Issue, WireGuard on a PaX kernel

Issue, WireGuard on a PaX kernel

[saeidscorp]

[-- Attachment #1: Type: text/plain, Size: 715 bytes --]

Hi everybody,
I've been having troubles using WireGuard on Gentoo hardened/PaX kernel. I have set up WireGuard on regular kernels several times, but on a PaX kernel it causes the kernel to panic.
All steps of inetrface addition and configuration using wg tool work well, but as soon as the first packet goes through the interface, it crashes the whole system.
I tried adding wireguard to the kernel tree, both as built-in and as a module, enabled verbose messages in kconfig, but don't know where to actually look for its log output! (No evidence of wireguard messages in dmesg or syslog)
Could you please point me in the right direction?!
FYI, It's running inside a VMware VPS and PaX is using slow UDEREF.
Thanks.

[-- Attachment #2: Type: text/html, Size: 971 bytes --]

Re: Issue, WireGuard on a PaX kernel

[Samuel Holland]

Hello,

On 04/23/17 09:53, saeidscorp wrote:
> I've been having troubles using WireGuard on Gentoo hardened/PaX
> kernel. I have set up WireGuard on regular kernels several times, but
> on a PaX kernel it causes the kernel to panic.
>
> All steps of interface addition and configuration using wg tool work
> well, but as soon as the first packet goes through the interface, it
> crashes the whole system.

You didn't mention your kernel version, so I assume you're using the
latest stable hardened-sources. The panic is a known issue for 4.8,
caused by a combination of bugs in the upstream kernel and the
grsecurity patch. You can resolve it by either downgrading to 4.7 or
upgrading to 4.9.

See this thread[0] for more information.

Regards,
Samuel

[0] https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg00385.html

Re: Issue, WireGuard on a PaX kernel

[saeidscorp]

[-- Attachment #1: Type: text/plain, Size: 663 bytes --]

Sorry I didn't noticed your link. ):

-------- Original message --------From: saeidscorp <saeidscorp@yahoo.com> Date: 24/04/2017  12:31  (GMT+03:30) To: Samuel Holland <samuel@sholland.org>, wireguard@lists.zx2c4.com Subject: Re: Issue, WireGuard on a PaX kernel 
Thanks for answering!
Yes, I was using the 4.8 hardened-sources. I tried both upgrading to 4.9 and downgrading to 4.7.Still the kernel panics.
However I copied my .config file from previous 4.8 kernel to these sources' install directories.Can you point me to related issues of Grsecurity patches causing the problem? I couldn't find the search capability in mailing list archives.
Thanks in advance.

[-- Attachment #2: Type: text/html, Size: 1113 bytes --]

Re: Issue, WireGuard on a PaX kernel

[saeidscorp]

[-- Attachment #1: Type: text/plain, Size: 1452 bytes --]

Thanks for answering!
Yes, I was using the 4.8 hardened-sources. I tried both upgrading to 4.9 and downgrading to 4.7.Still the kernel panics.
However I copied my .config file from previous 4.8 kernel to these sources' install directories.Can you point me to related issues of Grsecurity patches causing the problem? I couldn't find the search capability in mailing list archives.
Thanks in advance.
-------- Original message --------From: Samuel Holland <samuel@sholland.org> Date: 23/04/2017  23:49  (GMT+03:30) To: saeidscorp <saeidscorp@yahoo.com>, wireguard@lists.zx2c4.com Subject: Re: Issue, WireGuard on a PaX kernel 
Hello,

On 04/23/17 09:53, saeidscorp wrote:
> I've been having troubles using WireGuard on Gentoo hardened/PaX
> kernel. I have set up WireGuard on regular kernels several times, but
> on a PaX kernel it causes the kernel to panic.
>
> All steps of interface addition and configuration using wg tool work
> well, but as soon as the first packet goes through the interface, it
> crashes the whole system.

You didn't mention your kernel version, so I assume you're using the
latest stable hardened-sources. The panic is a known issue for 4.8,
caused by a combination of bugs in the upstream kernel and the
grsecurity patch. You can resolve it by either downgrading to 4.7 or
upgrading to 4.9.

See this thread[0] for more information.

Regards,
Samuel

[0] https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg00385.html

[-- Attachment #2: Type: text/html, Size: 1978 bytes --]