Re: [PATCH net] wireguard: flush endpoint dst cache when a peer is removed

Re: [PATCH net] wireguard: flush endpoint dst cache when a peer is removed

[Jason A. Donenfeld]

On Fri, Nov 06, 2026 at 04:15:17PM +0800, Jun Yang wrote:
> peer_make_dead() removes a peer from wg->peer_list, but a netlink device
> dump can keep it alive through ctx->next_peer. If the WireGuard device
> has moved to another network namespace, wg_netns_exit_rtnl() skips the
> removed peer when flushing endpoint caches for the original namespace.
> A cached IPv6 RTF_CACHE dst can then survive ip6_route_net_exit(), and
> its later release from rcu_release() accesses the destroyed per-netns
> dst counter.

Can you explain this better in your own words? I'd rather you do the
work of interpreting the LLM-generated output and making it
comprehensible. If you understand the bug, write up your understanding
of it.

> Mark the peer dead and flush its endpoint cache under endpoint_lock.
> Bypass the cache for dead peers in the send path so an in-flight sender
> cannot repopulate it after the flush.
> 
> Fixes: 20ae1d6aa159 ("wireguard: device: reset peer src endpoint when netns exits")
> Cc: stable@kernel.org
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> Signed-off-by: Jun Yang <junvyyang@tencent.com>
> ---
> A KASAN reproducer for this issue is available if requested.

Yes, please.