Good luck! ![]()
[RPi] ConnMan resource socket leak (1024 FD crash) when using kernel-space WireGuard (wg0)
-
Doemela -
July 20, 2026 at 1:25 AM -
Thread is Unresolved
-
-
-
To help other community members check if their systems are suffering from this ConnMan file descriptor leak, I have written a diagnostic script. Connect via SSH and create the script:
Paste the following code inside the file:
Bash
Display More#!/bin/sh # chmod +x /storage/.config/scripts/connman-leak-test.sh # /storage/.config/scripts/connman-leak-test.sh OUTDIR=/storage/.cache/connman-diagnostics-$(date +%Y%m%dT%H%M%S) mkdir -p "$OUTDIR" PASTE_LOG="$OUTDIR/connman-leak-test.txt" trap 'echo -e "\n[$(date +%H:%M:%S)] Execution interrupted by user! Jumping to final metrics collection..."; break' INT echo "=== CONNMAN DIAGNOSTICS (PASSIVE MONITOR) ===" > "$PASTE_LOG" echo "OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'"' -f2)" >> "$PASTE_LOG" echo "Kernel: $(uname -r)" >> "$PASTE_LOG" if [ -f /proc/device-tree/model ]; then echo "Hardware Model: $(cat /proc/device-tree/model)" >> "$PASTE_LOG" fi echo "----------------------------------------" >> "$PASTE_LOG" pid=$(pidof connmand) echo "Connmand PID: $pid" >> "$PASTE_LOG" echo "[$(date +%H:%M:%S)] Toggling Kodi component debug logging ON..." kodi-send --action="SetLogLevel(2)" >/dev/null 2>&1 || true echo "[$(date +%H:%M:%S)] Collecting FIRST snapshot (T=0)..." echo "=== SNAPSHOT 1: START ===" >> "$PASTE_LOG" echo "Timestamp: $(date)" >> "$PASTE_LOG" if [ -n "$pid" ]; then echo "FD count: $(ls -l /proc/$pid/fd 2>/dev/null | wc -l)" >> "$PASTE_LOG" echo "Active FD targets (Top 20):" >> "$PASTE_LOG" (for f in /proc/$pid/fd/*; do readlink -f "$f" 2>/dev/null || readlink "$f" 2>/dev/null; done ) | sort | uniq -c | sort -nr | head -n 20 >> "$PASTE_LOG" 2>&1 || true fi echo "----------------------------------------" >> "$PASTE_LOG" echo "[$(date +%H:%M:%S)] Sleeping for 30 minutes to let the leak accumulate..." echo "Press Ctrl+C at any time to skip the wait and generate the log immediately." for i in $(seq 1 1800); do sleep 1 done trap - INT echo "[$(date +%H:%M:%S)] Collecting SECOND snapshot (T=+30 min)..." echo -e "\n=== SNAPSHOT 2: AFTER 30 MIN ===" >> "$PASTE_LOG" echo "Timestamp: $(date)" >> "$PASTE_LOG" if [ -n "$pid" ]; then echo "FD count: $(ls -l /proc/$pid/fd 2>/dev/null | wc -l)" >> "$PASTE_LOG" echo "Active FD targets (Top 20):" >> "$PASTE_LOG" (for f in /proc/$pid/fd/*; do readlink -f "$f" 2>/dev/null || readlink "$f" 2>/dev/null; done ) | sort | uniq -c | sort -nr | head -n 20 >> "$PASTE_LOG" 2>&1 || true if [ -r /proc/net/netlink ]; then echo -e "\n=== /proc/net/netlink ===" >> "$PASTE_LOG" cat /proc/net/netlink >> "$PASTE_LOG" fi fi echo -e "\n=== RECENT KODI LOG ENTRIES FOR ADDON ===" >> "$PASTE_LOG" if [ -f /storage/.kodi/temp/kodi.log ]; then grep -Ei "connman|wireguard" /storage/.kodi/temp/kodi.log | tail -n 150 >> "$PASTE_LOG" 2>&1 || true fi echo -e "\n=== RECENT SYSTEM JOURNAL LOGS FOR CONNMAN ===" >> "$PASTE_LOG" journalctl -u connman.service -n 150 --no-pager >> "$PASTE_LOG" 2>&1 || true echo "[$(date +%H:%M:%S)] Toggling Kodi component debug logging OFF..." kodi-send --action="SetLogLevel(0)" >/dev/null 2>&1 || true echo "----------------------------------------" echo "Uploading results..." PASTE_URL="" if command -v paste >/dev/null 2>&1; then PASTE_URL=$(paste "$PASTE_LOG" 2>/dev/null) fi if [ -z "$PASTE_URL" ]; then echo "Deploying curl fallback to ix.io..." PASTE_URL=$(curl -s -F "f:1=@$PASTE_LOG" ix.io) fi if [ -n "$PASTE_URL" ]; then echo "----------------------------------------" echo "Your diagnostic paste link is:" echo "$PASTE_URL" echo "----------------------------------------" else echo "Upload failed. Log preserved locally at: $PASTE_LOG" fiSave and exit (Ctrl+O, Enter, Ctrl+X), then give it execution permissions and run it:
Shell sessionchmod +x /storage/.config/scripts/connman-leak-test.sh /storage/.config/scripts/connman-leak-test.shIf you let it run full course or interrupt it, it will provide a direct paste link showing if your system is experiencing un-canceled socket tracking build-ups.
-
The patch looks structurally okay to me now, but I can't speak for the code. Denis and Marcel seem to be less active at the moment and I'm not sure if they are still working at Intel or were laid off, which might slow things up (not that ConnMan has been quick in recent years). If there is no comment in a week you might need to reply to your own email submission with a brief apology for the five previous messy iterations, and politely asking for feedback. If we see some positive feedback then I'm happy to pick the patch into LE images until ConnMan sees a version bump that includes it.
-
UPDATE 2026-09-20: Fixed — patch submitted upstream
Confirmed the leak on stock LE13 nightly 20260920-b68ee23 (ConnMan 2.0, iwd backend, Generic x86_64): fd count 22 → 49+ over VPN cycles, never recovers. Root cause in plugins/wifi.c interface_removed() — early-return skips g_supplicant_interface_cancel().
Patch (v7) submitted to [email protected]. With patch applied: fd returns to baseline (22) after every cycle. Verified data + fix instructions: Upstream ConnMan FD Leak Automated Mitigation Guide
-
In the v7 submission everything below the first paragraph should have been placed under the --- separator so that it is visible to reviewers but not merged into the codebase along with the description.
I normally place things above --- during development so that testing commentary is easily edited and not forgotten, but then you need to remember to tweak the final patch files before sending to move the --- above it.
-
In the v7 submission everything below the first paragraph should have been placed under the --- separator so that it is visible to reviewers but not merged into the codebase along with the description.
I normally place things above --- during development so that testing commentary is easily edited and not forgotten, but then you need to remember to tweak the final patch files before sending to move the --- above it.
Ty v8 submitted with the commentary moved below the separator.
-