[PR #142] fix: free old buffers and reset mods_size in jp_spec_setup #202

New issue

Open

opened 2026-10-13 21:07:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:34 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/142
Author: @thebtf
Created: 2/21/2026
Status: 🔄 Open

Base: master ← Head: fix/jp-spec-setup-mods-overflow

📝 Commits (1)

28eeae0 fix: reset mods_size and free old buffers in jp_spec_setup

📊 Changes

1 file changed (+5 additions, -2 deletions)

View changed files

📝 src/junk.c (+5 -2)

📄 Description

Problem

jp_spec_setup() is called every time the AWG interface configuration changes. On repeated calls, the function allocates new spec->pkt and spec->mods buffers without freeing the old ones first and without resetting spec->mods_size. This causes:

Memory leak - old buffers orphaned on every reconfiguration.
Heap buffer overflow - spec->mods_size retains its value from the previous call, causing list_for_each_entry_reverse to write past the newly allocated buffer.

Observed in production: refill_obj_stock crashed with page fault on corrupted kernel pointer, leading to BUG: scheduling while atomic and RCU stall persisting until manual reboot.

Prior fix

Commit 87a06ff (fix: memleak in jp_spec_setup due to uninit pkt_size) added spec->pkt_size = 0. This PR addresses the remaining issues.

Fix

Free both old buffers and reset both size fields before allocating new ones:

`c
kfree(spec->pkt);
kfree(spec->mods);
spec->pkt_size = 0;
spec->mods_size = 0;

spec->pkt = kzalloc(pkt_size, GFP_KERNEL);
spec->mods = kzalloc(mods_size * sizeof(*spec->mods), GFP_KERNEL);
`

Testing

Verified on Ubuntu 24.04 (kernel 6.8.0-100-generic, amneziawg DKMS 1.0.0). Server ran stable under repeated awg syncconf calls without heap corruption or memory growth.

@coderabbitai ignore

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/142 **Author:** [@thebtf](https://github.com/thebtf) **Created:** 2/21/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/jp-spec-setup-mods-overflow` --- ### 📝 Commits (1) - [`28eeae0`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/28eeae084405dce766a292f0893e0459284f6584) fix: reset mods_size and free old buffers in jp_spec_setup ### 📊 Changes **1 file changed** (+5 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/junk.c` (+5 -2) </details> ### 📄 Description ## Problem `jp_spec_setup()` is called every time the AWG interface configuration changes. On repeated calls, the function allocates new `spec->pkt` and `spec->mods` buffers **without freeing the old ones first** and without resetting `spec->mods_size`. This causes: 1. **Memory leak** - old buffers orphaned on every reconfiguration. 2. **Heap buffer overflow** - `spec->mods_size` retains its value from the previous call, causing `list_for_each_entry_reverse` to write past the newly allocated buffer. Observed in production: `refill_obj_stock` crashed with page fault on corrupted kernel pointer, leading to `BUG: scheduling while atomic` and RCU stall persisting until manual reboot. ## Prior fix Commit 87a06ff (`fix: memleak in jp_spec_setup due to uninit pkt_size`) added `spec->pkt_size = 0`. This PR addresses the remaining issues. ## Fix Free both old buffers and reset both size fields before allocating new ones: `c kfree(spec->pkt); kfree(spec->mods); spec->pkt_size = 0; spec->mods_size = 0; spec->pkt = kzalloc(pkt_size, GFP_KERNEL); spec->mods = kzalloc(mods_size * sizeof(*spec->mods), GFP_KERNEL); ` ## Testing Verified on Ubuntu 24.04 (kernel 6.8.0-100-generic, amneziawg DKMS 1.0.0). Server ran stable under repeated `awg syncconf` calls without heap corruption or memory growth. --- @coderabbitai ignore --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:07:34 +00:00

bsakaguchi referenced this issue

2026-10-13 21:07:51 +00:00

[PR #202] [CLOSED] feat: add CI to build and publish .deb packages on tag push #233