[PR #234] fix: free ispecs after handshake workers stop #247

New issue

Open

opened 2026-10-13 21:07:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/234
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/ispec-teardown-uaf

📝 Commits (1)

500e9bf fix: free ispecs after handshake workers stop

📊 Changes

1 file changed (+2 additions, -3 deletions)

View changed files

📝 src/device.c (+2 -3)

📄 Description

Summary

Move jp_spec_free() calls in wg_destruct() after the handshake and packet workqueues are destroyed.

Handshake workers can access wg->ispecs[] while processing queued work. Previously the I1-I5 specs were freed before those workers were stopped, which left a teardown race where a worker could access already-freed pkt / mods memory.

After this change, the workqueues are destroyed first, and the ispecs are freed only after no worker can still use them.

Scope

This PR intentionally fixes only the ispec teardown ordering issue from #225.

It does not address the other issues reported there (Jmin > Jmax, unchecked junk-buffer allocation, etc.), so it should not close the whole issue.

Related to #225

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/234 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/ispec-teardown-uaf` --- ### 📝 Commits (1) - [`500e9bf`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/500e9bf68123dbfc68a56dd0ccf96d0a1cff2acc) fix: free ispecs after handshake workers stop ### 📊 Changes **1 file changed** (+2 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/device.c` (+2 -3) </details> ### 📄 Description ## Summary Move `jp_spec_free()` calls in `wg_destruct()` after the handshake and packet workqueues are destroyed. Handshake workers can access `wg->ispecs[]` while processing queued work. Previously the I1-I5 specs were freed before those workers were stopped, which left a teardown race where a worker could access already-freed `pkt` / `mods` memory. After this change, the workqueues are destroyed first, and the ispecs are freed only after no worker can still use them. ## Scope This PR intentionally fixes only the ispec teardown ordering issue from #225. It does not address the other issues reported there (`Jmin > Jmax`, unchecked junk-buffer allocation, etc.), so it should not close the whole issue. Related to #225 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:07:58 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:05 +00:00

[PR #247] fix: bound aggregate junk spec size #259