[PATCH net 00/10] pull request: fixes for ovpn 2026-07-30

[Antonio Quartulli <antonio@openvpn.net>]

Hi all!

Here is a batch of ovpn fixes for net, collected and reviewed over the
past weeks (they went through a few rounds of sashiko pre-review on
openvpn-devel).

There are still larger fixes in our queue, so please ignore any
"previous issue" Sashiko may report on these.

Please pull or let me know of any issue!

Thanks a lot,
	Antonio


The following changes since commit 51b093a7ba27476e1f639455f005e8d2e75390e4:

  net: sxgbe: check descriptor ring allocation failures (2026-07-29 09:33:10 +0100)

are available in the Git repository at:

  https://github.com/OpenVPN/ovpn-net-next.git ovpn-net-20260730

for you to fetch changes up to 26ba17d845193dac4921ae1ab280d28d1938052e:

  ovpn: fix incorrect use of rcu_access_pointer() (2026-07-30 11:28:30 +0200)

----------------------------------------------------------------
Included fixes:
* use rcu_dereference_bh() instead of rcu_access_pointer() where the
  pointer is actually dereferenced
* ensure TCP global variables are initialized before they can be
  accessed via netlink (e.g. when attaching a TCP socket)
* actually disable IPv4 redirects on multipeer interfaces (the
  previous attempt was a no-op and did not survive netns moves)
* hash a floated peer by its transport identity only, consistently
  with the add and lookup paths
* zero the sockaddr padding before learning a floated endpoint so it
  does not leak into the by_transp_addr hash key
* ensure the socket is owned by ovpn before dereferencing
  sk_user_data
* rehash a peer in the by_transp_addr table when its remote endpoint
  is updated via CMD_PEER_SET
* avoid re-adding to the hashtables a peer that was concurrently
  removed (use-after-free)
* limit keepalive values to one day to avoid overflowing the
  delayed-work delay on 32-bit systems
* add the missing rtnl_link_ops->get_size callback so link messages
  account for the nested mode attribute

----------------------------------------------------------------
Antonio Quartulli (7):
      ovpn: skip rehash for peers already removed from by_id
      ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
      ovpn: ensure socket is owned by ovpn before deref sk_user_data
      ovpn: zero-initialize sockaddr before learning a floated endpoint
      ovpn: hash floated peer by transport identity only
      ovpn: disable IPv4 redirects on MP interfaces
      ovpn: ensure TCP vars are initialized first

Marco Baffo (1):
      ovpn: limit keepalive values to one day

Qingfang Deng (1):
      ovpn: fix incorrect use of rcu_access_pointer()

Ralf Lici (1):
      ovpn: add missing rtnl_link_ops->get_size callback

 Documentation/netlink/specs/ovpn.yaml |   4 +
 drivers/net/ovpn/main.c               |  64 +++++++++----
 drivers/net/ovpn/netlink-gen.c        |  20 ++--
 drivers/net/ovpn/netlink.c            |   6 ++
 drivers/net/ovpn/peer.c               | 172 +++++++++++++++++++++++++---------
 drivers/net/ovpn/peer.h               |   1 +
 drivers/net/ovpn/socket.c             |   9 ++
 7 files changed, 208 insertions(+), 68 deletions(-)