[PATCH net] wireguard: flush endpoint dst cache when a peer is removed

[PATCH net] wireguard: flush endpoint dst cache when a peer is removed

[Jun Yang]

From: Jun Yang <junvyyang@tencent.com>

peer_make_dead() removes a peer from wg->peer_list, but a netlink device
dump can keep it alive through ctx->next_peer. If the WireGuard device
has moved to another network namespace, wg_netns_exit_rtnl() skips the
removed peer when flushing endpoint caches for the original namespace.
A cached IPv6 RTF_CACHE dst can then survive ip6_route_net_exit(), and
its later release from rcu_release() accesses the destroyed per-netns
dst counter.

Mark the peer dead and flush its endpoint cache under endpoint_lock.
Bypass the cache for dead peers in the send path so an in-flight sender
cannot repopulate it after the flush.

Fixes: 20ae1d6aa159 ("wireguard: device: reset peer src endpoint when netns exits")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
A KASAN reproducer for this issue is available if requested.

 drivers/net/wireguard/peer.c   | 5 ++++-
 drivers/net/wireguard/socket.c | 6 ++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireguard/peer.c b/drivers/net/wireguard/peer.c
index 1cb502a932e0..c8d9396b1f13 100644
--- a/drivers/net/wireguard/peer.c
+++ b/drivers/net/wireguard/peer.c
@@ -85,8 +85,11 @@ static void peer_make_dead(struct wg_peer *peer)
 				     &peer->device->device_update_lock);
 	wg_pubkey_hashtable_remove(peer->device->peer_hashtable, peer);
 
-	/* Mark as dead, so that we don't allow jumping contexts after. */
+	/* Mark as dead and flush the cache before the peer's netns exits. */
+	write_lock_bh(&peer->endpoint_lock);
 	WRITE_ONCE(peer->is_dead, true);
+	dst_cache_reset_now(&peer->endpoint_cache);
+	write_unlock_bh(&peer->endpoint_lock);
 
 	/* The caller must now synchronize_net() for this to take effect. */
 }
diff --git a/drivers/net/wireguard/socket.c b/drivers/net/wireguard/socket.c
index 0028ef17dc71..0cd916d480b2 100644
--- a/drivers/net/wireguard/socket.c
+++ b/drivers/net/wireguard/socket.c
@@ -167,15 +167,17 @@ out:
 int wg_socket_send_skb_to_peer(struct wg_peer *peer, struct sk_buff *skb, u8 ds)
 {
 	size_t skb_len = skb->len;
+	struct dst_cache *cache;
 	int ret = -EAFNOSUPPORT;
 
 	read_lock_bh(&peer->endpoint_lock);
+	cache = READ_ONCE(peer->is_dead) ? NULL : &peer->endpoint_cache;
 	if (peer->endpoint.addr.sa_family == AF_INET)
 		ret = send4(peer->device, skb, &peer->endpoint, ds,
-			    &peer->endpoint_cache);
+			    cache);
 	else if (peer->endpoint.addr.sa_family == AF_INET6)
 		ret = send6(peer->device, skb, &peer->endpoint, ds,
-			    &peer->endpoint_cache);
+			    cache);
 	else
 		dev_kfree_skb(skb);
 	if (likely(!ret))
-- 
2.43.7

Re: [PATCH net] wireguard: flush endpoint dst cache when a peer is removed

[Jason A. Donenfeld]

On Fri, Nov 06, 2026 at 04:15:17PM +0800, Jun Yang wrote:
> peer_make_dead() removes a peer from wg->peer_list, but a netlink device
> dump can keep it alive through ctx->next_peer. If the WireGuard device
> has moved to another network namespace, wg_netns_exit_rtnl() skips the
> removed peer when flushing endpoint caches for the original namespace.
> A cached IPv6 RTF_CACHE dst can then survive ip6_route_net_exit(), and
> its later release from rcu_release() accesses the destroyed per-netns
> dst counter.

Can you explain this better in your own words? I'd rather you do the
work of interpreting the LLM-generated output and making it
comprehensible. If you understand the bug, write up your understanding
of it.

> Mark the peer dead and flush its endpoint cache under endpoint_lock.
> Bypass the cache for dead peers in the send path so an in-flight sender
> cannot repopulate it after the flush.
> 
> Fixes: 20ae1d6aa159 ("wireguard: device: reset peer src endpoint when netns exits")
> Cc: stable@kernel.org
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> Signed-off-by: Jun Yang <junvyyang@tencent.com>
> ---
> A KASAN reproducer for this issue is available if requested.

Yes, please.