2024-10-29, 11:47:21 +0100, Antonio Quartulli wrote:
> +static int ovpn_udp4_output(struct ovpn_struct *ovpn, struct ovpn_bind *bind,
> + struct dst_cache *cache, struct sock *sk,
> + struct sk_buff *skb)
> +{
[...]
> + if (unlikely(!inet_confirm_addr(sock_net(sk), NULL, 0, fl.saddr,
> + RT_SCOPE_HOST))) {
> + /* we may end up here when the cached address is not usable
> + * anymore. In this case we reset address/cache and perform a
> + * new look up
> + */
> + fl.saddr = 0;
> + bind->local.ipv4.s_addr = 0;
Here we're updating bind->local without holding peer->lock, that's
inconsistent with ovpn_peer_update_local_endpoint.
> +static int ovpn_udp6_output(struct ovpn_struct *ovpn, struct ovpn_bind *bind,
> + struct dst_cache *cache, struct sock *sk,
> + struct sk_buff *skb)
> +{
[...]
> + if (unlikely(!ipv6_chk_addr(sock_net(sk), &fl.saddr, NULL, 0))) {
> + /* we may end up here when the cached address is not usable
> + * anymore. In this case we reset address/cache and perform a
> + * new look up
> + */
> + fl.saddr = in6addr_any;
> + bind->local.ipv6 = in6addr_any;
And here as well.
--
Sabrina
