amnezia-vpn/amneziawg-linux-kernel-module
1
0
Fork 0
mirror of https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git synced 2026-10-14 05:41:56 +00:00
Code Issues 131 Projects Packages Wiki Activity

[GH-ISSUE #98] v1.0.20251004 caused a kernel oops #58

New issue
Closed
opened 2026-10-13 21:06:08 +00:00 by bsakaguchi · 5 comments
bsakaguchi commented 2026-10-13 21:06:08 +00:00
Owner
Copy link

Originally created by @orange-banal-pole on GitHub (Oct 5, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/98

Shortly after I established a client tunnel to an AWG 2.0 server, using awg-quick, my kernel crashed:

Oct 05 18:14:37 localhost kernel: Oops: general protection fault, probably for non-canonical address 0xdc6b140083541836: 0000 [#2] >
Oct 05 18:14:37 localhost kernel: CPU: 2 UID: 0 PID: 6731 Comm: awg Tainted: G      D    O       6.12.41-x86_64 #2
Oct 05 18:14:37 localhost kernel: Tainted: [D]=DIE, [O]=OOT_MODULE
Oct 05 18:14:37 localhost kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D98/PRO B760-P WIFI DDR4 (MS-7D98), BIOS 1.>
Oct 05 18:14:37 localhost kernel: RIP: 0010:nfulnl_rcv_nl_event+0x1d/0xa0
Oct 05 18:14:37 localhost kernel: Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 56 41 55 4c 8b 2a 41 54 44 8b 25 30 b7 d0 00 55 4>
Oct 05 18:14:37 localhost kernel: RSP: 0018:ffffc9000193fdf0 EFLAGS: 00010202
Oct 05 18:14:37 localhost kernel: RAX: 0000000000000001 RBX: 0000000000000001 RCX: 00000000ffffffff
Oct 05 18:14:37 localhost kernel: RDX: ffff88820dd44d80 RSI: 0000000000000001 RDI: ffffffff825d1090
Oct 05 18:14:37 localhost kernel: RBP: ffffc9000193fe80 R08: 0000000000000000 R09: 0000000000000000
Oct 05 18:14:37 localhost kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008
Oct 05 18:14:37 localhost kernel: R13: dc6b140083540dc6 R14: ffffffff825d1090 R15: 00000000ffffffff
Oct 05 18:14:37 localhost kernel: FS:  00007f8166949740(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000
Oct 05 18:14:37 localhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Oct 05 18:14:37 localhost kernel: CR2: 000055cc15ece3a8 CR3: 000000017b2ec004 CR4: 0000000000772ef0
Oct 05 18:14:37 localhost kernel: PKRU: 55555554
Oct 05 18:14:37 localhost kernel: Call Trace:
Oct 05 18:14:37 localhost kernel:  <TASK>
Oct 05 18:14:37 localhost kernel:  notifier_call_chain+0x50/0xc0
Oct 05 18:14:37 localhost kernel:  blocking_notifier_call_chain+0x36/0x50
Oct 05 18:14:37 localhost kernel:  netlink_release+0x60a/0x690
Oct 05 18:14:37 localhost kernel:  __sock_release+0x35/0xc0
Oct 05 18:14:37 localhost kernel:  sock_close+0xc/0x20
Oct 05 18:14:37 localhost kernel:  __fput+0xd1/0x290
Oct 05 18:14:37 localhost kernel:  __x64_sys_close+0x33/0x70
Oct 05 18:14:37 localhost kernel:  do_syscall_64+0x47/0x110
Oct 05 18:14:37 localhost kernel:  entry_SYSCALL_64_after_hwframe+0x76/0x7e
Oct 05 18:14:37 localhost kernel: RIP: 0033:0x7f81669d4567
Oct 05 18:14:37 localhost kernel: Code: 20 49 89 d0 48 89 fa 4c 89 df e8 64 b2 00 00 8b 93 08 03 00 00 59 48 83 f8 fc 5e 74 16 5b c>
Oct 05 18:14:37 localhost kernel: RSP: 002b:00007fff8bf87d70 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
Oct 05 18:14:37 localhost kernel: RAX: ffffffffffffffda RBX: 00007f8166949740 RCX: 00007f81669d4567
Oct 05 18:14:37 localhost kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
Oct 05 18:14:37 localhost kernel: RBP: 000055cc15ece3b0 R08: 0000000000000000 R09: 0000000000000000
Oct 05 18:14:37 localhost kernel: R10: 0000000000000000 R11: 0000000000000202 R12: 00000000ffffffea
Oct 05 18:14:37 localhost kernel: R13: 000055cc15ecd2a0 R14: 000055cc15ecd370 R15: 00007f8166b88000
Oct 05 18:14:37 localhost kernel:  </TASK>
Oct 05 18:14:37 localhost kernel: Modules linked in: nft_fib_ipv4 nft_ct nft_fib_ipv6 nft_fib nf_tables amneziawg curve25519_x86_64>
Oct 05 18:14:37 localhost kernel: ---[ end trace 0000000000000000 ]---
Oct 05 18:14:37 localhost kernel: RIP: 0010:flush_to_ldisc+0xb0/0x180
Oct 05 18:14:37 localhost kernel: Code: 8b 00 ff d0 0f 1f 00 48 8b 0c 24 48 85 c0 49 89 c4 0f 85 98 00 00 00 8b 43 18 8b 53 14 39 c>
Oct 05 18:14:37 localhost kernel: RSP: 0018:ffffc90004ca3e48 EFLAGS: 00010206
Oct 05 18:14:37 localhost kernel: RAX: 000000005812883e RBX: 4d4fbc144f2c6ede RCX: 4d4fbc144f2c6ede
Oct 05 18:14:37 localhost kernel: RDX: 000000005812883e RSI: ffff8881e863d517 RDI: ffff88845d6d3430
Oct 05 18:14:37 localhost kernel: RBP: ffff88822775e408 R08: ffffffff815beac0 R09: ffff88812f110fd3
Oct 05 18:14:37 localhost kernel: R10: 0000000000200b20 R11: 0000000000000000 R12: 0000000000000fff
Oct 05 18:14:37 localhost kernel: R13: ffff88822775e400 R14: ffff88822775e428 R15: 0000000000000000
Oct 05 18:14:37 localhost kernel: FS:  00007f8166949740(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000
Oct 05 18:14:37 localhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Oct 05 18:14:37 localhost kernel: CR2: 000055cc15ece3a8 CR3: 000000017b2ec004 CR4: 0000000000772ef0
Oct 05 18:14:37 localhost kernel: PKRU: 55555554

This is the client config:

[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Address = 10.9.0.2/32
Jc = 4
Jmin = 8
Jmax = 80
S1 = 17
S2 = 19
H1 = 365726737
H2 = 968844857
H3 = 1628569305
H4 = 1658850829
I1 = <b 0xc70000000108ce1bf31eec7d93360000449e227e4596ed7f75c4d35ce31880b4133107c822c6355b51f0d7c1bba96d5c210a48aca01885fed0871cfc37d59137d73b506dc013bb4a13c060ca5b04b7ae215af71e37d6e8ff1db235f9fe0c25cb8b492471054a7c8d0d6077d430d07f6e87a8699287f6e69f54263c7334a8e144a29851429bf2e350e519445172d36953e96085110ce1fb641e5efad42c0feb4711ece959b72cc4d6f3c1e83251adb572b921534f6ac4b10927167f41fe50040a75acef62f45bded67c0b45b9d655ce374589cad6f568b8475b2e8921ff98628f86ff2eb5bcce6f3ddb7dc89e37c5b5e78ddc8d93a58896e530b5f9f1448ab3b7a1d1f24a63bf981634f6183a21af310ffa52e9ddf5521561760288669de01a5f2f1a4f922e68d0592026bbe4329b654d4f5d6ace4f6a23b8560b720a5350691c0037b10acfac9726add44e7d3e880ee6f3b0d6429ff33655c297fee786bb5ac032e48d2062cd45e305e6d8d8b82bfbf0fdbc5ec09943d1ad02b0b5868ac4b24bb10255196be883562c35a713002014016b8cc5224768b3d330016cf8ed9300fe6bf39b4b19b3667cddc6e7c7ebe4437a58862606a2a66bd4184b09ab9d2cd3d3faed4d2ab71dd821422a9540c4c5fa2a9b2e6693d411a22854a8e541ed930796521f03a54254074bc4c5bca152a1723260e7d70a24d49720acc544b41359cfc252385bda7de7d05878ac0ea0343c77715e145160e6562161dfe2024846dfda3ce99068817a2418e66e4f37dea40a21251c8a034f83145071d93baadf050ca0f95dc9ce2338fb082d64fbc8faba905cec66e65c0e1f9b003c32c943381282d4ab09bef9b6813ff3ff5118623d2617867e25f0601df583c3ac51bc6303f79e68d8f8de4b8363ec9c7728b3ec5fcd5274edfca2a42f2727aa223c557afb33f5bea4f64aeb252c0150ed734d4d8eccb257824e8e090f65029a3a042a51e5cc8767408ae07d55da8507e4d009ae72c47ddb138df3cab6cc023df2532f88fb5a4c4bd917fafde0f3134be09231c389c70bc55cb95a779615e8e0a76a2b4d943aabfde0e394c985c0cb0376930f92c5b6998ef49ff4a13652b787503f55c4e3d8eebd6e1bc6db3a6d405d8405bd7a8db7cefc64d16e0d105a468f3d33d29e5744a24c4ac43ce0eb1bf6b559aed520b91108cda2de6e2c4f14bc4f4dc58712580e07d217c8cca1aaf7ac04bab3e7b1008b966f1ed4fba3fd93a0a9d3a27127e7aa587fbcc60d548300146bdc126982a58ff5342fc41a43f83a3d2722a26645bc961894e339b953e78ab395ff2fb854247ad06d446cc2944a1aefb90573115dc198f5c1efbc22bc6d7a74e41e666a643d5f85f57fde81b87ceff95353d22ae8bab11684180dd142642894d8dc34e402f802c2fd4a73508ca99124e428d67437c871dd96e506ffc39c0fc401f666b437adca41fd563cbcfd0fa22fbbf8112979c4e677fb533d981745cceed0fe96da6cc0593c430bbb71bcbf924f70b4547b0bb4d41c94a09a9ef1147935a5c75bb2f721fbd24ea6a9f5c9331187490ffa6d4e34e6bb30c2c54a0344724f01088fb2751a486f425362741664efb287bce66c4a544c96fa8b124d3c6b9eaca170c0b530799a6e878a57f402eb0016cf2689d55c76b2a91285e2273763f3afc5bc9398273f5338a06d>

[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 0.0.0.0/0
Endpoint = XXX:XXX
Originally created by @orange-banal-pole on GitHub (Oct 5, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/98 Shortly after I established a client tunnel to an AWG 2.0 server, using `awg-quick`, my kernel crashed: ``` Oct 05 18:14:37 localhost kernel: Oops: general protection fault, probably for non-canonical address 0xdc6b140083541836: 0000 [#2] > Oct 05 18:14:37 localhost kernel: CPU: 2 UID: 0 PID: 6731 Comm: awg Tainted: G D O 6.12.41-x86_64 #2 Oct 05 18:14:37 localhost kernel: Tainted: [D]=DIE, [O]=OOT_MODULE Oct 05 18:14:37 localhost kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D98/PRO B760-P WIFI DDR4 (MS-7D98), BIOS 1.> Oct 05 18:14:37 localhost kernel: RIP: 0010:nfulnl_rcv_nl_event+0x1d/0xa0 Oct 05 18:14:37 localhost kernel: Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 56 41 55 4c 8b 2a 41 54 44 8b 25 30 b7 d0 00 55 4> Oct 05 18:14:37 localhost kernel: RSP: 0018:ffffc9000193fdf0 EFLAGS: 00010202 Oct 05 18:14:37 localhost kernel: RAX: 0000000000000001 RBX: 0000000000000001 RCX: 00000000ffffffff Oct 05 18:14:37 localhost kernel: RDX: ffff88820dd44d80 RSI: 0000000000000001 RDI: ffffffff825d1090 Oct 05 18:14:37 localhost kernel: RBP: ffffc9000193fe80 R08: 0000000000000000 R09: 0000000000000000 Oct 05 18:14:37 localhost kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008 Oct 05 18:14:37 localhost kernel: R13: dc6b140083540dc6 R14: ffffffff825d1090 R15: 00000000ffffffff Oct 05 18:14:37 localhost kernel: FS: 00007f8166949740(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 Oct 05 18:14:37 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 05 18:14:37 localhost kernel: CR2: 000055cc15ece3a8 CR3: 000000017b2ec004 CR4: 0000000000772ef0 Oct 05 18:14:37 localhost kernel: PKRU: 55555554 Oct 05 18:14:37 localhost kernel: Call Trace: Oct 05 18:14:37 localhost kernel: <TASK> Oct 05 18:14:37 localhost kernel: notifier_call_chain+0x50/0xc0 Oct 05 18:14:37 localhost kernel: blocking_notifier_call_chain+0x36/0x50 Oct 05 18:14:37 localhost kernel: netlink_release+0x60a/0x690 Oct 05 18:14:37 localhost kernel: __sock_release+0x35/0xc0 Oct 05 18:14:37 localhost kernel: sock_close+0xc/0x20 Oct 05 18:14:37 localhost kernel: __fput+0xd1/0x290 Oct 05 18:14:37 localhost kernel: __x64_sys_close+0x33/0x70 Oct 05 18:14:37 localhost kernel: do_syscall_64+0x47/0x110 Oct 05 18:14:37 localhost kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Oct 05 18:14:37 localhost kernel: RIP: 0033:0x7f81669d4567 Oct 05 18:14:37 localhost kernel: Code: 20 49 89 d0 48 89 fa 4c 89 df e8 64 b2 00 00 8b 93 08 03 00 00 59 48 83 f8 fc 5e 74 16 5b c> Oct 05 18:14:37 localhost kernel: RSP: 002b:00007fff8bf87d70 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 Oct 05 18:14:37 localhost kernel: RAX: ffffffffffffffda RBX: 00007f8166949740 RCX: 00007f81669d4567 Oct 05 18:14:37 localhost kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 Oct 05 18:14:37 localhost kernel: RBP: 000055cc15ece3b0 R08: 0000000000000000 R09: 0000000000000000 Oct 05 18:14:37 localhost kernel: R10: 0000000000000000 R11: 0000000000000202 R12: 00000000ffffffea Oct 05 18:14:37 localhost kernel: R13: 000055cc15ecd2a0 R14: 000055cc15ecd370 R15: 00007f8166b88000 Oct 05 18:14:37 localhost kernel: </TASK> Oct 05 18:14:37 localhost kernel: Modules linked in: nft_fib_ipv4 nft_ct nft_fib_ipv6 nft_fib nf_tables amneziawg curve25519_x86_64> Oct 05 18:14:37 localhost kernel: ---[ end trace 0000000000000000 ]--- Oct 05 18:14:37 localhost kernel: RIP: 0010:flush_to_ldisc+0xb0/0x180 Oct 05 18:14:37 localhost kernel: Code: 8b 00 ff d0 0f 1f 00 48 8b 0c 24 48 85 c0 49 89 c4 0f 85 98 00 00 00 8b 43 18 8b 53 14 39 c> Oct 05 18:14:37 localhost kernel: RSP: 0018:ffffc90004ca3e48 EFLAGS: 00010206 Oct 05 18:14:37 localhost kernel: RAX: 000000005812883e RBX: 4d4fbc144f2c6ede RCX: 4d4fbc144f2c6ede Oct 05 18:14:37 localhost kernel: RDX: 000000005812883e RSI: ffff8881e863d517 RDI: ffff88845d6d3430 Oct 05 18:14:37 localhost kernel: RBP: ffff88822775e408 R08: ffffffff815beac0 R09: ffff88812f110fd3 Oct 05 18:14:37 localhost kernel: R10: 0000000000200b20 R11: 0000000000000000 R12: 0000000000000fff Oct 05 18:14:37 localhost kernel: R13: ffff88822775e400 R14: ffff88822775e428 R15: 0000000000000000 Oct 05 18:14:37 localhost kernel: FS: 00007f8166949740(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 Oct 05 18:14:37 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 05 18:14:37 localhost kernel: CR2: 000055cc15ece3a8 CR3: 000000017b2ec004 CR4: 0000000000772ef0 Oct 05 18:14:37 localhost kernel: PKRU: 55555554 ``` This is the client config: ``` [Interface] PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Address = 10.9.0.2/32 Jc = 4 Jmin = 8 Jmax = 80 S1 = 17 S2 = 19 H1 = 365726737 H2 = 968844857 H3 = 1628569305 H4 = 1658850829 I1 = <b 0xc70000000108ce1bf31eec7d93360000449e227e4596ed7f75c4d35ce31880b4133107c822c6355b51f0d7c1bba96d5c210a48aca01885fed0871cfc37d59137d73b506dc013bb4a13c060ca5b04b7ae215af71e37d6e8ff1db235f9fe0c25cb8b492471054a7c8d0d6077d430d07f6e87a8699287f6e69f54263c7334a8e144a29851429bf2e350e519445172d36953e96085110ce1fb641e5efad42c0feb4711ece959b72cc4d6f3c1e83251adb572b921534f6ac4b10927167f41fe50040a75acef62f45bded67c0b45b9d655ce374589cad6f568b8475b2e8921ff98628f86ff2eb5bcce6f3ddb7dc89e37c5b5e78ddc8d93a58896e530b5f9f1448ab3b7a1d1f24a63bf981634f6183a21af310ffa52e9ddf5521561760288669de01a5f2f1a4f922e68d0592026bbe4329b654d4f5d6ace4f6a23b8560b720a5350691c0037b10acfac9726add44e7d3e880ee6f3b0d6429ff33655c297fee786bb5ac032e48d2062cd45e305e6d8d8b82bfbf0fdbc5ec09943d1ad02b0b5868ac4b24bb10255196be883562c35a713002014016b8cc5224768b3d330016cf8ed9300fe6bf39b4b19b3667cddc6e7c7ebe4437a58862606a2a66bd4184b09ab9d2cd3d3faed4d2ab71dd821422a9540c4c5fa2a9b2e6693d411a22854a8e541ed930796521f03a54254074bc4c5bca152a1723260e7d70a24d49720acc544b41359cfc252385bda7de7d05878ac0ea0343c77715e145160e6562161dfe2024846dfda3ce99068817a2418e66e4f37dea40a21251c8a034f83145071d93baadf050ca0f95dc9ce2338fb082d64fbc8faba905cec66e65c0e1f9b003c32c943381282d4ab09bef9b6813ff3ff5118623d2617867e25f0601df583c3ac51bc6303f79e68d8f8de4b8363ec9c7728b3ec5fcd5274edfca2a42f2727aa223c557afb33f5bea4f64aeb252c0150ed734d4d8eccb257824e8e090f65029a3a042a51e5cc8767408ae07d55da8507e4d009ae72c47ddb138df3cab6cc023df2532f88fb5a4c4bd917fafde0f3134be09231c389c70bc55cb95a779615e8e0a76a2b4d943aabfde0e394c985c0cb0376930f92c5b6998ef49ff4a13652b787503f55c4e3d8eebd6e1bc6db3a6d405d8405bd7a8db7cefc64d16e0d105a468f3d33d29e5744a24c4ac43ce0eb1bf6b559aed520b91108cda2de6e2c4f14bc4f4dc58712580e07d217c8cca1aaf7ac04bab3e7b1008b966f1ed4fba3fd93a0a9d3a27127e7aa587fbcc60d548300146bdc126982a58ff5342fc41a43f83a3d2722a26645bc961894e339b953e78ab395ff2fb854247ad06d446cc2944a1aefb90573115dc198f5c1efbc22bc6d7a74e41e666a643d5f85f57fde81b87ceff95353d22ae8bab11684180dd142642894d8dc34e402f802c2fd4a73508ca99124e428d67437c871dd96e506ffc39c0fc401f666b437adca41fd563cbcfd0fa22fbbf8112979c4e677fb533d981745cceed0fe96da6cc0593c430bbb71bcbf924f70b4547b0bb4d41c94a09a9ef1147935a5c75bb2f721fbd24ea6a9f5c9331187490ffa6d4e34e6bb30c2c54a0344724f01088fb2751a486f425362741664efb287bce66c4a544c96fa8b124d3c6b9eaca170c0b530799a6e878a57f402eb0016cf2689d55c76b2a91285e2273763f3afc5bc9398273f5338a06d> [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 0.0.0.0/0 Endpoint = XXX:XXX ```
bsakaguchi commented 2026-10-13 21:06:09 +00:00
Author
Owner
Copy link

@orange-banal-pole commented on GitHub (Oct 6, 2025):

[  661.383660] BUG: KASAN: slab-out-of-bounds in jp_spec_setup+0x4bf/0xae0 [amneziawg]
[  661.383669] Write of size 1200 at addr ffff888102fc94b0 by task awg/7316

[  661.383675] CPU: 1 UID: 0 PID: 7316 Comm: awg Tainted: G           O       6.12.50-x86_64 #1
[  661.383678] Tainted: [O]=OOT_MODULE
[  661.383679] Hardware name: Micro-Star International Co., Ltd. MS-7D98/PRO B760-P WIFI DDR4 (MS-7D98), BIOS 1.80 10/28/2023
[  661.383681] Call Trace:
[  661.383682]  <TASK>
[  661.383683]  dump_stack_lvl+0x4f/0x70
[  661.383687]  print_report+0xc4/0x610
[  661.383691]  ? jp_spec_setup+0x4bf/0xae0 [amneziawg]
[  661.383696]  kasan_report+0xaa/0xe0
[  661.383698]  ? jp_spec_setup+0x4bf/0xae0 [amneziawg]
[  661.383703]  kasan_check_range+0xeb/0x1a0
[  661.383705]  __asan_memcpy+0x38/0x60
[  661.383707]  jp_spec_setup+0x4bf/0xae0 [amneziawg]
[  661.383712]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  661.383716]  ? __pfx_jp_spec_setup+0x10/0x10 [amneziawg]
[  661.383720]  ? kernel_text_address+0xa3/0x130
[  661.383723]  ? __pfx_unwind_next_frame+0x10/0x10
[  661.383725]  ? get_stack_info_noinstr+0x14/0x100
[  661.383727]  wg_device_handle_post_config+0x363/0xaf0 [amneziawg]
[  661.383733]  ? dst_cache_reset_now+0x156/0x270
[  661.383735]  wg_set_device+0x14c9/0x1f80 [amneziawg]
[  661.383740]  ? __pfx_wg_set_device+0x10/0x10 [amneziawg]
[  661.383746]  ? __pfx___nla_validate_parse+0x10/0x10
[  661.383748]  ? kasan_save_track+0x10/0x30
[  661.383750]  ? __kasan_kmalloc+0x8b/0x90
[  661.383752]  ? __kmalloc_noprof+0x197/0x440
[  661.383754]  ? kernel_text_address+0xa3/0x130
[  661.383756]  ? __nla_parse+0x20/0x30
[  661.383757]  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x14b/0x230
[  661.383760]  genl_family_rcv_msg_doit+0x1cd/0x2b0
[  661.383763]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  661.383765]  ? stack_trace_save+0x91/0xd0
[  661.383767]  ? __pfx_mutex_lock+0x10/0x10
[  661.383770]  genl_rcv_msg+0x3d0/0x650
[  661.383772]  ? __pfx_genl_rcv_msg+0x10/0x10
[  661.383774]  ? do_syscall_64+0x47/0x110
[  661.383775]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  661.383778]  ? __pfx_wg_set_device+0x10/0x10 [amneziawg]
[  661.383783]  ? skb_release_data+0x510/0x7a0
[  661.383785]  ? _raw_spin_lock_irqsave+0x82/0xe0
[  661.383787]  netlink_rcv_skb+0x129/0x380
[  661.383789]  ? __pfx_genl_rcv_msg+0x10/0x10
[  661.383791]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  661.383793]  ? __pfx_down_read+0x10/0x10
[  661.383795]  ? __pfx_netlink_lookup+0x10/0x10
[  661.383797]  genl_rcv+0x1f/0x30
[  661.383799]  netlink_unicast+0x685/0x9c0
[  661.383801]  ? __pfx_netlink_unicast+0x10/0x10
[  661.383802]  ? __check_object_size+0x410/0x540
[  661.383805]  netlink_sendmsg+0x70b/0xb70
[  661.383807]  ? __pfx_netlink_sendmsg+0x10/0x10
[  661.383808]  ? _copy_from_user+0x2b/0x80
[  661.383811]  __sys_sendto+0x35e/0x3c0
[  661.383813]  ? __pfx___sys_sendto+0x10/0x10
[  661.383815]  ? __pfx___sys_recvmsg+0x10/0x10
[  661.383817]  __x64_sys_sendto+0xd7/0x1b0
[  661.383819]  ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0
[  661.383821]  ? syscall_exit_to_user_mode+0x3a/0xf0
[  661.383823]  do_syscall_64+0x47/0x110
[  661.383824]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  661.383827] RIP: 0033:0x7f00c1693567
[  661.383829] Code: 20 49 89 d0 48 89 fa 4c 89 df e8 64 b2 00 00 8b 93 08 03 00 00 59 48 83 f8 fc 5e 74 16 5b c3 0f 1f 40 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 e2 e8 23 ff ff ff
[  661.383831] RSP: 002b:00007ffe0f3de690 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  661.383833] RAX: ffffffffffffffda RBX: 00007f00c1608740 RCX: 00007f00c1693567
[  661.383835] RDX: 0000000000000028 RSI: 000055cf0f5413a0 RDI: 0000000000000003
[  661.383836] RBP: 0000000000000000 R08: 000055cedc46c898 R09: 000000000000000c
[  661.383837] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[  661.383838] R13: 000055cf0f5412a0 R14: 000055cf0f541370 R15: 00007f00c1847000
[  661.383840]  </TASK>

[  661.383876] Allocated by task 7316:
[  661.383878]  kasan_save_stack+0x1c/0x40
[  661.383881]  kasan_save_track+0x10/0x30
[  661.383883]  __kasan_kmalloc+0x8b/0x90
[  661.383886]  __kmalloc_noprof+0x197/0x440
[  661.383888]  jp_spec_setup+0x37a/0xae0 [amneziawg]
[  661.383894]  wg_device_handle_post_config+0x363/0xaf0 [amneziawg]
[  661.383899]  wg_set_device+0x14c9/0x1f80 [amneziawg]
[  661.383905]  genl_family_rcv_msg_doit+0x1cd/0x2b0
[  661.383908]  genl_rcv_msg+0x3d0/0x650
[  661.383910]  netlink_rcv_skb+0x129/0x380
[  661.383912]  genl_rcv+0x1f/0x30
[  661.383915]  netlink_unicast+0x685/0x9c0
[  661.383917]  netlink_sendmsg+0x70b/0xb70
[  661.383919]  __sys_sendto+0x35e/0x3c0
[  661.383921]  __x64_sys_sendto+0xd7/0x1b0
[  661.383923]  do_syscall_64+0x47/0x110
[  661.383925]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

[  661.383929] The buggy address belongs to the object at ffff888102fc9000
                which belongs to the cache kmalloc-2k of size 2048
[  661.383931] The buggy address is located 0 bytes to the right of
                allocated 1200-byte region [ffff888102fc9000, ffff888102fc94b0)

[  661.383936] The buggy address belongs to the physical page:
[  661.383937] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102fc8
[  661.383940] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  661.383942] flags: 0x200000000000040(head|node=0|zone=2)
[  661.383945] page_type: f5(slab)
[  661.383948] raw: 0200000000000040 ffff888100042f00 dead000000000100 dead000000000122
[  661.383950] raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
[  661.383953] head: 0200000000000040 ffff888100042f00 dead000000000100 dead000000000122
[  661.383955] head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
[  661.383957] head: 0200000000000003 ffffea00040bf201 ffffffffffffffff 0000000000000000
[  661.383958] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
[  661.383960] page dumped because: kasan: bad access detected

[  661.383963] Memory state around the buggy address:
[  661.383964]  ffff888102fc9380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  661.383966]  ffff888102fc9400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  661.383968] >ffff888102fc9480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[  661.383970]                                      ^
[  661.383971]  ffff888102fc9500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  661.383973]  ffff888102fc9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  661.383975] ==================================================================
[  661.384270] Disabling lock debugging due to kernel taint
<!-- gh-comment-id:3369968180 --> @orange-banal-pole commented on GitHub (Oct 6, 2025): ``` [ 661.383660] BUG: KASAN: slab-out-of-bounds in jp_spec_setup+0x4bf/0xae0 [amneziawg] [ 661.383669] Write of size 1200 at addr ffff888102fc94b0 by task awg/7316 [ 661.383675] CPU: 1 UID: 0 PID: 7316 Comm: awg Tainted: G O 6.12.50-x86_64 #1 [ 661.383678] Tainted: [O]=OOT_MODULE [ 661.383679] Hardware name: Micro-Star International Co., Ltd. MS-7D98/PRO B760-P WIFI DDR4 (MS-7D98), BIOS 1.80 10/28/2023 [ 661.383681] Call Trace: [ 661.383682] <TASK> [ 661.383683] dump_stack_lvl+0x4f/0x70 [ 661.383687] print_report+0xc4/0x610 [ 661.383691] ? jp_spec_setup+0x4bf/0xae0 [amneziawg] [ 661.383696] kasan_report+0xaa/0xe0 [ 661.383698] ? jp_spec_setup+0x4bf/0xae0 [amneziawg] [ 661.383703] kasan_check_range+0xeb/0x1a0 [ 661.383705] __asan_memcpy+0x38/0x60 [ 661.383707] jp_spec_setup+0x4bf/0xae0 [amneziawg] [ 661.383712] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 661.383716] ? __pfx_jp_spec_setup+0x10/0x10 [amneziawg] [ 661.383720] ? kernel_text_address+0xa3/0x130 [ 661.383723] ? __pfx_unwind_next_frame+0x10/0x10 [ 661.383725] ? get_stack_info_noinstr+0x14/0x100 [ 661.383727] wg_device_handle_post_config+0x363/0xaf0 [amneziawg] [ 661.383733] ? dst_cache_reset_now+0x156/0x270 [ 661.383735] wg_set_device+0x14c9/0x1f80 [amneziawg] [ 661.383740] ? __pfx_wg_set_device+0x10/0x10 [amneziawg] [ 661.383746] ? __pfx___nla_validate_parse+0x10/0x10 [ 661.383748] ? kasan_save_track+0x10/0x30 [ 661.383750] ? __kasan_kmalloc+0x8b/0x90 [ 661.383752] ? __kmalloc_noprof+0x197/0x440 [ 661.383754] ? kernel_text_address+0xa3/0x130 [ 661.383756] ? __nla_parse+0x20/0x30 [ 661.383757] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x14b/0x230 [ 661.383760] genl_family_rcv_msg_doit+0x1cd/0x2b0 [ 661.383763] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 661.383765] ? stack_trace_save+0x91/0xd0 [ 661.383767] ? __pfx_mutex_lock+0x10/0x10 [ 661.383770] genl_rcv_msg+0x3d0/0x650 [ 661.383772] ? __pfx_genl_rcv_msg+0x10/0x10 [ 661.383774] ? do_syscall_64+0x47/0x110 [ 661.383775] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 661.383778] ? __pfx_wg_set_device+0x10/0x10 [amneziawg] [ 661.383783] ? skb_release_data+0x510/0x7a0 [ 661.383785] ? _raw_spin_lock_irqsave+0x82/0xe0 [ 661.383787] netlink_rcv_skb+0x129/0x380 [ 661.383789] ? __pfx_genl_rcv_msg+0x10/0x10 [ 661.383791] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 661.383793] ? __pfx_down_read+0x10/0x10 [ 661.383795] ? __pfx_netlink_lookup+0x10/0x10 [ 661.383797] genl_rcv+0x1f/0x30 [ 661.383799] netlink_unicast+0x685/0x9c0 [ 661.383801] ? __pfx_netlink_unicast+0x10/0x10 [ 661.383802] ? __check_object_size+0x410/0x540 [ 661.383805] netlink_sendmsg+0x70b/0xb70 [ 661.383807] ? __pfx_netlink_sendmsg+0x10/0x10 [ 661.383808] ? _copy_from_user+0x2b/0x80 [ 661.383811] __sys_sendto+0x35e/0x3c0 [ 661.383813] ? __pfx___sys_sendto+0x10/0x10 [ 661.383815] ? __pfx___sys_recvmsg+0x10/0x10 [ 661.383817] __x64_sys_sendto+0xd7/0x1b0 [ 661.383819] ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0 [ 661.383821] ? syscall_exit_to_user_mode+0x3a/0xf0 [ 661.383823] do_syscall_64+0x47/0x110 [ 661.383824] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 661.383827] RIP: 0033:0x7f00c1693567 [ 661.383829] Code: 20 49 89 d0 48 89 fa 4c 89 df e8 64 b2 00 00 8b 93 08 03 00 00 59 48 83 f8 fc 5e 74 16 5b c3 0f 1f 40 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 e2 e8 23 ff ff ff [ 661.383831] RSP: 002b:00007ffe0f3de690 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 661.383833] RAX: ffffffffffffffda RBX: 00007f00c1608740 RCX: 00007f00c1693567 [ 661.383835] RDX: 0000000000000028 RSI: 000055cf0f5413a0 RDI: 0000000000000003 [ 661.383836] RBP: 0000000000000000 R08: 000055cedc46c898 R09: 000000000000000c [ 661.383837] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 661.383838] R13: 000055cf0f5412a0 R14: 000055cf0f541370 R15: 00007f00c1847000 [ 661.383840] </TASK> [ 661.383876] Allocated by task 7316: [ 661.383878] kasan_save_stack+0x1c/0x40 [ 661.383881] kasan_save_track+0x10/0x30 [ 661.383883] __kasan_kmalloc+0x8b/0x90 [ 661.383886] __kmalloc_noprof+0x197/0x440 [ 661.383888] jp_spec_setup+0x37a/0xae0 [amneziawg] [ 661.383894] wg_device_handle_post_config+0x363/0xaf0 [amneziawg] [ 661.383899] wg_set_device+0x14c9/0x1f80 [amneziawg] [ 661.383905] genl_family_rcv_msg_doit+0x1cd/0x2b0 [ 661.383908] genl_rcv_msg+0x3d0/0x650 [ 661.383910] netlink_rcv_skb+0x129/0x380 [ 661.383912] genl_rcv+0x1f/0x30 [ 661.383915] netlink_unicast+0x685/0x9c0 [ 661.383917] netlink_sendmsg+0x70b/0xb70 [ 661.383919] __sys_sendto+0x35e/0x3c0 [ 661.383921] __x64_sys_sendto+0xd7/0x1b0 [ 661.383923] do_syscall_64+0x47/0x110 [ 661.383925] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 661.383929] The buggy address belongs to the object at ffff888102fc9000 which belongs to the cache kmalloc-2k of size 2048 [ 661.383931] The buggy address is located 0 bytes to the right of allocated 1200-byte region [ffff888102fc9000, ffff888102fc94b0) [ 661.383936] The buggy address belongs to the physical page: [ 661.383937] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102fc8 [ 661.383940] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 661.383942] flags: 0x200000000000040(head|node=0|zone=2) [ 661.383945] page_type: f5(slab) [ 661.383948] raw: 0200000000000040 ffff888100042f00 dead000000000100 dead000000000122 [ 661.383950] raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 [ 661.383953] head: 0200000000000040 ffff888100042f00 dead000000000100 dead000000000122 [ 661.383955] head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 [ 661.383957] head: 0200000000000003 ffffea00040bf201 ffffffffffffffff 0000000000000000 [ 661.383958] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 661.383960] page dumped because: kasan: bad access detected [ 661.383963] Memory state around the buggy address: [ 661.383964] ffff888102fc9380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 661.383966] ffff888102fc9400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 661.383968] >ffff888102fc9480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 661.383970] ^ [ 661.383971] ffff888102fc9500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 661.383973] ffff888102fc9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 661.383975] ================================================================== [ 661.384270] Disabling lock debugging due to kernel taint ```
bsakaguchi commented 2026-10-13 21:06:09 +00:00
Author
Owner
Copy link

@orange-banal-pole commented on GitHub (Oct 6, 2025):

As far as I understand, the out-of-bounds write happens here:

github.com/amnezia-vpn/amneziawg-linux-kernel-module@876bf7571e/src/junk.c (L293)

We also have the same pointer arithmetics below:

github.com/amnezia-vpn/amneziawg-linux-kernel-module@876bf7571e/src/junk.c (L299)

<!-- gh-comment-id:3370022853 --> @orange-banal-pole commented on GitHub (Oct 6, 2025): As far as I understand, the out-of-bounds write happens here: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/blob/876bf7571e47e349d0e86b70c244330b470d9642/src/junk.c#L293 We also have the same pointer arithmetics below: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/blob/876bf7571e47e349d0e86b70c244330b470d9642/src/junk.c#L299
bsakaguchi commented 2026-10-13 21:06:09 +00:00
Author
Owner
Copy link

@orange-banal-pole commented on GitHub (Oct 6, 2025):

This patch seems to solve the issue:

--- src/junk.c.orig     2025-10-03 10:23:14.541926951 +0700
+++ src/junk.c  2025-10-06 14:37:18.494288797 +0700
@@ -288,6 +288,8 @@
         goto error;
     }
 
+    spec->pkt_size = 0;
+
     list_for_each_entry_reverse(tag, &head, head) {
         if (tag->pkt) {
             memcpy(spec->pkt + spec->pkt_size, tag->pkt, tag->pkt_size);
<!-- gh-comment-id:3370309946 --> @orange-banal-pole commented on GitHub (Oct 6, 2025): This patch seems to solve the issue: ```diff --- src/junk.c.orig 2025-10-03 10:23:14.541926951 +0700 +++ src/junk.c 2025-10-06 14:37:18.494288797 +0700 @@ -288,6 +288,8 @@ goto error; } + spec->pkt_size = 0; + list_for_each_entry_reverse(tag, &head, head) { if (tag->pkt) { memcpy(spec->pkt + spec->pkt_size, tag->pkt, tag->pkt_size); ```
bsakaguchi commented 2026-10-13 21:06:10 +00:00
Author
Owner
Copy link

@ygurov commented on GitHub (Oct 6, 2025):

Hi @orange-banal-pole,
Thanks for reporting and debugging the issue. Looks like you are right, we have a potential memory leak due to uninitialized pkt_size variable
Will put a PR shortly

<!-- gh-comment-id:3370816783 --> @ygurov commented on GitHub (Oct 6, 2025): Hi @orange-banal-pole, Thanks for reporting and debugging the issue. Looks like you are right, we have a potential memory leak due to uninitialized pkt_size variable Will put a PR shortly
bsakaguchi commented 2026-10-13 21:06:10 +00:00
Author
Owner
Copy link

@ygurov commented on GitHub (Oct 6, 2025):

Resolved in #99

<!-- gh-comment-id:3371661825 --> @ygurov commented on GitHub (Oct 6, 2025): Resolved in #99
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
feature/awg4
build/newer-ubuntu
v3.1.20260906
v3.1.20260828
v3.1.20260827
v3.1.20260812
v3.0.20260805
v3.0.20260731-04
v3.0.20260731-03
v3.0.20260731-02
v3.0.20260731
v3.0.20260730
v1.0.20260725
v1.0.20260611
v1.0.20260329-2
v1.0.20260329
v1.0.20260322
v1.0.20260210
v1.0.20251104
v1.0.20251009
v1.0.20251004
v1.0.20241112
v1.0.20241023
v1.0.20241022
v1.0.20240711
v1.0.20240213
v1.0.20240207
v1.0.20220627
v1.0.20211208
v1.0.20210606
v1.0.20210424
v1.0.20210219
v1.0.20210124
v1.0.20201221
v1.0.20201112
v1.0.20200908
v1.0.20200729
v1.0.20200712
v1.0.20200623
v1.0.20200611
v1.0.20200520
v1.0.20200506
v1.0.20200429
v1.0.20200426
v1.0.20200413
v1.0.20200401
v1.0.20200330
v0.0.20200318
v0.0.20200215
v0.0.20200214
v0.0.20200205
v0.0.20200128
v0.0.20200121
v0.0.20200105
v0.0.20191226
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
amnezia-vpn/amneziawg-linux-kernel-module#58
No description provided.