* Re: [PATCH net] wireguard: flush endpoint dst cache when a peer is removed
[not found] <20261106081538.69465-1-juny24602@gmail.com>
@ 2026-11-10 16:56 ` Jason A. Donenfeld
0 siblings, 0 replies; only message in thread
From: Jason A. Donenfeld @ 2026-11-10 16:56 UTC (permalink / raw)
To: Jun Yang
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, wireguard, netdev,
Jun Yang, stable, TencentOS Corvus AI
On Fri, Nov 06, 2026 at 04:15:17PM +0800, Jun Yang wrote:
> peer_make_dead() removes a peer from wg->peer_list, but a netlink device
> dump can keep it alive through ctx->next_peer. If the WireGuard device
> has moved to another network namespace, wg_netns_exit_rtnl() skips the
> removed peer when flushing endpoint caches for the original namespace.
> A cached IPv6 RTF_CACHE dst can then survive ip6_route_net_exit(), and
> its later release from rcu_release() accesses the destroyed per-netns
> dst counter.
Can you explain this better in your own words? I'd rather you do the
work of interpreting the LLM-generated output and making it
comprehensible. If you understand the bug, write up your understanding
of it.
> Mark the peer dead and flush its endpoint cache under endpoint_lock.
> Bypass the cache for dead peers in the send path so an in-flight sender
> cannot repopulate it after the flush.
>
> Fixes: 20ae1d6aa159 ("wireguard: device: reset peer src endpoint when netns exits")
> Cc: stable@kernel.org
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> Signed-off-by: Jun Yang <junvyyang@tencent.com>
> ---
> A KASAN reproducer for this issue is available if requested.
Yes, please.
^ permalink raw reply [flat|nested] only message in thread