From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40140413231 for ; Mon, 20 Jul 2026 13:47:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555253; cv=none; b=lFZd9cCtSPy7H7SvR0RKjBRe+0xxv1tJp8gJuNCWqBb2mIkXcYkDA7BpHVoH7jP42Ekq+UeqENsmr5/2cDCuypqq/+Gpwlykh7D/UcaNNwp1HqFL3ECN/YCloxE9I9NfYjvo8P+LTcUhOVGUqbILCP2uoZBe0UE7N3mhypE6unY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555253; c=relaxed/simple; bh=4yntPrZ75aFgvK8fRFr1GoNSyySukRHtLsnky+C5c6s=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=U+VxI2zRJ45t04Z0J/7awtqiXtnrUFjfAjFyWISMjXggzcrdOKXx5q/GZShQXRwI4vbqyC9SYwUaQcl/rS5jWNEIL2ugna0RQUjfp0IOUem2hArr6+iHnbzPQ9aG9GKCPPPxK3UyjQ/hxCoxhRjpE+6hKLvAsz9rJEluDY/Y0tY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=BzYs/+vZ; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="BzYs/+vZ" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-495590dde14so15022515e9.0 for ; Mon, 20 Jul 2026 06:47:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1784555249; x=1785160049; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:organization :from:content-language:references:cc:to:subject:user-agent :mime-version:date:message-id:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0oaxpczoCU94fzTgvg4t1BTobNQ29rp5vCPHjPJ9yQw=; b=BzYs/+vZaGwQkp5INEgLsEK+x+Kyq1j3gpy5eh+IQXhI6Z6BmatdVL18pZ4E4GiQhv PlfuSVVmk6ZYaHQ+aENw04HeLg+WKywpn3Q9LaO3gnfoJQUSenJ9cjNgRdAXdUcId0jR Wn5gY+bxwgWM1IJAgIOFdA1Vm/9+Lpy75PMyItza+fCHNwKakpQcPdxpzaArhQJZiRcE aOqPMDdpExpA2DsHfkwucqn5L41GZvpEkXEaXza7RO3vPfM0yC52OlhvUFThvsWLMeCk cNTR2tUBH+cY/Qu6G4ORDqbcKBnaC9XHMBpvfkdkvyuaWQaMRmHtMZDAS0ET+xgPRkuN JDZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784555249; x=1785160049; h=content-transfer-encoding:content-type:in-reply-to:organization :from:content-language:references:cc:to:subject:user-agent :mime-version:date:message-id:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=0oaxpczoCU94fzTgvg4t1BTobNQ29rp5vCPHjPJ9yQw=; b=ClsS6GzqKIWko5s4MkD23DMBQ+pL2OJmI69JRHfsRHL0aht+45r5HNqbsOphrg7M+D RnvgFdKKhMU1MlSrB9Xj5xbSpMsJjqTWwUkHxajCMzfvxl0g3bfgnHf9eEVD3kv29FjD YdGKcNo0rnaTDtP9X5Y5k/ZVOaiFk++Dv+VSawOGaN/RaMpuwCMwlUEeeBXj4nhIkJhl A/zPvo+K/te66IXtAe4Qs9zi5cE0OJSzob4xoL84DuV1sbi6jYzjsRiHiVbQ7c1bc8V7 qCBpEODHuQ59GwEdEwCFmReorq7IyTwFAjzey7no5eidRNcwXOcqZaqCJIqHEDwgx/Y+ tJmQ== X-Forwarded-Encrypted: i=1; AHgh+RrZdtW1qzNGomcdwvqQz+QOGoqp12adxmT0+uO8uIiZfP4cy5gLXDbWkL8gDuoBBsVlMEeQQsdg/RmF9Ho=@vger.kernel.org X-Gm-Message-State: AOJu0YyyMOAjPOTzqx3Tt9KClL6EUm4nfnGqgbDsLUnsftZtqiZ6tu8j QyxiBMaK2IaO9YhiFYR2040DIWx7w5LaoBOTWc+dbvGQt+4ym69dDWKPxb4P902GQUriZanjobj OrCOkEI4G2JBAoRjr+d4IIyKFuyL7CmFbitfXuyZxCxM31JSU3gUlg/1eWYY= X-Gm-Gg: AfdE7cn+1v4EBAkcWceOu92mYxLbyOwKw9axfwOuebeh7kcKO6pAAVZVY2ntktB25cV 5qAcnBHs4HfloRZwgIxN3MqMwrmkWJyvAq4qGIA0XLQnYpPo4xb+nkRj3yU0p64kpx/XsQ7jWBR 3pSu9kqByT1pJmTNwY49zm6tYWKcRGwLP8tHK7sUzDaDbOFGPFAC2D6mQsz1p2wAFCRkhRE0YHd n3wQIuw7+9vKj3JAx08H6gx1+Yev9zAUyFNwtTEKrUt+QNZCev939KYIoLlnkPVw+F6EMuVNh80 rmNP8jgSd0GrPzra3cxOWpYRIflml3EEOM1O+XeTP5csSHBBW5iXETUtEdAq9B2vs+VPVc39hM8 sQ5Nk7kd5g9KKmGOHWj85uUFYPOclSquj1tRwty1LOv3CJBmBwNVXUXY10YdVAH7zX7OQc1EStX 2nD8IV5iFYIi/0eUlD0/JVlNJxejIkQ/AAYvaxdydWRp4QTUZNVb4= X-Received: by 2002:a05:600c:470a:b0:495:4e22:5eb8 with SMTP id 5b1f17b1804b1-4954e226f16mr141625995e9.38.1784555249162; Mon, 20 Jul 2026 06:47:29 -0700 (PDT) Received: from ?IPV6:2001:67c:2fbc:1:32cf:3416:35c6:c361? ([2001:67c:2fbc:1:32cf:3416:35c6:c361]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f63e496ffsm29626545f8f.3.2026.07.20.06.47.27 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 20 Jul 2026 06:47:28 -0700 (PDT) Message-ID: <524c6b9d-352c-4f84-bc8a-802dad97d909@openvpn.net> Date: Mon, 20 Jul 2026 15:47:26 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] ovpn: prevent UAF re-add to by_transp_addr on float-vs-delete race To: Ibrahim Hashimov , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Sabrina Dubroca , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Ralf Lici References: <20260708224631.1365-1-security@auditcode.ai> Content-Language: en-US From: Antonio Quartulli Organization: OpenVPN Inc. In-Reply-To: <20260708224631.1365-1-security@auditcode.ai> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi there, On 09/07/2026 00:46, Ibrahim Hashimov wrote: [...] > Fixes: f0281c1d3732 ("ovpn: add support for updating local or remote UDP endpoint") > Cc: stable@vger.kernel.org > Signed-off-by: Ibrahim Hashimov > Assisted-by: AuditCode-AI:2026.07 Sorry for the delay in getting back to you. We already have a fix for this bug that is queued for being sent to net. You can find it here: https://github.com/OpenVPN/ovpn-net-next/commit/beb427921aafd186eb139349bf04c6d54a4927f5 I was caught by Sashiko's fire and therefore had hard time sending all the fixes in my queue, but I am getting there. If you want, please check the patch at the link above. Thanks a lot. Best Regards, -- Antonio Quartulli OpenVPN Inc.