[PATCH net 0/4] pull request: fixes for ovpn 2026-08-07

[Antonio Quartulli <antonio@openvpn.net>]

Hi all!

This batch collects four ovpn fixes for net that I considered critical
enough. Anything else has been postponed to after the release (or will
directly go to net-next).

All patches in this set are from Ralf, addressing key-slot and workqueue
lifetime issues:
* a NULL dereference when killing a key that is not installed on the
  peer;
* crypto completion callbacks that could continue their cleanup after;
  releasing the peer reference gating netdev and module teardown;
* deferred work running on the global workqueues with no driver-owned
  drain point at module exit;
* AEAD transforms being freed from an RCU callback even though
  crypto_free_aead() may sleep.

The series went through six rounds of sashiko pre-review on
openvpn-devel and should now be sashiko-free[tm].

Sashiko will still report pre-existing issues, but like I said above,
they are not critical and will be addressed later.


Please pull or let me know of any issue!

Thanks a lot,
	Antonio

The following changes since commit 594d905195024b228c962627ae5ae7c17bd582a4:

  af_unix: Unlink scc_entry in unix_del_edge(). (2026-08-06 11:52:48 -0700)

are available in the Git repository at:

  https://github.com/OpenVPN/ovpn-net-next.git ovpn-net-20260807

for you to fetch changes up to ab0fa79efbc496817d877470be507c21462142c1:

  ovpn: defer key slot crypto freeing to workqueue (2026-08-07 02:12:13 +0200)

----------------------------------------------------------------
Included fixes:
* release key slot crypto transforms from a workqueue rather than an RCU
  callback, because crypto_free_aead() may sleep with async or hardware
  implementations
* run all deferred ovpn work on a module-owned workqueue and drain it on
  module exit, so no work item can still be executing module text after
  the module is unloaded
* finish crypto callback cleanup (key slot release and leftover skb)
  before dropping the peer reference that gates netdev unregistration
  and module removal
* avoid dereferencing a NULL key slot when userspace asks to kill a key
  that is not installed on the peer

----------------------------------------------------------------
Ralf Lici (4):
      ovpn: fix NULL dereference when killing missing key
      ovpn: finish crypto callback cleanup before peer release
      ovpn: run deferred work on a module-owned workqueue
      ovpn: defer key slot crypto freeing to workqueue

 drivers/net/ovpn/crypto.c      | 26 +++++++++++---------------
 drivers/net/ovpn/crypto.h      |  4 +++-
 drivers/net/ovpn/crypto_aead.c | 19 ++++++++++++++-----
 drivers/net/ovpn/crypto_aead.h |  1 -
 drivers/net/ovpn/io.c          | 10 +++++-----
 drivers/net/ovpn/main.c        | 19 ++++++++++++++++++-
 drivers/net/ovpn/ovpnpriv.h    |  4 ++++
 drivers/net/ovpn/peer.c        |  8 ++++----
 drivers/net/ovpn/tcp.c         |  9 ++++-----
 9 files changed, 63 insertions(+), 37 deletions(-)