[PATCH net 0/2] wireguard: memcg accounting and initiation race fix

[Alexander Ildiyarov]

  Two independent fixes:
  
  1/2 charges peer, allowedips, dst_cache and hashtable allocations to the
  memcg of the configuring process, which currently can allocate
  unaccounted kernel memory through WG_CMD_SET_DEVICE.
  
  2/2 rechecks the replay/flood conditions under the write lock in
  wg_noise_handshake_consume_initiation(), the initiation-side counterpart
  of 2a73c9b2c0ca. The race window is narrow and was only reproduced with
  an artificial delay; details are in the commit message.
  
  Tested in qemu (x86_64, 4 vCPUs) with reproducers for both issues and
  CONFIG_WIREGUARD_DEBUG self-tests. netns.sh was run up to the
  allowed-ips removal step, where the available wg(8) is too old; that
  part was not run.


Alexander Ildiyarov (2):
  wireguard: account peer and allowedips allocations to memcg
  wireguard: noise: recheck replay and flood under write lock on
    initiation

 drivers/net/wireguard/allowedips.c |  2 +-
 drivers/net/wireguard/noise.c      | 29 ++++++++++++++++++++++-------
 drivers/net/wireguard/peer.c       |  4 ++--
 drivers/net/wireguard/peerlookup.c |  4 ++--
 4 files changed, 27 insertions(+), 12 deletions(-)

-- 
2.43.0