[PATCH net 0/2] ovpn: fix peer float use-after-free and key slot NULL deref

[Junrui Luo via B4 Relay]

Two independent fixes for the ovpn driver, both in lifetime handling:
one for a crypto key slot that can legitimately be empty, one for a peer
that can be re-linked into a hash table after it has been removed.

Patch 1 fixes a NULL dereference in ovpn_crypto_kill_key(). It locates
the slot holding a given key ID by reading both cs->slots[] entries and
comparing ->key_id, without checking either pointer first. An empty slot
is a normal state: the ordinary rekey sequence - install into the
secondary slot, swap, delete the retired one - leaves primary_idx at 1
with slots[0] empty, and key_id sits at offset 0, so the first
comparison faults on a read of address 0.

Patch 2 fixes a use-after-free in the peer float path.
ovpn_peer_endpoints_update() releases peer->lock to send the float
notification, then re-acquires ovpn->lock and re-links the peer into
by_transp_addr unconditionally - even if ovpn_peer_remove() unlinked it
while the lock was not held. The teardown path never unlinks hash nodes
again, so the peer ends up freed while still on the chain, and every
later datagram walks it in ovpn_peer_get_by_transp_addr(). Reproduced
under KASAN on 7.0-rc3; the splat is included in the patch.

The two patches are independent and touch different files; they can be
applied in either order.

Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
Junrui Luo (2):
      ovpn: don't deref NULL key slot in ovpn_crypto_kill_key()
      ovpn: don't re-hash a removed peer on float

 drivers/net/ovpn/crypto.c | 6 ++++--
 drivers/net/ovpn/peer.c   | 7 ++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)
---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260805-ovpn-fixes-52c198458a2a

Best regards,
-- 
Junrui Luo <moonafterrain@xxxxxxxxxxx>