mirror of
https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git
synced 2026-10-14 05:41:56 +00:00
[PR #153] [MERGED] fix: memory corruption in jp_spec_setup causing kernel crash #207
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
amnezia-vpn/amneziawg-linux-kernel-module#207
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📋 Pull Request Information
Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/153
Author: @Arsolitt
Created: 3/18/2026
Status: ✅ Merged
Merged: 3/29/2026
Merged by: @pokamest
Base:
master← Head:fix-memory-corruption-ispecs📝 Commits (2)
a860536fix: memory corruption in jp_spec_setup causing kernel crash7ffa57bfix: race condition in jp_spec_setup causing use-after-free📊 Changes
3 files changed (+25 additions, -6 deletions)
View changed files
📝
src/device.c(+3 -1)📝
src/junk.c(+17 -5)📝
src/netlink.c(+5 -0)📄 Description
Problem
When I1-I5 parameters are configured, the kernel module crashes with a kernel oops. The bug was reproduced on CachyOS with kernels:
Crash can be triggered more quickly by restarting
awg-quickseveral times in rapid succession. The bug does not occur with the userspace implementation — only the kernel module is affected.Kernel Log (journalctl)
Root Cause Analysis
Bug 1: Out-of-bounds write (causes immediate crash)
In
src/junk.c:jp_spec_setup():spec->pkt_sizewas reset to 0 before the fill loopspec->mods_sizewas NOT reset to 0This causes memory corruption on subsequent configurations:
spec->mods_size= 3, array allocated, filled correctlymods_size= 2, new array allocated with size 2spec->mods_sizestill = 3 from previous runspec->mods + spec->mods_size= index 3, 4, 5... (out of bounds!)jp_spec_applymods()callsmod->func()→ jumps to garbage address → NX page faultBug 2: Race condition causing use-after-free
Fixed in second commit (d367e96)
mutex_init(&spec->lock)was called injp_spec_setup()on every configuration change. This re-initializes the mutex while it may be locked by another thread:send.choldsspec->lock, usesspec->pktjp_spec_setup(config reload) callsmutex_init(&spec->lock)— re-inits locked mutex!mutex_locksucceeds immediatelyjp_spec_setupdoeskfree(spec->pkt)whilesend.cstill uses itThe fix: Initialize mutexes once in
wg_newlink()during device creation, not injp_spec_setup().Bug 3: Memory leaks
spec->pkt,spec->modsnot freed before reallocation injp_spec_setup()spec->descnot freed before reallocation innetlink.cjp_spec_free()didn't freespec->descFix Summary
junk.c:jp_spec_setup()pkt/mods, resetmods_size = 0before fill loopnetlink.ckfree(desc)before assigning new valuejunk.c:jp_spec_free()desc, null all pointers, reset countersdevice.c:wg_newlink()ispecs[i].lockmutexes once at device creationjunk.c:jp_spec_setup()mutex_init(&spec->lock)— mutex already initializedTesting
Tested with various I1-I5 configurations:
awg-quickrestarts work correctlythis PR fixes:
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.