Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
reproducer on bare metal machines:
#!/bin/bash
# br0
# Host A -- SA --- Host B
# 192.168.0.1 192.168.0.2
# 2000::1 2000::2
# | |
# wg: 10.0.1.10 wg: 10.0.1.11
# fec0:1::a fec0:1::b
IN_V=6
MASK[6]="64"
HA_IP[6]="2000::1"
HB_IP[6]="2000::2"
HA_WG_IP[6]="fec0:1::a"
HB_WG_IP[6]="fec0:1::b"
WG_NET[6]="fec0:1::"
HA="ip netns exec ha"
HB="ip netns exec hb"
test_wg()
{
wg genkey | tee left_private.key | wg pubkey > left_public.key
wg genkey | tee right_private.key | wg pubkey > right_public.key
$HA ip link add wg0 type wireguard
$HA ip addr add ${HA_WG_IP[$IN_V]}/${MASK[$IN_V]} dev wg0
$HB ip link add wg0 type wireguard
$HB ip addr add ${HB_WG_IP[$IN_V]}/${MASK[$IN_V]} dev wg0
$HA wg set wg0 private-key ./left_private.key listen-port 56781 \
peer $(cat right_public.key) allowed-ips ${WG_NET[$IN_V]}/${MASK[$IN_V]} \
endpoint ${HB_IP[$IN_V]}:56782
$HA wg
$HB wg set wg0 private-key ./right_private.key listen-port 56782 \
peer $(cat left_public.key) allowed-ips ${WG_NET[$IN_V]}/${MASK[$IN_V]} \
endpoint ${HA_IP[$IN_V]}:56781
$HB wg
$HA ip link set wg0 up
$HB ip link set wg0 up
$HA ping ${HB_WG_IP[$IN_V]} -c 4 -i 0.1
$HB ping ${HA_WG_IP[$IN_V]} -c 4 -i 0.1
}
netns_1_net.sh
test_wg
modprobe -r veth
ip -a netns del
Update:
When removing a netns before removing the wg interface, the wg_netns_pre_exit() is called first.
But the peer's dst cache is not removed. So later in netdev_run_todo() the
function will be hung at netdev_wait_allrefs(dev) as dev->priv_destructor(dev)
runs later, the peer's dst cache could not be cleared and there is still a reference on the device.
The following fix works.
diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index 551ddaaaf540..c370854c76eb 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -407,6 +407,7 @@ static void wg_netns_pre_exit(struct net *net)
mutex_lock(&wg->device_update_lock);
rcu_assign_pointer(wg->creating_net, NULL);
wg_socket_reinit(wg, NULL, NULL);
+ wg_peer_remove_all(wg);
mutex_unlock(&wg->device_update_lock);
}
}
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (new packages: kernel), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2022:3907
reproducer on bare metal machines: #!/bin/bash # br0 # Host A -- SA --- Host B # 192.168.0.1 192.168.0.2 # 2000::1 2000::2 # | | # wg: 10.0.1.10 wg: 10.0.1.11 # fec0:1::a fec0:1::b IN_V=6 MASK[6]="64" HA_IP[6]="2000::1" HB_IP[6]="2000::2" HA_WG_IP[6]="fec0:1::a" HB_WG_IP[6]="fec0:1::b" WG_NET[6]="fec0:1::" HA="ip netns exec ha" HB="ip netns exec hb" test_wg() { wg genkey | tee left_private.key | wg pubkey > left_public.key wg genkey | tee right_private.key | wg pubkey > right_public.key $HA ip link add wg0 type wireguard $HA ip addr add ${HA_WG_IP[$IN_V]}/${MASK[$IN_V]} dev wg0 $HB ip link add wg0 type wireguard $HB ip addr add ${HB_WG_IP[$IN_V]}/${MASK[$IN_V]} dev wg0 $HA wg set wg0 private-key ./left_private.key listen-port 56781 \ peer $(cat right_public.key) allowed-ips ${WG_NET[$IN_V]}/${MASK[$IN_V]} \ endpoint ${HB_IP[$IN_V]}:56782 $HA wg $HB wg set wg0 private-key ./right_private.key listen-port 56782 \ peer $(cat left_public.key) allowed-ips ${WG_NET[$IN_V]}/${MASK[$IN_V]} \ endpoint ${HA_IP[$IN_V]}:56781 $HB wg $HA ip link set wg0 up $HB ip link set wg0 up $HA ping ${HB_WG_IP[$IN_V]} -c 4 -i 0.1 $HB ping ${HA_WG_IP[$IN_V]} -c 4 -i 0.1 } netns_1_net.sh test_wg modprobe -r veth ip -a netns del