kernel NULL pointer dereference in ovpn_socket_release() #1
Description
P2P tun instance (so no --server, just --tls-server) exiting, server crashed
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: dco_do_read
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: ovpn-dco: received CMD_PEER_DEL_NTF, ifindex: 43704, peer-id 10957750, reason: 2
May 3 18:45:41 ubuntu2004 systemd-networkd[772]: tun11: Lost carrier
May 3 18:45:41 ubuntu2004 kernel: [26633494.422286] tun11: deleting peer with id 10957750, reason 2
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: process_incoming_dco: received peer expired notification of for peer-id 10957750
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: [freebsd-14-amd64] Inactivity timeout (--ping-restart), restarting
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: register signal: SIGUSR1 (ping-restart)
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: Sent warning SSL alert: close notify
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: TCP/UDP: Closing socket
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: Closing ovpn-dco interface
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: net_addr_v4_del: 10.220.11.1 dev tun11
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: sitnl_send: checking for received messages
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: sitnl_send: rtnl: received 36 bytes
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: net_addr_v6_del: fd00:abcd:220:11::1/64 dev tun11
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: sitnl_send: checking for received messages
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: sitnl_send: rtnl: received 36 bytes
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: close_tun_dco
May 3 18:45:41 ubuntu2004 tun-udp-p2p-tls-sha256[151971]: net_iface_del: delete tun11
May 3 18:45:41 ubuntu2004 kernel: [26633494.438282] BUG: kernel NULL pointer dereference, address: 0000000000000219
May 3 18:45:41 ubuntu2004 kernel: [26633494.444177] #PF: supervisor read access in kernel mode
May 3 18:45:41 ubuntu2004 kernel: [26633494.449143] #PF: error_code(0x0000) - not-present page
May 3 18:45:41 ubuntu2004 kernel: [26633494.454052] PGD 0 P4D 0
May 3 18:45:41 ubuntu2004 kernel: [26633494.458700] Oops: 0000 [#1] SMP PTI
May 3 18:45:41 ubuntu2004 kernel: [26633494.463255] CPU: 1 PID: 158060 Comm: kworker/1:1 Tainted: G OE 5.4.0-187-generic #207-Ubuntu
May 3 18:45:41 ubuntu2004 kernel: [26633494.472418] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
May 3 18:45:41 ubuntu2004 kernel: [26633494.482108] Workqueue: events ovpn_peer_keepalive_work [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.486820] RIP: 0010:ovpn_socket_release+0x9b/0x150 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.491483] Code: 48 8b 78 18 0f b6 87 19 02 00 00 3c 11 74 5e 3c 06 0f 84 9e 00 00 00 e8 c3 2d 9d df e8 de 4f 20 df 49 8b 44 24 08 48 8b 40 18 <0f> b6 80 19 02 00 00 3c 11 74 11 3c 06 74 47 4c 89 e7 e8 5e 80 38
May 3 18:45:41 ubuntu2004 kernel: [26633494.505696] RSP: 0018:ffffaf41c6693dd8 EFLAGS: 00010246
May 3 18:45:41 ubuntu2004 kernel: [26633494.510419] RAX: 0000000000000000 RBX: ffff972ffacfd000 RCX: 0000000000000000
May 3 18:45:41 ubuntu2004 kernel: [26633494.515186] RDX: ffffaf41c6693db0 RSI: 0000000055555554 RDI: ffffaf41c6693da8
May 3 18:45:41 ubuntu2004 kernel: [26633494.519926] RBP: ffffaf41c6693de8 R08: 000000000000039e R09: 000000000002ff00
May 3 18:45:41 ubuntu2004 kernel: [26633494.524613] R10: 0000000000000400 R11: 000000000000010d R12: ffff972f82b9fb40
May 3 18:45:41 ubuntu2004 kernel: [26633494.529261] R13: ffff972fb0ff38c0 R14: ffffaf41c6693e28 R15: 0000000000000000
May 3 18:45:41 ubuntu2004 kernel: [26633494.533902] FS: 0000000000000000(0000) GS:ffff972ffdd00000(0000) knlGS:0000000000000000
May 3 18:45:41 ubuntu2004 kernel: [26633494.538554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
May 3 18:45:41 ubuntu2004 kernel: [26633494.543179] CR2: 0000000000000219 CR3: 0000000013bac005 CR4: 00000000000606e0
May 3 18:45:41 ubuntu2004 kernel: [26633494.547883] Call Trace:
May 3 18:45:41 ubuntu2004 kernel: [26633494.552400] ? show_regs.cold+0x1a/0x1f
May 3 18:45:41 ubuntu2004 kernel: [26633494.556877] ? __die+0x90/0xd9
May 3 18:45:41 ubuntu2004 kernel: [26633494.561265] ? no_context+0x196/0x380
May 3 18:45:41 ubuntu2004 kernel: [26633494.565595] ? __switch_to_asm+0x5a/0x80
May 3 18:45:41 ubuntu2004 kernel: [26633494.569844] ? __bad_area_nosemaphore+0x50/0x1a0
May 3 18:45:41 ubuntu2004 kernel: [26633494.574063] ? bad_area_nosemaphore+0x16/0x20
May 3 18:45:41 ubuntu2004 kernel: [26633494.578205] ? do_user_addr_fault+0x267/0x450
May 3 18:45:41 ubuntu2004 kernel: [26633494.582278] ? schedule_timeout+0x10e/0x160
May 3 18:45:41 ubuntu2004 kernel: [26633494.586296] ? __do_page_fault+0x58/0x90
May 3 18:45:41 ubuntu2004 kernel: [26633494.590240] ? do_page_fault+0x2c/0xe0
May 3 18:45:41 ubuntu2004 kernel: [26633494.594137] ? page_fault+0x34/0x40
May 3 18:45:41 ubuntu2004 kernel: [26633494.597946] ? ovpn_socket_release+0x9b/0x150 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.601721] ? ovpn_socket_release+0x92/0x150 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.605710] unlock_ovpn.isra.0+0x4e/0x80 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.609307] ovpn_peer_keepalive_work+0xd7/0x180 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.612938] ? __schedule+0x2eb/0x740
May 3 18:45:41 ubuntu2004 kernel: [26633494.616529] process_one_work+0x1eb/0x3b0
May 3 18:45:41 ubuntu2004 kernel: [26633494.620130] worker_thread+0x4d/0x400
May 3 18:45:41 ubuntu2004 kernel: [26633494.623651] kthread+0x104/0x140
May 3 18:45:41 ubuntu2004 kernel: [26633494.627067] ? process_one_work+0x3b0/0x3b0
May 3 18:45:41 ubuntu2004 kernel: [26633494.630390] ? kthread_park+0x90/0x90
May 3 18:45:41 ubuntu2004 kernel: [26633494.633584] ret_from_fork+0x1f/0x40
May 3 18:45:41 ubuntu2004 kernel: [26633494.636751] Modules linked in: ovpn(OE) nfnetlink bluetooth ecdh_generic ecc xsk_diag vsock_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs cpuid 8021q garp mrp stp llc dummy ovpn_dco_v2(OE) ip6_udp_tunnel udp_tunnel authenc echainiv esp6 xfrm_user xfrm_algo vmw_vsock_vmci_transport vsock dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr binfmt_misc intel_rapl_common vmw_balloon rapl input_leds joydev serio_raw vmw_vmci mac_hid sch_fq_codel msr ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear ahci hid_generic libahci usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper mptspi mptscsih psmouse vmwgfx ttm mptbase drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops vmxnet3 drm
May 3 18:45:41 ubuntu2004 kernel: [26633494.636951] scsi_transport_spi i2c_piix4 pata_acpi
May 3 18:45:41 ubuntu2004 kernel: [26633494.675818] CR2: 0000000000000219
May 3 18:45:41 ubuntu2004 kernel: [26633494.679564] ---[ end trace 6dc8919115004d43 ]---
May 3 18:45:41 ubuntu2004 kernel: [26633494.683280] RIP: 0010:ovpn_socket_release+0x9b/0x150 [ovpn]
May 3 18:45:41 ubuntu2004 kernel: [26633494.687001] Code: 48 8b 78 18 0f b6 87 19 02 00 00 3c 11 74 5e 3c 06 0f 84 9e 00 00 00 e8 c3 2d 9d df e8 de 4f 20 df 49 8b 44 24 08 48 8b 40 18 <0f> b6 80 19 02 00 00 3c 11 74 11 3c 06 74 47 4c 89 e7 e8 5e 80 38
still on backports commit 550943957b5ca and ubuntu 20.04 with 5.4.0-174-generic