[PR #213] [MERGED] fix: read is_keepalive before sending skb #240

New issue

Closed

opened 2026-10-13 21:07:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/213
Author: @shilin-ai
Created: 8/12/2026
Status: ✅ Merged
Merged: 8/12/2026
Merged by: @ygurov

Base: master ← Head: fix/is-keepalive-uaf

📝 Commits (1)

a1fb0b5 fix: read is_keepalive before sending skb

📊 Changes

1 file changed (+3 additions, -1 deletions)

View changed files

📝 src/send.c (+3 -1)

📄 Description

Summary

After ce16310, keepalive detection uses PACKET_CB(skb)->is_keepalive.
The flag was read after wg_socket_send_skb_to_peer(), which consumes the skb.
The network stack reuses skb->cb, so the bool can become garbage (UBSAN: load of value 51 is not a valid value for type '_Bool' in send.c / wg_packet_tx_worker).

Fix

Capture is_keepalive into a local before sending, matching the pre-ce16310 pattern that evaluated keepalive status before transmit.

Test plan

Rebuild DKMS module and load it
Run traffic + keepalives with S4 / ContentPaddingAddition enabled
Confirm no UBSAN invalid-load in send.c / wg_packet_tx_worker

Made with Cursor

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/213 **Author:** [@shilin-ai](https://github.com/shilin-ai) **Created:** 8/12/2026 **Status:** ✅ Merged **Merged:** 8/12/2026 **Merged by:** [@ygurov](https://github.com/ygurov) **Base:** `master` ← **Head:** `fix/is-keepalive-uaf` --- ### 📝 Commits (1) - [`a1fb0b5`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/a1fb0b50f535b3f710f0a9b9ba089373ea5af66c) fix: read is_keepalive before sending skb ### 📊 Changes **1 file changed** (+3 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/send.c` (+3 -1) </details> ### 📄 Description ## Summary - After `ce16310`, keepalive detection uses `PACKET_CB(skb)->is_keepalive`. - The flag was read **after** `wg_socket_send_skb_to_peer()`, which consumes the skb. - The network stack reuses `skb->cb`, so the bool can become garbage (UBSAN: `load of value 51 is not a valid value for type '_Bool'` in `send.c` / `wg_packet_tx_worker`). ## Fix Capture `is_keepalive` into a local before sending, matching the pre-`ce16310` pattern that evaluated keepalive status before transmit. ## Test plan - [x] Rebuild DKMS module and load it - [x] Run traffic + keepalives with `S4` / `ContentPaddingAddition` enabled - [ ] Confirm no UBSAN `invalid-load` in `send.c` / `wg_packet_tx_worker` Made with [Cursor](https://cursor.com) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 21:07:54 +00:00