[GH-ISSUE #140] BUG: kernel NULL pointer dereference, awg set if_name i1 #87

New issue

Open

opened 2026-10-13 21:06:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:06:23 +00:00

Owner

Originally created by @lestermfp on GitHub (Feb 19, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/140

Attempting to change the I1–I5 CSP parameters on an active AWG 2.0 tunnel via awg set results in the following kernel message. awg-quick down ends up with ip link delete hanging in D state.

awg set example

awg set "$IFACE" i1 "<b 0x>" i2 "<b 0x>" i3 "<b 0x>" i4 "<b 0x>" i5 "<b 0x>"

   awg set "$IFACE" i1 "<b 0x>"
    sleep 0.25
    awg set "$IFACE" i2 "<b 0x>"
    sleep 0.25
    awg set "$IFACE" i3 "<b 0x>"
    sleep 0.25
    awg set "$IFACE" i4 "<b 0x>"
    sleep 0.25
    awg set "$IFACE" i5 "<b 0x>"

Kernel message

[  +0.000080] BUG: kernel NULL pointer dereference, address: 0000000000000010
[  +0.000021] #PF: supervisor read access in kernel mode
[  +0.000008] #PF: error_code(0x0000) - not-present page
[  +0.000007] PGD 0 P4D 0 
[  +0.000007] Oops: 0000 [#1] PREEMPT SMP PTI
[  +0.000008] CPU: 0 PID: 121 Comm: kworker/u2:3 Tainted: G           OE      6.1.0-43-amd64 #1  Debian 6.1.162-1
[  +0.000012] Hardware name: Red Hat KVM, BIOS 1.16.0-4.module_el8.9.0+3659+9c8643f3 04/01/2014
[  +0.000009] Workqueue: wg-kex-hru wg_packet_handshake_send_worker [amneziawg]
[  +0.000079] RIP: 0010:jp_spec_applymods+0x27/0x60 [amneziawg]
[  +0.000014] Code: 00 00 90 0f 1f 44 00 00 8b 47 3c 85 c0 7e 43 41 54 49 89 f4 55 48 89 fd 53 31 db 48 63 c3 48 8d 14 40 48 8b 45 10 48 8d 04 d0 <48> 8b 08 48 85 c9 74 0f 8b 70 10 
48 8b 78 08 4c 89 e2 e8 d2 d4 de
[  +0.000019] RSP: 0018:ffffd3e1c070bd90 EFLAGS: 00010246
[  +0.000007] RAX: 0000000000000010 RBX: 0000000000000000 RCX: 000000000000000a
[  +0.000008] RDX: 0000000000000000 RSI: ffff8b4f75d12490 RDI: ffff8b4f44c9ce98
[  +0.000008] RBP: ffff8b4f44c9ce98 R08: 0000000000000000 R09: ffffd3e1c070bb98
[  +0.000008] R10: 0000000000000003 R11: ffffffffa14d46c8 R12: ffff8b4f75d12490
[  +0.000007] R13: ffff8b4f44c9c980 R14: ffff8b4f44c9cff0 R15: ffff8b4f75d126e0
[  +0.000008] FS:  0000000000000000(0000) GS:ffff8b4f7ec00000(0000) knlGS:0000000000000000
[  +0.000009] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000007] CR2: 0000000000000010 CR3: 000000000a91e000 CR4: 00000000000006f0
[  +0.000012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  +0.000008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  +0.000008] Call Trace:
[  +0.000019]  <TASK>
[  +0.000020]  wg_packet_send_handshake_initiation+0x100/0x2f0 [amneziawg]
[  +0.000025]  wg_packet_handshake_send_worker+0x15/0x20 [amneziawg]
[  +0.000015]  process_one_work+0x1c7/0x380
[  +0.000010]  worker_thread+0x4d/0x380
[  +0.000006]  ? rescuer_thread+0x3a0/0x3a0
[  +0.000007]  kthread+0xda/0x100
[  +0.000567]  ? kthread_complete_and_exit+0x20/0x20
[  +0.000012]  ret_from_fork+0x22/0x30
[  +0.000013]  </TASK>
[  +0.000006] Modules linked in: mptcp_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag cls_u32 sch_htb wireguard tun xt_tcpudp nft_chain_nat xt_MASQU
ERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables libcrc32c nfnetlink binfmt_misc pcspkr virtio_balloon virtio_console button evdev joydev serio_raw sg ov
pn_dco_v2(OE) amneziawg(E) libchacha20poly1305 chacha_x86_64 poly1305_x86_64 curve25519_x86_64 libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel fuse loop dm_mod efi_pstore 
configfs qemu_fw_cfg virtio_rng ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic hid_generic usbhid hid sr_mod cdrom virtio_blk virtio_net net_failover failover ata
_generic cirrus drm_shmem_helper drm_kms_helper ata_piix uhci_hcd ehci_hcd libata drm usbcore psmouse scsi_mod virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_r
ing i2c_piix4 scsi_common usb_common floppy
[  +0.000223] CR2: 0000000000000010
[  +0.000007] ---[ end trace 0000000000000000 ]---
[  +0.000006] RIP: 0010:jp_spec_applymods+0x27/0x60 [amneziawg]
[  +0.000015] Code: 00 00 90 0f 1f 44 00 00 8b 47 3c 85 c0 7e 43 41 54 49 89 f4 55 48 89 fd 53 31 db 48 63 c3 48 8d 14 40 48 8b 45 10 48 8d 04 d0 <48> 8b 08 48 85 c9 74 0f 8b 70 10 48 8b 78 08 4c 89 e2 e8 d2 d4 de
[  +0.000571] RSP: 0018:ffffd3e1c070bd90 EFLAGS: 00010246
[  +0.000296] RAX: 0000000000000010 RBX: 0000000000000000 RCX: 000000000000000a
[  +0.000335] RDX: 0000000000000000 RSI: ffff8b4f75d12490 RDI: ffff8b4f44c9ce98
[  +0.000333] RBP: ffff8b4f44c9ce98 R08: 0000000000000000 R09: ffffd3e1c070bb98
[  +0.000306] R10: 0000000000000003 R11: ffffffffa14d46c8 R12: ffff8b4f75d12490
[  +0.000273] R13: ffff8b4f44c9c980 R14: ffff8b4f44c9cff0 R15: ffff8b4f75d126e0
[  +0.000321] FS:  0000000000000000(0000) GS:ffff8b4f7ec00000(0000) knlGS:0000000000000000
[  +0.000282] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000292] CR2: 0000000000000010 CR3: 000000000a91e000 CR4: 00000000000006f0
[  +0.000283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  +0.000331] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  +0.000274] note: kworker/u2:3[121] exited with irqs disabled

System info

Debian GNU/Linux 12 (bookworm)
modinfo amneziawg:

filename:       /lib/modules/6.1.0-43-amd64/updates/dkms/amneziawg.ko
version:        1.0.20251009
srcversion:     CF17DBA902A6A711D43DA4A
vermagic:       6.1.0-43-amd64 SMP preempt mod_unload modversions

Originally created by @lestermfp on GitHub (Feb 19, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/140 Attempting to change the I1–I5 CSP parameters on an active AWG 2.0 tunnel via **awg set** results in the following kernel message. **awg-quick down** ends up with **ip link delete** hanging in D state. ### awg set example ```bash awg set "$IFACE" i1 "" i2 "" i3 "" i4 "" i5 "" ``` or ```bash awg set "$IFACE" i1 "" sleep 0.25 awg set "$IFACE" i2 "" sleep 0.25 awg set "$IFACE" i3 "" sleep 0.25 awg set "$IFACE" i4 "" sleep 0.25 awg set "$IFACE" i5 "" ``` ### Kernel message ```dmesg [ +0.000080] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ +0.000021] #PF: supervisor read access in kernel mode [ +0.000008] #PF: error_code(0x0000) - not-present page [ +0.000007] PGD 0 P4D 0 [ +0.000007] Oops: 0000 [#1] PREEMPT SMP PTI [ +0.000008] CPU: 0 PID: 121 Comm: kworker/u2:3 Tainted: G OE 6.1.0-43-amd64 #1 Debian 6.1.162-1 [ +0.000012] Hardware name: Red Hat KVM, BIOS 1.16.0-4.module_el8.9.0+3659+9c8643f3 04/01/2014 [ +0.000009] Workqueue: wg-kex-hru wg_packet_handshake_send_worker [amneziawg] [ +0.000079] RIP: 0010:jp_spec_applymods+0x27/0x60 [amneziawg] [ +0.000014] Code: 00 00 90 0f 1f 44 00 00 8b 47 3c 85 c0 7e 43 41 54 49 89 f4 55 48 89 fd 53 31 db 48 63 c3 48 8d 14 40 48 8b 45 10 48 8d 04 d0 <48> 8b 08 48 85 c9 74 0f 8b 70 10 48 8b 78 08 4c 89 e2 e8 d2 d4 de [ +0.000019] RSP: 0018:ffffd3e1c070bd90 EFLAGS: 00010246 [ +0.000007] RAX: 0000000000000010 RBX: 0000000000000000 RCX: 000000000000000a [ +0.000008] RDX: 0000000000000000 RSI: ffff8b4f75d12490 RDI: ffff8b4f44c9ce98 [ +0.000008] RBP: ffff8b4f44c9ce98 R08: 0000000000000000 R09: ffffd3e1c070bb98 [ +0.000008] R10: 0000000000000003 R11: ffffffffa14d46c8 R12: ffff8b4f75d12490 [ +0.000007] R13: ffff8b4f44c9c980 R14: ffff8b4f44c9cff0 R15: ffff8b4f75d126e0 [ +0.000008] FS: 0000000000000000(0000) GS:ffff8b4f7ec00000(0000) knlGS:0000000000000000 [ +0.000009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000007] CR2: 0000000000000010 CR3: 000000000a91e000 CR4: 00000000000006f0 [ +0.000012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000008] Call Trace: [ +0.000019] <TASK> [ +0.000020] wg_packet_send_handshake_initiation+0x100/0x2f0 [amneziawg] [ +0.000025] wg_packet_handshake_send_worker+0x15/0x20 [amneziawg] [ +0.000015] process_one_work+0x1c7/0x380 [ +0.000010] worker_thread+0x4d/0x380 [ +0.000006] ? rescuer_thread+0x3a0/0x3a0 [ +0.000007] kthread+0xda/0x100 [ +0.000567] ? kthread_complete_and_exit+0x20/0x20 [ +0.000012] ret_from_fork+0x22/0x30 [ +0.000013] </TASK> [ +0.000006] Modules linked in: mptcp_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag cls_u32 sch_htb wireguard tun xt_tcpudp nft_chain_nat xt_MASQU ERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables libcrc32c nfnetlink binfmt_misc pcspkr virtio_balloon virtio_console button evdev joydev serio_raw sg ov pn_dco_v2(OE) amneziawg(E) libchacha20poly1305 chacha_x86_64 poly1305_x86_64 curve25519_x86_64 libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel fuse loop dm_mod efi_pstore configfs qemu_fw_cfg virtio_rng ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic hid_generic usbhid hid sr_mod cdrom virtio_blk virtio_net net_failover failover ata _generic cirrus drm_shmem_helper drm_kms_helper ata_piix uhci_hcd ehci_hcd libata drm usbcore psmouse scsi_mod virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_r ing i2c_piix4 scsi_common usb_common floppy [ +0.000223] CR2: 0000000000000010 [ +0.000007] ---[ end trace 0000000000000000 ]--- [ +0.000006] RIP: 0010:jp_spec_applymods+0x27/0x60 [amneziawg] [ +0.000015] Code: 00 00 90 0f 1f 44 00 00 8b 47 3c 85 c0 7e 43 41 54 49 89 f4 55 48 89 fd 53 31 db 48 63 c3 48 8d 14 40 48 8b 45 10 48 8d 04 d0 <48> 8b 08 48 85 c9 74 0f 8b 70 10 48 8b 78 08 4c 89 e2 e8 d2 d4 de [ +0.000571] RSP: 0018:ffffd3e1c070bd90 EFLAGS: 00010246 [ +0.000296] RAX: 0000000000000010 RBX: 0000000000000000 RCX: 000000000000000a [ +0.000335] RDX: 0000000000000000 RSI: ffff8b4f75d12490 RDI: ffff8b4f44c9ce98 [ +0.000333] RBP: ffff8b4f44c9ce98 R08: 0000000000000000 R09: ffffd3e1c070bb98 [ +0.000306] R10: 0000000000000003 R11: ffffffffa14d46c8 R12: ffff8b4f75d12490 [ +0.000273] R13: ffff8b4f44c9c980 R14: ffff8b4f44c9cff0 R15: ffff8b4f75d126e0 [ +0.000321] FS: 0000000000000000(0000) GS:ffff8b4f7ec00000(0000) knlGS:0000000000000000 [ +0.000282] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000292] CR2: 0000000000000010 CR3: 000000000a91e000 CR4: 00000000000006f0 [ +0.000283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000331] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000274] note: kworker/u2:3[121] exited with irqs disabled ``` ### System info Debian GNU/Linux 12 (bookworm) **modinfo amneziawg:** ``` filename: /lib/modules/6.1.0-43-amd64/updates/dkms/amneziawg.ko version: 1.0.20251009 srcversion: CF17DBA902A6A711D43DA4A vermagic: 6.1.0-43-amd64 SMP preempt mod_unload modversions

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amneziawg-linux-kernel-module#87

No description provided.

Rows
Columns

[GH-ISSUE #140] BUG: kernel NULL pointer dereference, awg set if_name i1 <b 0x> #87

awg set example

Kernel message

System info