[PATCH net 0/5] pull request: fixes for ovpn 2026-05-14

[Antonio Quartulli <antonio@openvpn.net>]

Hello netdev team,

This batch includes a few fixes for net. Specifically:

Patch 1 fixes the remaining of the selftests in order to avoid
TCP failures on slow kernels, where pings cannot be always
delivered on time.

Patch 2 fixes a RCU deref outside of the RCU read critical area.

Patch 3 fixes a potential UAF in case of a TCP peer that fails
to be added to the hash table, while being fully initialized.
In this scenario, potentially ongoing TCP socket syscalls would
attempt accessing a free'd peer.

Patch 4 fixes a race condition betwen interface teardown and a
new peer being added via netlink. The race condition would lead
to the "ghost peer" endlessly holding the netdev while the core
is waiting for it to be released.

Patch 5 fixes dev dstats updates by ensuring they are always
performed with BH disabled, to avoid concurrent updates on the
same CPU.

Please pull or let me know of any issue.

Thanks a lot,
	Antonio


The following changes since commit 93d809adc13001e9d3a3ceb8d1e60fae2fb740d6:

  Merge branch 'vsock-virtio-fix-vsockmon-tap-skb-construction' (2026-05-12 12:52:18 +0200)

are available in the Git repository at:

  https://github.com/OpenVPN/ovpn-net-next.git tags/ovpn-net-20260514

for you to fetch changes up to 0c0dddc07d272a8d25922e48041e8e4d2434df7e:

  ovpn: disable BHs when updating device stats (2026-05-15 00:43:55 +0200)

----------------------------------------------------------------
Included fixes:
* fix TCP selftest failures by reducing number of attempted pings
* fix RCU ptr deref outside of RCU read section
* fix UAF in case of TCP peer failed to be added to hashtable
* fix race condition between iface teardown and new peer being added
* ensure dstats are updated with BH disabled to avoid concurrency

----------------------------------------------------------------
Antonio Quartulli (1):
      ovpn: fix race between deleting interface and adding new peer

David Carlier (2):
      ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
      ovpn: respect peer refcount in CMD_NEW_PEER error path

Ralf Lici (2):
      selftests: ovpn: reduce remaining ping flood counts
      ovpn: disable BHs when updating device stats

 drivers/net/ovpn/io.c                              | 12 +++++------
 drivers/net/ovpn/main.c                            | 12 ++---------
 drivers/net/ovpn/netlink.c                         |  8 +++++---
 drivers/net/ovpn/peer.c                            | 23 ++++++++++++++++++----
 drivers/net/ovpn/peer.h                            |  1 -
 drivers/net/ovpn/stats.h                           | 16 +++++++++++++++
 drivers/net/ovpn/tcp.c                             | 19 +++++++++++-------
 drivers/net/ovpn/udp.c                             |  2 +-
 .../selftests/net/ovpn/test-close-socket.sh        |  2 +-
 tools/testing/selftests/net/ovpn/test-mark.sh      |  6 +++---
 tools/testing/selftests/net/ovpn/test.sh           |  4 ++--
 11 files changed, 67 insertions(+), 38 deletions(-)