Version in base suite: 0.0+git20241121-1 Base version: openvpn-dco-dkms_0.0+git20241121-1 Target version: openvpn-dco-dkms_0.0+git20241121-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/o/openvpn-dco-dkms/openvpn-dco-dkms_0.0+git20241121-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/o/openvpn-dco-dkms/openvpn-dco-dkms_0.0+git20241121-1+deb13u1.dsc changelog | 8 + gbp.conf | 3 patches/avoid-UAF-when-releasing-peer.patch | 35 ++++++++ patches/serialize-peer-NAPI-add-delete.patch | 109 +++++++++++++++++++++++++++ patches/series | 2 5 files changed, 157 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp89bdqv5k/openvpn-dco-dkms_0.0+git20241121-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp89bdqv5k/openvpn-dco-dkms_0.0+git20241121-1+deb13u1.dsc: no acceptable signature found diff -Nru openvpn-dco-dkms-0.0+git20241121/debian/changelog openvpn-dco-dkms-0.0+git20241121/debian/changelog --- openvpn-dco-dkms-0.0+git20241121/debian/changelog 2024-12-08 13:37:32.000000000 +0000 +++ openvpn-dco-dkms-0.0+git20241121/debian/changelog 2026-06-23 21:58:52.000000000 +0000 @@ -1,3 +1,11 @@ +openvpn-dco-dkms (0.0+git20241121-1+deb13u1) trixie; urgency=medium + + * Add debian/gbp.conf for debian/trixie branch + * Cherry-Pick upstream patches to fix NULL deref in ovpn_netlink_notify_del_peer + (Closes: #1140548) + + -- Bernhard Schmidt Tue, 23 Jun 2026 23:58:52 +0200 + openvpn-dco-dkms (0.0+git20241121-1) unstable; urgency=medium * New upstream version 0.0+git20241121 diff -Nru openvpn-dco-dkms-0.0+git20241121/debian/gbp.conf openvpn-dco-dkms-0.0+git20241121/debian/gbp.conf --- openvpn-dco-dkms-0.0+git20241121/debian/gbp.conf 1970-01-01 00:00:00.000000000 +0000 +++ openvpn-dco-dkms-0.0+git20241121/debian/gbp.conf 2026-06-23 21:58:52.000000000 +0000 @@ -0,0 +1,3 @@ +[DEFAULT] +debian-branch = debian/trixie + diff -Nru openvpn-dco-dkms-0.0+git20241121/debian/patches/avoid-UAF-when-releasing-peer.patch openvpn-dco-dkms-0.0+git20241121/debian/patches/avoid-UAF-when-releasing-peer.patch --- openvpn-dco-dkms-0.0+git20241121/debian/patches/avoid-UAF-when-releasing-peer.patch 1970-01-01 00:00:00.000000000 +0000 +++ openvpn-dco-dkms-0.0+git20241121/debian/patches/avoid-UAF-when-releasing-peer.patch 2026-06-23 21:58:52.000000000 +0000 @@ -0,0 +1,35 @@ +From f74c59a7e2c8b63958f556df74a585d54e2ac660 Mon Sep 17 00:00:00 2001 +From: Antonio Quartulli +Date: Thu, 14 May 2026 11:56:21 +0200 +Subject: [PATCH] ovpn-dco: avoid UAF when releasing peer + +ovpn_peer_release() schedules a RCU callback which actually +frees the peer object. + +Since we are not in an RCU read critical section, the callback +may get scheduled any time, therefore the peer should not be +accessed after having invoked ovpn_peer_release(). + +Move the call to ovpn_netlink_notify_del_peer() after the +invokation of ovpn_peer_release() and avoid a use-after-free. + +Reported-by: Ralf Lici +Signed-off-by: Antonio Quartulli +--- + drivers/net/ovpn-dco/peer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ovpn-dco/peer.c b/drivers/net/ovpn-dco/peer.c +index 4a5d41e..167fa62 100644 +--- a/drivers/net/ovpn-dco/peer.c ++++ b/drivers/net/ovpn-dco/peer.c +@@ -237,8 +237,8 @@ static void ovpn_peer_delete_work(struct work_struct *work) + { + struct ovpn_peer *peer = container_of(work, struct ovpn_peer, + delete_work); +- ovpn_peer_release(peer); + ovpn_netlink_notify_del_peer(peer); ++ ovpn_peer_release(peer); + } + + /* Use with kref_put calls, when releasing refcount diff -Nru openvpn-dco-dkms-0.0+git20241121/debian/patches/serialize-peer-NAPI-add-delete.patch openvpn-dco-dkms-0.0+git20241121/debian/patches/serialize-peer-NAPI-add-delete.patch --- openvpn-dco-dkms-0.0+git20241121/debian/patches/serialize-peer-NAPI-add-delete.patch 1970-01-01 00:00:00.000000000 +0000 +++ openvpn-dco-dkms-0.0+git20241121/debian/patches/serialize-peer-NAPI-add-delete.patch 2026-06-23 21:58:52.000000000 +0000 @@ -0,0 +1,109 @@ +From ef379eae8534a7bc4847d8545573b00c5f4887ae Mon Sep 17 00:00:00 2001 +From: Ralf Lici +Date: Thu, 14 May 2026 12:45:17 +0200 +Subject: [PATCH] ovpn-dco: serialize peer NAPI add/delete + +ovpn-dco creates one NAPI instance per peer and registers it against the +ovpn netdev when the peer is created. The NAPI instance is later removed +when the peer is released. + +On older kernels, netif_napi_add* and netif_napi_del do not serialize +updates to the netdev napi_list internally. Peer creation happens from +the netlink path, while peer release may happen asynchronously from the +event workqueue, therefore concurrent peer add/delete can corrupt the +shared netdev NAPI list. + +Serialize the per-peer NAPI registration and unregistration with a mutex +in the ovpn instance. + +Signed-off-by: Ralf Lici +Signed-off-by: Antonio Quartulli +--- + drivers/net/ovpn-dco/ovpn.c | 1 + + drivers/net/ovpn-dco/ovpnstruct.h | 4 ++++ + drivers/net/ovpn-dco/peer.c | 24 +++++++++++++++++++----- + 3 files changed, 24 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ovpn-dco/ovpn.c b/drivers/net/ovpn-dco/ovpn.c +index 82e9f94..0961c59 100644 +--- a/drivers/net/ovpn-dco/ovpn.c ++++ b/drivers/net/ovpn-dco/ovpn.c +@@ -66,6 +66,7 @@ int ovpn_struct_init(struct net_device *dev) + + spin_lock_init(&ovpn->lock); + spin_lock_init(&ovpn->peers.lock); ++ mutex_init(&ovpn->napi_lock); + + ovpn->crypto_wq = alloc_workqueue("ovpn-crypto-wq-%s", + WQ_CPU_INTENSIVE | WQ_MEM_RECLAIM, 0, +diff --git a/drivers/net/ovpn-dco/ovpnstruct.h b/drivers/net/ovpn-dco/ovpnstruct.h +index 98f0953..bcedf8b 100644 +--- a/drivers/net/ovpn-dco/ovpnstruct.h ++++ b/drivers/net/ovpn-dco/ovpnstruct.h +@@ -13,6 +13,7 @@ + #include "peer.h" + + #include ++#include + #include + #include + +@@ -27,6 +28,9 @@ struct ovpn_struct { + /* protect writing to the ovpn_struct object */ + spinlock_t lock; + ++ /* protect NAPI add/delete operations */ ++ struct mutex napi_lock; ++ + /* workqueue used to schedule crypto work that may sleep */ + struct workqueue_struct *crypto_wq; + /* workqueue used to schedule generic event that may sleep or that need +diff --git a/drivers/net/ovpn-dco/peer.c b/drivers/net/ovpn-dco/peer.c +index 167fa62..14a5454 100644 +--- a/drivers/net/ovpn-dco/peer.c ++++ b/drivers/net/ovpn-dco/peer.c +@@ -36,6 +36,23 @@ static void ovpn_peer_expire(struct timer_list *t) + ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_EXPIRED); + } + ++static void ovpn_peer_napi_add(struct ovpn_peer *peer) ++{ ++ mutex_lock(&peer->ovpn->napi_lock); ++ netif_napi_add_tx_weight(peer->ovpn->dev, &peer->napi, ovpn_napi_poll, ++ NAPI_POLL_WEIGHT); ++ napi_enable(&peer->napi); ++ mutex_unlock(&peer->ovpn->napi_lock); ++} ++ ++static void ovpn_peer_napi_del(struct ovpn_peer *peer) ++{ ++ mutex_lock(&peer->ovpn->napi_lock); ++ napi_disable(&peer->napi); ++ netif_napi_del(&peer->napi); ++ mutex_unlock(&peer->ovpn->napi_lock); ++} ++ + /* Construct a new peer */ + static struct ovpn_peer *ovpn_peer_create(struct ovpn_struct *ovpn, u32 id) + { +@@ -89,9 +106,7 @@ static struct ovpn_peer *ovpn_peer_create(struct ovpn_struct *ovpn, u32 id) + } + + /* configure and start NAPI */ +- netif_napi_add_tx_weight(ovpn->dev, &peer->napi, ovpn_napi_poll, +- NAPI_POLL_WEIGHT); +- napi_enable(&peer->napi); ++ ovpn_peer_napi_add(peer); + + dev_hold(ovpn->dev); + +@@ -224,8 +239,7 @@ static void ovpn_peer_release_rcu(struct rcu_head *head) + + void ovpn_peer_release(struct ovpn_peer *peer) + { +- napi_disable(&peer->napi); +- netif_napi_del(&peer->napi); ++ ovpn_peer_napi_del(peer); + + if (peer->sock) + ovpn_socket_put(peer->sock); diff -Nru openvpn-dco-dkms-0.0+git20241121/debian/patches/series openvpn-dco-dkms-0.0+git20241121/debian/patches/series --- openvpn-dco-dkms-0.0+git20241121/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ openvpn-dco-dkms-0.0+git20241121/debian/patches/series 2026-06-23 21:58:52.000000000 +0000 @@ -0,0 +1,2 @@ +avoid-UAF-when-releasing-peer.patch +serialize-peer-NAPI-add-delete.patch