw2uCidH6txjNQ67UlQERJ5eWEovZV8c9ixcg1 GzUSMFZOAB4NF5rdxLerThi28BKS8IXSvdjRAO4PE3Yp++SW5Rys5szD9pkXouWUCey0 +roA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=ZFhswOT4; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=e+cEyqi8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Co9EiSJo; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=0S1Omcw1; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-44cfb6573a8si8377532fac.94.2026.07.06.04.34.40 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:40 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=ZFhswOT4; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=e+cEyqi8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Co9EiSJo; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=0S1Omcw1; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Iz9cSUrze07kmfKjdizFhKXXHOjXXG7k6B+mmBsozxU=; b=ZFhswOT4buA4u3VL/gKBYWwk0d 0Ek6dJd/Gtkl+wnZ374nk73LinCrr6+B1BEihqhv6/SHDFKp4pMiKQcO+6wfJ1tveHDghFngwCJ8J seTkn49dCHDSKEn4GQ+oj64OcihcHY//8H1SRPAjZOAsiUhZ9LopkBRjmaaj3C4yGGwI=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghau-000760-Na; Mon, 06 Jul 2026 11:34:37 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghas-00075t-Jl for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=I/IM/VXEJG9KlWBRsVE5e0A1T0rtTNLzXdNuW8PthK4=; b=e+cEyqi8UU9hB+io8dF7rwNTBG dWSF8jYi7X3B7oPmVm8griiHGognnwE55tSmPcgr/LpIT3hjFJVfgn/gWLUNCvFufcpURoTOphLmQ lCHDT/+JCgFPCIbBbVMgXP5Q8OxtMxX4qOEHYGfP0vBZnEngVZzMGXCRQBAlhMtBk3d8=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=I/IM/VXEJG9KlWBRsVE5e0A1T0rtTNLzXdNuW8PthK4=; b=Co9EiSJo1r2Fd2rlZdZFaa5dqG C8cr5tTc+pcIYfEIE8nr5iBcD2kAWrJJnYhIPkNEdd36b/Y/Js62/QLRpfwqg6SNHfSPZVshC5gdz jpchE5ysq3bN06xx6sVZ2+ngTjYKpzMjljlWPAxV3lqBIfxYwwGQNXsVfWQv9bOFlvk8=; Received: from mout-b-107.mailbox.org ([195.10.208.47]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghaq-0006lY-II for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:35 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4gv2M50nQpzDs4h; Mon, 6 Jul 2026 13:34:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337665; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I/IM/VXEJG9KlWBRsVE5e0A1T0rtTNLzXdNuW8PthK4=; b=0S1Omcw1sWpb9vEANO1721gm9v818QyJMt4KoECpCDqf04TWhM+WqRJGaiqW2USVcAfmJ6 6fSYwelSBeEf1DAV3laqdxmYSecyR+FZUCY9Kn7PWLEb59hXHClW4DwnjX++TU+0RyVpOV tWQ5sN8yHxciCC2C0W+uZq41Dv+4XNPQV13VcabUWvR9DsTwAnB9jdjlurlb0SEKuyozh+ E7UV2jqg3n1L8TJ7Xva6sNPV8UQLzBEmDtepua8gt9O4ycT5pZ7y+H/daEuzr8ACVRk0pg HB6iUDtinGZWORyvXcLLsH8LteOgF3eNRb5g8BXywQadi8NcToUDfd8elhGj5g== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:34:03 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4gv2M50nQpzDs4h X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callba [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghaq-0006lY-II Subject: [Openvpn-devel] [PATCH ovpn net v5 5/6] ovpn: run deferred work on a module-owned workqueue X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965091800197350 X-GMAIL-MSGID: 1869965091800197350 ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed. Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code. Add a module-owned workqueue and queue all ovpn work items on it. Destroy the workqueue during module exit, after unregistering the rtnl link ops and netlink family and before the final RCU barrier, so no ovpn work item can outlive the module text. The per-device delayed keepalive work remains explicitly disabled during netdev teardown (disable_delayed_work_sync in ndo_uninit), since destroy_workqueue does not flush delayed work that is still only pending on its timer. Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici --- Changes since v4 https://lore.kernel.org/openvpn-devel/6edfcc51e0855bfd34286b86d4e7f26bb3bcd3f7.1783099626.git.ralf@mandelbit.com/ - Rebase on the pending keepalive and TCP deferred-work refcount fixes, preserving their hold-before-queue and queue-failure put handling when converting schedule_work to queue_work. Changes since v3 https://lore.kernel.org/openvpn-devel/49f38f89340e18ed30543d3990a7a7e20595b6af.1783080055.git.ralf@mandelbit.com/ - Replace the RCU-deferred peer netdev reference release with a module-owned workqueue that drains all ovpn work callbacks before module text can be freed. drivers/net/ovpn/main.c | 17 ++++++++++++++++- drivers/net/ovpn/ovpnpriv.h | 4 ++++ drivers/net/ovpn/peer.c | 8 ++++---- drivers/net/ovpn/tcp.c | 9 ++++----- 4 files changed, 28 insertions(+), 10 deletions(-) diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index c2c3af0c3c55..0714a53133b7 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -26,6 +27,9 @@ #include "tcp.h" #include "udp.h" +/* module-owned workqueue on which all ovpn-specific work is queued */ +struct workqueue_struct *ovpn_wq; + static void ovpn_priv_free(struct net_device *net) { struct ovpn_priv *ovpn = netdev_priv(net); @@ -240,10 +244,16 @@ static int __init ovpn_init(void) */ ovpn_tcp_init(); + ovpn_wq = alloc_workqueue("ovpn", 0, 0); + if (!ovpn_wq) { + pr_err("ovpn: cannot allocate workqueue\n"); + return -ENOMEM; + } + err = rtnl_link_register(&ovpn_link_ops); if (err) { pr_err("ovpn: can't register rtnl link ops: %d\n", err); - return err; + goto destroy_wq; } err = ovpn_nl_register(); @@ -256,6 +266,9 @@ static int __init ovpn_init(void) unreg_rtnl: rtnl_link_unregister(&ovpn_link_ops); +destroy_wq: + destroy_workqueue(ovpn_wq); + ovpn_wq = NULL; return err; } @@ -263,6 +276,8 @@ static __exit void ovpn_cleanup(void) { ovpn_nl_unregister(); rtnl_link_unregister(&ovpn_link_ops); + destroy_workqueue(ovpn_wq); + ovpn_wq = NULL; rcu_barrier(); } diff --git a/drivers/net/ovpn/ovpnpriv.h b/drivers/net/ovpn/ovpnpriv.h index 5898f6adada7..84499140e4bd 100644 --- a/drivers/net/ovpn/ovpnpriv.h +++ b/drivers/net/ovpn/ovpnpriv.h @@ -15,6 +15,10 @@ #include #include +struct workqueue_struct; + +extern struct workqueue_struct *ovpn_wq; + /** * struct ovpn_peer_collection - container of peers for MultiPeer mode * @by_id: table of peers index by ID diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index 4e6cd2b69f57..29d03d96fd33 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -61,7 +61,7 @@ void ovpn_peer_keepalive_set(struct ovpn_peer *peer, u32 interval, u32 timeout) /* now that interval and timeout have been changed, kick * off the worker so that the next delay can be recomputed */ - mod_delayed_work(system_percpu_wq, &peer->ovpn->keepalive_work, 0); + mod_delayed_work(ovpn_wq, &peer->ovpn->keepalive_work, 0); } /** @@ -1287,7 +1287,7 @@ static time64_t ovpn_peer_keepalive_work_single(struct ovpn_peer *peer, peer->id); if (WARN_ON(!ovpn_peer_hold(peer))) return 0; - if (!schedule_work(&peer->keepalive_work)) + if (!queue_work(ovpn_wq, &peer->keepalive_work)) ovpn_peer_put(peer); } @@ -1379,8 +1379,8 @@ void ovpn_peer_keepalive_work(struct work_struct *work) netdev_dbg(ovpn->dev, "scheduling keepalive work: now=%llu next_run=%llu delta=%llu\n", next_run, now, next_run - now); - schedule_delayed_work(&ovpn->keepalive_work, - (next_run - now) * HZ); + queue_delayed_work(ovpn_wq, &ovpn->keepalive_work, + (next_run - now) * HZ); } unlock_ovpn(ovpn, &release_list); } diff --git a/drivers/net/ovpn/tcp.c b/drivers/net/ovpn/tcp.c index 0af14055c39a..8fe8a8e750a4 100644 --- a/drivers/net/ovpn/tcp.c +++ b/drivers/net/ovpn/tcp.c @@ -151,7 +151,7 @@ static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb) /* take reference for deferred peer deletion. should never fail */ if (WARN_ON(!ovpn_peer_hold(peer))) goto err_nopeer; - if (!schedule_work(&peer->tcp.defer_del_work)) + if (!queue_work(ovpn_wq, &peer->tcp.defer_del_work)) ovpn_peer_put(peer); ovpn_dev_dstats_rx_dropped(peer->ovpn->dev); err_nopeer: @@ -284,13 +284,12 @@ static void ovpn_tcp_send_sock(struct ovpn_peer *peer, struct sock *sk) * stream therefore we abort the connection */ ovpn_peer_hold(peer); - if (!schedule_work(&peer->tcp.defer_del_work)) + if (!queue_work(ovpn_wq, &peer->tcp.defer_del_work)) ovpn_peer_put(peer); /* we bail out immediately and keep tx_in_progress set * to true. This way we prevent more TX attempts - * which would lead to more invocations of - * schedule_work() + * which would lead to more invocations of queue_work() */ return; } @@ -487,7 +486,7 @@ static void ovpn_tcp_write_space(struct sock *sk) rcu_read_lock(); sock = rcu_dereference_sk_user_data(sk); if (likely(sock && sock->peer)) { - schedule_work(&sock->tcp_tx_work); + queue_work(ovpn_wq, &sock->tcp_tx_work); sock->peer->tcp.sk_cb.sk_write_space(sk); } rcu_read_unlock(); From patchwork Mon Jul 6 11:34:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5096 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1887:b0:869:83bc:8c48 with SMTP id r7csp5321324max; Mon, 6 Jul 2026 04:34:45 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ/2k14fBANX3Zrt8bxnVv2Ng6yCRiFxzvS3vqlBzxAB/ScwUPvke0iQahEYLa3wrfffG03I3KcEWv4=@openvpn.net X-Received: by 2002:a05:6830:910:b0:7e9:b4cf:d8c5 with SMTP id 46e09a7af769-7eb7ff9b672mr5889222a34.25.1783337685061; Mon, 06 Jul 2026 04:34:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783337685; cv=none; d=google.com; s=arc-20260327; b=Md7855hSpQ+aPxlY9lomKEpyXimfJeigI8QJjQEBsdgU8zvQP1Uxwdgtib7q07zwC5 YydD1NQ/NkpQsCQeSe1o+kat/0UWYNiOGNsy8QCuCgT9A6VhA7DfzVv4d5pbdxxEtmL8 rsrRBxbSlrceBR4IPGt+Rjmj0jxdol5kQBEisCqDrgJLCBKl8Nr4MNoAPrQxlaKlqMui 4kIifMU6Sah72fDw2OkcXAP0ZiUyoE7oj2voNtf0T0/0ZHYY556d/fix/mIhQee/I2Xq kAt8j8Yg29POCHiii5tt2LoGyHEdNAU11/2aVEelEi1m3iEKVMc2dxZXn3clrxTEhIYx bxDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=Vr6rl+LmZ+soSQCg7Unh/yNByW2H+B4ZoO85aiLS1EU=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=maPdmUf3ahhZcQ/eAA54gNYSWT4tr7ahS0YnhjfHsftzDvfyN0fwGQv2xNXB66yXmm ucbXrm6fGpqw6NMO/Dq0g+wRDfeseil/xMjhbvSBWWjAWSZ0ru23rcVfxT3OAbzNbTsK 8IE29aoCqxgVCRZt7DsQ8JynBMNyTspmrMCgKuDidMcywKlOPG1kkqcP076fjObdr0Ni ahvAu2mOoMWI1pkekSmQtygDIsS7SGEQ/Jg0/6Iy+TOUIN9NnRGN37v4+KwwyvIOCgty TXJUUMozhL/xD2kZRt0YMhLe6Yu8qbzQSv/NH/p1RRF8yce/vnKHx159/V7S4sr8IxTJ HNtQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IrnTUcvH; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=S8BdWFom; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=JVRv8Smr; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=bHI+6Ikd; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7eb542a1fcfsi10728659a34.7.2026.07.06.04.34.44 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2026 04:34:45 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IrnTUcvH; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=S8BdWFom; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=JVRv8Smr; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=bHI+6Ikd; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Vr6rl+LmZ+soSQCg7Unh/yNByW2H+B4ZoO85aiLS1EU=; b=IrnTUcvHMBIqRXXnN1GDct3o8W 5F+6I0bsdpytLW8QlJBIahYQpvvLRxnXcREiTtYFGu3CKN914lDNDTRivih50SDAhiALjuxIrk0Dl m96boo1ZmFmGzDcpl0X1kGloN4TPJt73mNPe1qoK1AStjE76CSgXa+IJqugqGng2MdHs=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wghaz-0001LJ-Jb; Mon, 06 Jul 2026 11:34:42 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wghay-0001L1-3p for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:40 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ucNxD8Y6eCJDQRSMs8zMnGBa91Gx19CryChV9K9cIFg=; b=S8BdWFomEdHrg7T4XUhnvQ/hwt gb6OlxsiLlqiX9KpdVgu12viDAVmEEGS2KFF8HStfG2qnj+XHM+41xplUAPrUYmCzoLMcArMIRUWs RFnj2rYFvgccVy9HuQFCIYWHAO23Q6Kd0f47nYKzTylMQFnaFb1oETx8aCVF4ZpgWzmk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ucNxD8Y6eCJDQRSMs8zMnGBa91Gx19CryChV9K9cIFg=; b=JVRv8SmrgJeDoUBxRpY1VZNQqV l26RHXnU3cY/YrRv90ShIAXerjc5NqbEQkGG5l6Dppo+Hg83eM452I4p/0p6p5k4CwmF84f3gB7a1 eEXspD6xYv6JEkf+krUzSk2cbu8UONJoqB4tlp47aQ+JaVYiTCNsE1gAa/0DosWUMKOU=; Received: from mout-b-206.mailbox.org ([195.10.208.51]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wghax-0006no-KP for openvpn-devel@lists.sourceforge.net; Mon, 06 Jul 2026 11:34:40 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-206.mailbox.org (Postfix) with ESMTPS id 4gv2M64zVDz9yFq; Mon, 6 Jul 2026 13:34:26 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1783337666; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ucNxD8Y6eCJDQRSMs8zMnGBa91Gx19CryChV9K9cIFg=; b=bHI+6Ikdx8pxNxH3BghhyHGCBn9JOv9i3I0hWOtcQ/AlOzcT7+6GxZXqEXdGt9Xjh9xxh9 rGMjMc0NyKu3pcEqKYPxtbGhCgy6uQiuluv6z50WOrggm9rJFH/El+O/HpPVY2wpI+gGE+ aJiauAOidvo9HJKeyqczQJ+sm/z1RhsWmEcDFDyq8S2L6VP29w6neGgVFypOJPzWioe/py Z31zt0X2iB/bUQ9WphKmd9ToBpLkAgXC2O+fWa7Ah3Qp7RVUDoKPtHw+oJYNj23cqCX6mp rZnRTwlfg7yxwrgeoUTD8ro/9L14HEMYkPAlMNu2ydJfHX73FYL6HHPJCwxuLg== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 6 Jul 2026 13:34:04 +0200 Message-ID: <5e4de5963ea48d7e7431e55192f0d6a5784c2a47.1783336121.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4gv2M64zVDz9yFq X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for exa [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wghax-0006no-KP Subject: [Openvpn-devel] [PATCH ovpn net v5 6/6] ovpn: defer key slot crypto freeing to workqueue X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869965096406866581 X-GMAIL-MSGID: 1869965096406866581 Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for example when an async or hardware implementation has teardown work to complete. The AEAD transforms are only used while a key-slot reference is held, so the final kref put is enough to prove that no transform user remains. Queue the final crypto teardown on the ovpn workqueue, where sleeping is allowed, and keep the slot memory itself RCU-freed after the transforms have been released. ovpn_crypto_config_get was the remaining lockless reader of transform state through ovpn_aead_crypto_alg. Make it take a key-slot reference before reading that state, so the transform lifetime is consistently tied to key-slot references. The previous patch drains ovpn_wq during module exit, so queued key-slot teardown work cannot outlive module text. Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Ralf Lici --- No changes since v4 https://lore.kernel.org/openvpn-devel/b53ae1a9714bae7081c71bdab7b30623ce3cb77b.1783099626.git.ralf@mandelbit.com/ Changes since v3 https://lore.kernel.org/openvpn-devel/ac2842c8e759849c51447126343376dcc793c7ae.1783080055.git.ralf@mandelbit.com/ - Reuse the module-owned ovpn workqueue instead of allocating a crypto-specific workqueue for key-slot teardown. Changes since v2 https://lore.kernel.org/openvpn-devel/b5dfebec718f230783ff47aa354c3b3fa1aa2ed7.1783068961.git.ralf@mandelbit.com/ - Reword the message to note the dependency on patch 1. Changes since v1 https://lore.kernel.org/openvpn-devel/350f6b48c363dde5a8d0bdf7a1b9fd2abb8b1034.1783057762.git.ralf@mandelbit.com/ - Fix a potential AEAD transform UAF in ovpn_crypto_config_get by holding a slot kref while reading the cipher algorithm. drivers/net/ovpn/crypto.c | 15 ++++----------- drivers/net/ovpn/crypto.h | 3 +++ drivers/net/ovpn/crypto_aead.c | 20 ++++++++++++++------ drivers/net/ovpn/crypto_aead.h | 1 - 4 files changed, 21 insertions(+), 18 deletions(-) diff --git a/drivers/net/ovpn/crypto.c b/drivers/net/ovpn/crypto.c index 8cb7078a1d93..63efbca64eab 100644 --- a/drivers/net/ovpn/crypto.c +++ b/drivers/net/ovpn/crypto.c @@ -18,20 +18,12 @@ #include "crypto_aead.h" #include "crypto.h" -static void ovpn_ks_destroy_rcu(struct rcu_head *head) -{ - struct ovpn_crypto_key_slot *ks; - - ks = container_of(head, struct ovpn_crypto_key_slot, rcu); - ovpn_aead_crypto_key_slot_destroy(ks); -} - void ovpn_crypto_key_slot_release(struct kref *kref) { struct ovpn_crypto_key_slot *ks; ks = container_of(kref, struct ovpn_crypto_key_slot, refcount); - call_rcu(&ks->rcu, ovpn_ks_destroy_rcu); + queue_work(ovpn_wq, &ks->free_work); } /* can only be invoked when all peer references have been dropped (i.e. RCU @@ -201,14 +193,15 @@ int ovpn_crypto_config_get(struct ovpn_crypto_state *cs, rcu_read_lock(); ks = rcu_dereference(cs->slots[idx]); - if (!ks) { + if (!ks || !ovpn_crypto_key_slot_hold(ks)) { rcu_read_unlock(); return -ENOENT; } + rcu_read_unlock(); keyconf->cipher_alg = ovpn_aead_crypto_alg(ks); keyconf->key_id = ks->key_id; - rcu_read_unlock(); + ovpn_crypto_key_slot_put(ks); return 0; } diff --git a/drivers/net/ovpn/crypto.h b/drivers/net/ovpn/crypto.h index 0e284fec3a75..85834bbd3ec9 100644 --- a/drivers/net/ovpn/crypto.h +++ b/drivers/net/ovpn/crypto.h @@ -10,6 +10,8 @@ #ifndef _NET_OVPN_OVPNCRYPTO_H_ #define _NET_OVPN_OVPNCRYPTO_H_ +#include + #include "pktid.h" #include "proto.h" @@ -45,6 +47,7 @@ struct ovpn_crypto_key_slot { struct ovpn_pktid_recv pid_recv ____cacheline_aligned_in_smp; struct ovpn_pktid_xmit pid_xmit ____cacheline_aligned_in_smp; + struct work_struct free_work; struct kref refcount; struct rcu_head rcu; }; diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 8f07c418622b..332975527734 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -9,6 +9,7 @@ #include #include +#include #include #include #include @@ -380,14 +381,19 @@ static struct crypto_aead *ovpn_aead_init(const char *title, return ERR_PTR(ret); } -void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks) +static void ovpn_aead_crypto_key_slot_free(struct ovpn_crypto_key_slot *ks) { - if (!ks) - return; - crypto_free_aead(ks->encrypt); crypto_free_aead(ks->decrypt); - kfree(ks); +} + +static void ovpn_aead_crypto_key_slot_free_work(struct work_struct *work) +{ + struct ovpn_crypto_key_slot *ks; + + ks = container_of(work, struct ovpn_crypto_key_slot, free_work); + ovpn_aead_crypto_key_slot_free(ks); + kfree_rcu(ks, rcu); } struct ovpn_crypto_key_slot * @@ -420,6 +426,7 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) ks->encrypt = NULL; ks->decrypt = NULL; + INIT_WORK(&ks->free_work, ovpn_aead_crypto_key_slot_free_work); kref_init(&ks->refcount); ks->key_id = kc->key_id; @@ -453,7 +460,8 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) return ks; destroy_ks: - ovpn_aead_crypto_key_slot_destroy(ks); + ovpn_aead_crypto_key_slot_free(ks); + kfree(ks); return ERR_PTR(ret); } diff --git a/drivers/net/ovpn/crypto_aead.h b/drivers/net/ovpn/crypto_aead.h index 65a2ff307898..fae3b585a43b 100644 --- a/drivers/net/ovpn/crypto_aead.h +++ b/drivers/net/ovpn/crypto_aead.h @@ -22,7 +22,6 @@ int ovpn_aead_decrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, struct ovpn_crypto_key_slot * ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc); -void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks); enum ovpn_cipher_alg ovpn_aead_crypto_alg(struct ovpn_crypto_key_slot *ks);