[PATCH] wg-quick: darwin: fix set_dns() and del_dns() race

[PATCH] wg-quick: darwin: fix set_dns() and del_dns() race

[Dmitry Ilvokhin]

The monitor deamon restores the DNS servers by running del_dns() from
its INT, TERM and EXIT trap. Every route event also schedules an ALRM 2
seconds later, and the ALRM trap runs set_dns().

If ALRM arrives during cleanup, set_dns() can run in the middle of
del_dns(), and the DNS servers may not be restored after the WireGuard
interface is removed.

Ignore ALRM in cleanup signal handler to avoid this race.

Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
---
 src/wg-quick/darwin.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/darwin.bash b/src/wg-quick/darwin.bash
index 0179afb..20a21ce 100755
--- a/src/wg-quick/darwin.bash
+++ b/src/wg-quick/darwin.bash
@@ -323,7 +323,7 @@ del_dns() {
 
 monitor_daemon() {
 	echo "[+] Backgrounding route monitor" >&2
-	(trap 'del_routes; del_dns; exit 0' INT TERM EXIT
+	(trap 'trap "" ALRM; del_routes; del_dns; exit 0' INT TERM EXIT
 	exec >/dev/null 2>&1
 	exec 19< <(exec route -n monitor)
 	local event bpid=$BASHPID mpid=$!
-- 
2.54.0 (Apple Git-157)

[PATCH] wg-quick: darwin: fix set_dns() and del_dns() race

[Dmitry Ilvokhin]

The monitor deamon restores the DNS servers by running del_dns() from
its INT, TERM and EXIT trap. Every route event also schedules an ALRM 2
seconds later, and the ALRM trap runs set_dns().

If ALRM arrives during cleanup, set_dns() can run in the middle of
del_dns(), and the DNS servers may not be restored after the WireGuard
interface is removed.

Ignore ALRM in cleanup signal handler to avoid this race.

Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
---
Resending the patch, since mailing list didn't accept it first time,
because I was not a member of the list.

 src/wg-quick/darwin.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/darwin.bash b/src/wg-quick/darwin.bash
index 0179afb..20a21ce 100755
--- a/src/wg-quick/darwin.bash
+++ b/src/wg-quick/darwin.bash
@@ -323,7 +323,7 @@ del_dns() {
 
 monitor_daemon() {
 	echo "[+] Backgrounding route monitor" >&2
-	(trap 'del_routes; del_dns; exit 0' INT TERM EXIT
+	(trap 'trap "" ALRM; del_routes; del_dns; exit 0' INT TERM EXIT
 	exec >/dev/null 2>&1
 	exec 19< <(exec route -n monitor)
 	local event bpid=$BASHPID mpid=$!
-- 
2.54.0 (Apple Git-157)

Re: [PATCH] wg-quick: darwin: fix set_dns() and del_dns() race

[Dmitry Ilvokhin]

On Wed, Sep 30, 2026 at 10:30:41AM +0000, Dmitry Ilvokhin wrote:
> The monitor deamon restores the DNS servers by running del_dns() from
> its INT, TERM and EXIT trap. Every route event also schedules an ALRM 2
> seconds later, and the ALRM trap runs set_dns().
> 
> If ALRM arrives during cleanup, set_dns() can run in the middle of
> del_dns(), and the DNS servers may not be restored after the WireGuard
> interface is removed.
> 
> Ignore ALRM in cleanup signal handler to avoid this race.
> 
> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
> ---
> Resending the patch, since mailing list didn't accept it first time,
> because I was not a member of the list.

Hello Jason,

Any thoughts on the patch?

I applied this patch locally, tested it for a few weeks and never hit
the race again. I'd love to get the fix upstream.