netdev - Re: [PATCH net-next v19 00/26] Introducing OpenVPN Data Channel Offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ccd4c233-e065-456d-8275-ffcca402583d@openvpn.net>
Date: Fri, 14 Feb 2025 15:00:31 +0100
From: Antonio Quartulli <antonio@...nvpn.net>
To: Sabrina Dubroca <sd@...asysnail.net>
Cc: netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Donald Hunter <donald.hunter@...il.com>, Shuah Khan <shuah@...nel.org>,
 ryazanov.s.a@...il.com, Andrew Lunn <andrew+netdev@...n.ch>,
 Simon Horman <horms@...nel.org>, linux-kernel@...r.kernel.org,
 linux-kselftest@...r.kernel.org, Xiao Liang <shaw.leon@...il.com>,
 steffen.klassert@...unet.com, antony.antony@...unet.com,
 willemdebruijn.kernel@...il.com, David Ahern <dsahern@...nel.org>,
 Andrew Lunn <andrew@...n.ch>, Shuah Khan <skhan@...uxfoundation.org>,
 Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH net-next v19 00/26] Introducing OpenVPN Data Channel
 Offload

On 14/02/2025 14:54, Antonio Quartulli wrote:
> For example in wireguard/device.c the socket is released in 
> pernet_operations.pre_exit().
> 
> But pre_exit() is invoked in cleanup_net(), which is invoked ONLY if the 
> net refcount has reached 0...but how can it be zero before the sockets 
> have been released?
> 
> I must be missing something, because this seems to be a reference loop.

FTR, the answer is that sockets created in-kernel (like for wireguard) 
have sk->sk_ref_cnt set to 0, which implies that no reference to the 
netns is taken.

So ovpn has this issue because our sockets are coming from userspace.

Regards,

-- 
Antonio Quartulli
OpenVPN Inc.