| 0/0 |
2026/03/06 01:38 |
flow |
repro |
3m
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
} ReproSyz:r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, {&(0x7f0000000200)={0x34, 0x10, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [
{0x8, 0x3, "wg0\x00"},
{0x14, 0x12, {
{0xe, 0x1, "wireguard\x00"}
}}
]}}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, {&(0x7f0000000400)={0x34, 0x10, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [
{0x8, 0x3, "wg1\x00"},
{0x14, 0x12, {
{0xe, 0x1, "wireguard\x00"}
}}
]}}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id(&(0x7f0000000500)='wireguard\x00')
sendmsg$nl_generic(r1, &(0x7f0000000600)={0x0, 0x0, {&(0x7f0000000700)={0xa8, r2, 0x5, 0x1, 0x0, 0x100, "\x08\x00\x02\x00wg0\x00\x24\x00\x03\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x06\x00\x06\x00\x20\x4e\x00\x00\x60\x00\x08\x00\x5c\x00\x00\x00\x24\x00\x01\x00\x8e\x66\x47\x21\x4f\x8d\x56\x14\x3c\x03\x66\x33\x2e\x19\x63\x06\x43\x5b\x54\x43\x13\x06\x2e\x23\x96\x0c\x71\xa7\x4f\x2d\x43\x16\x14\x00\x04\x00\x02\x00\x21\x4e\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x09\x00\x1c\x00\x00\x00\x06\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x02\x05\x00\x03\x00\x20\x00\x00\x00"}}}, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000800)={0x0, 0x0, {&(0x7f0000000900)={0xa8, r2, 0x5, 0x1, 0x0, 0x100, "\x08\x00\x02\x00wg1\x00\x24\x00\x03\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x06\x00\x06\x00\x21\x4e\x00\x00\x60\x00\x08\x00\x5c\x00\x00\x00\x24\x00\x01\x00\x8e\x66\x47\x21\x4f\x8d\x56\x14\x3c\x03\x66\x33\x2e\x19\x63\x06\x43\x5b\x54\x43\x13\x06\x2e\x23\x96\x0c\x71\xa7\x4f\x2d\x43\x16\x14\x00\x04\x00\x02\x00\x20\x4e\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x09\x00\x1c\x00\x00\x00\x06\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x01\x02\x05\x00\x03\x00\x20\x00\x00\x00"}}}, 0x0)
r3 = socket$inet_dgram(0x2, 0x2, 0x0)
ioctl$sock_inet_siocsi_ifreq(r3, 0x8916, &(0x7f0000000a00)={'wg0\x00', {0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x1}}})
ioctl$sock_inet_siocsi_ifreq(r3, 0x891c, &(0x7f0000000b00)={'wg0\x00', {0x2, 0x0, @ipv4={0xff, 0xff, 0xff, 0x0}}})
ioctl$sock_ifreq(r3, 0x8914, &(0x7f0000000c00)={'wg0\x00', 0x1})
ioctl$sock_inet_siocsi_ifreq(r3, 0x8916, &(0x7f0000000d00)={'wg1\x00', {0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x1}}})
ioctl$sock_inet_siocsi_ifreq(r3, 0x891c, &(0x7f0000000e00)={'wg1\x00', {0x2, 0x0, @ipv4={0xff, 0xff, 0xff, 0x0}}})
ioctl$sock_ifreq(r3, 0x8914, &(0x7f0000000f00)={'wg1\x00', 0x1})
r4 = socket$inet_dgram(0x2, 0x2, 0x0)
sendto$inet(r4, &(0x7f0000001000)='data', 0x4, 0x0, &(0x7f0000001100)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001200)='data', 0x4, 0x0, &(0x7f0000001300)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001400)='data', 0x4, 0x0, &(0x7f0000001500)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001600)='data', 0x4, 0x0, &(0x7f0000001700)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001800)='data', 0x4, 0x0, &(0x7f0000001900)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001a00)='data', 0x4, 0x0, &(0x7f0000001b00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001c00)='data', 0x4, 0x0, &(0x7f0000001d00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001e00)='data', 0x4, 0x0, &(0x7f0000001f00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 1/1 |
2026/03/06 01:38 |
action |
provide-var |
0m
Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 2/1 |
2026/03/06 01:38 |
action |
kernel-checkouter |
0m
Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/0e0543b6728a481f7d36ab5dee63cf72a341470b]
|
| 3/1 |
2026/03/06 01:38 |
action |
kernel-builder |
0m
Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/ab46ffce72d0488f35bcd81d33f5cf480fb66a36]
|
| 4/1 |
2026/03/06 01:38 |
agent |
crash-repro-finder |
3m
Model:
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
Instruction:
You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
Bug Title: KCSAN: data-race in __mod_timer / __mod_timer
Original Crash Report:
==================================================================
BUG: KCSAN: data-race in __mod_timer / __mod_timer
write to 0xffff88811a4d64a0 of 8 bytes by task 9888 on cpu 1:
__mod_timer+0x670/0x9d0 kernel/time/timer.c:1126
mod_timer+0x1f/0x30 kernel/time/timer.c:1195
mod_peer_timer drivers/net/wireguard/timers.c:37 [inline]
wg_timers_any_authenticated_packet_traversal+0xd0/0x100 drivers/net/wireguard/timers.c:218
wg_packet_consume_data_done drivers/net/wireguard/receive.c:354 [inline]
wg_packet_rx_poll+0x7f5/0x10f0 drivers/net/wireguard/receive.c:474
__napi_poll+0x61/0x330 net/core/dev.c:7695
napi_threaded_poll_loop+0x1b9/0x630 net/core/dev.c:7814
napi_threaded_poll+0x15f/0x1f0 net/core/dev.c:7865
kthread+0x22a/0x280 kernel/kthread.c:467
ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
read to 0xffff88811a4d64a0 of 8 bytes by task 6384 on cpu 0:
__mod_timer+0x69/0x9d0 kernel/time/timer.c:1038
mod_timer+0x1f/0x30 kernel/time/timer.c:1195
mod_peer_timer drivers/net/wireguard/timers.c:37 [inline]
wg_timers_any_authenticated_packet_traversal+0xd0/0x100 drivers/net/wireguard/timers.c:218
wg_packet_create_data_done drivers/net/wireguard/send.c:247 [inline]
wg_packet_tx_worker+0xeb/0x330 drivers/net/wireguard/send.c:276
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
worker_thread+0x581/0x770 kernel/workqueue.c:3439
kthread+0x22a/0x280 kernel/kthread.c:467
ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
value changed: 0x00000000ffffe904 -> 0x00000000ffffea81
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6384 Comm: kworker/0:7 Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: wg-crypt-wg2 wg_packet_tx_worker
==================================================================
The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt
Reply: r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, {&(0x7f0000000200)={0x34, 0x10, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [
{0x8, 0x3, "wg0\x00"},
{0x14, 0x12, {
{0xe, 0x1, "wireguard\x00"}
}}
]}}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, {&(0x7f0000000400)={0x34, 0x10, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [
{0x8, 0x3, "wg1\x00"},
{0x14, 0x12, {
{0xe, 0x1, "wireguard\x00"}
}}
]}}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id(&(0x7f0000000500)='wireguard\x00')
sendmsg$nl_generic(r1, &(0x7f0000000600)={0x0, 0x0, {&(0x7f0000000700)={0xa8, r2, 0x5, 0x1, 0x0, 0x100, "\x08\x00\x02\x00wg0\x00\x24\x00\x03\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x06\x00\x06\x00\x20\x4e\x00\x00\x60\x00\x08\x00\x5c\x00\x00\x00\x24\x00\x01\x00\x8e\x66\x47\x21\x4f\x8d\x56\x14\x3c\x03\x66\x33\x2e\x19\x63\x06\x43\x5b\x54\x43\x13\x06\x2e\x23\x96\x0c\x71\xa7\x4f\x2d\x43\x16\x14\x00\x04\x00\x02\x00\x21\x4e\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x09\x00\x1c\x00\x00\x00\x06\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x02\x05\x00\x03\x00\x20\x00\x00\x00"}}}, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000800)={0x0, 0x0, {&(0x7f0000000900)={0xa8, r2, 0x5, 0x1, 0x0, 0x100, "\x08\x00\x02\x00wg1\x00\x24\x00\x03\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x06\x00\x06\x00\x21\x4e\x00\x00\x60\x00\x08\x00\x5c\x00\x00\x00\x24\x00\x01\x00\x8e\x66\x47\x21\x4f\x8d\x56\x14\x3c\x03\x66\x33\x2e\x19\x63\x06\x43\x5b\x54\x43\x13\x06\x2e\x23\x96\x0c\x71\xa7\x4f\x2d\x43\x16\x14\x00\x04\x00\x02\x00\x20\x4e\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x09\x00\x1c\x00\x00\x00\x06\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x01\x02\x05\x00\x03\x00\x20\x00\x00\x00"}}}, 0x0)
r3 = socket$inet_dgram(0x2, 0x2, 0x0)
ioctl$sock_inet_siocsi_ifreq(r3, 0x8916, &(0x7f0000000a00)={'wg0\x00', {0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x1}}})
ioctl$sock_inet_siocsi_ifreq(r3, 0x891c, &(0x7f0000000b00)={'wg0\x00', {0x2, 0x0, @ipv4={0xff, 0xff, 0xff, 0x0}}})
ioctl$sock_ifreq(r3, 0x8914, &(0x7f0000000c00)={'wg0\x00', 0x1})
ioctl$sock_inet_siocsi_ifreq(r3, 0x8916, &(0x7f0000000d00)={'wg1\x00', {0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x1}}})
ioctl$sock_inet_siocsi_ifreq(r3, 0x891c, &(0x7f0000000e00)={'wg1\x00', {0x2, 0x0, @ipv4={0xff, 0xff, 0xff, 0x0}}})
ioctl$sock_ifreq(r3, 0x8914, &(0x7f0000000f00)={'wg1\x00', 0x1})
r4 = socket$inet_dgram(0x2, 0x2, 0x0)
sendto$inet(r4, &(0x7f0000001000)='data', 0x4, 0x0, &(0x7f0000001100)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001200)='data', 0x4, 0x0, &(0x7f0000001300)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001400)='data', 0x4, 0x0, &(0x7f0000001500)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001600)='data', 0x4, 0x0, &(0x7f0000001700)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001800)='data', 0x4, 0x0, &(0x7f0000001900)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001a00)='data', 0x4, 0x0, &(0x7f0000001b00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001c00)='data', 0x4, 0x0, &(0x7f0000001d00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x0, 0x2}}, 0x10)
sendto$inet(r4, &(0x7f0000001e00)='data', 0x4, 0x0, &(0x7f0000001f00)={0x2, 0x0, @ipv4={0xa, 0x0, 0x1, 0x2}}, 0x10)
|
| 5/2 |
2026/03/06 01:38 |
llm |
crash-repro-finder |
2m
Model:
Tokens:
input: 2828
output: 43
thoughts: 18320
Thoughts: **Reproducing a KCSAN Data Race in WireGuard's Timer Handling**
My goal is to create a syzkaller program to trigger a data race bug within the WireGuard driver, specifically related to the `__mod_timer` function. The crash report pinpoints the race happening during timer management in `drivers/net/wireguard/timers.c`, and potentially in the packet handling code (`drivers/net/wireguard/receive.c` and `drivers/net/wireguard/send.c`). The core issue is the potential for concurrent modifications of the timer structure when processing packet transmissions and receptions.
The race occurs between two execution paths, both of which eventually call `__mod_timer` via `mod_peer_timer` and `mod_timer`. One path, triggered by packet reception via NAPI polling (`wg_packet_rx_poll`), involves the sequence: `wg_packet_consume_data_done` -> `wg_timers_any_authenticated_packet_traversal` -> `mod_peer_timer` -> `mod_timer` -> `__mod_timer`. The other path, initiated by packet transmission via a workqueue item (`wg_packet_tx_worker`), follows a similar route, but with `wg_packet_create_data_done` instead of `wg_packet_consume_data_done`. These are both triggered after a packet has been processed, whether received or sent. The shared resource is the timer structure within the `wg_peer` struct that's modified.
To reproduce this, I'll set up a WireGuard interface with a configured peer and then generate traffic that simultaneously activates both the transmission and reception paths. The syzkaller description file `socket_netlink_generic_wireguard.txt` will be essential for configuring WireGuard, and I'll use standard socket operations for packet transmission and reception.
The plan involves these steps: First, I create two WireGuard interfaces, `wg0` and `wg1`. Then, I configure each interface with its own private key, a listening port, and configure a peer. Crucially, I'll establish a bidirectional link by having `wg0`'s peer configured to use `wg1`'s public key (and a corresponding endpoint) and `wg1`'s peer configured with `wg0`'s public key (and corresponding endpoint), this can be the loopback. Allowed IPs are set up to force traffic to go *through* the tunnel. After the configuration, assign IPs to the WireGuard interface. Finally, I generate traffic, sending packets from `wg0` to an address that will make the packets be encapsulated by `wg0`, and send packets from `wg1` to an address that makes the packets be encapsulated by `wg1`. Then I simply run a loop sending data through the interfaces, hoping to trigger the race.
The trickiest part is correctly setting up the WireGuard configuration and the routing such that the traffic follows the intended paths. To ensure this, I need to create the two interfaces. Since I cannot easily use network namespaces inside the syzkaller program, I will instead make use of different subnets to ensure that traffic is correctly routed through the WireGuard tunnel. The send and receive operations should then hit the data race in `wg_timers_any_authenticated_packet_traversal`, which calls `mod_peer_timer`. Specifically, I aim to create concurrent access to the timer structures when processing incoming and outgoing WireGuard packets, potentially by exploiting a timing window related to timer updates triggered by keepalives or handshake-related timers, but also during regular data packets. This should produce a KCSAN error.
|
| 6/2 |
2026/03/06 01:41 |
tool |
set-results |
0m
Args: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
|
| 7/2 |
2026/03/06 01:41 |
llm |
crash-repro-finder |
0m
Model:
Tokens:
input: 22002
output: 3001
thoughts: 0
|