syzbot


KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (7)

Status: moderation: reported on 2024/03/22 19:02
Subsystems: wireguard
[Documentation on labels]
Reported-by: syzbot+39260a0ec8ecfc780719@syzkaller.appspotmail.com
First crash: 29d, last: 29d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (2) wireguard 1 1228d 1228d 0/26 auto-closed as invalid on 2021/01/13 19:06
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (4) wireguard 1 224d 224d 0/26 auto-obsoleted due to no activity on 2023/10/14 08:22
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (5) wireguard 1 181d 181d 0/26 auto-obsoleted due to no activity on 2023/11/26 10:20
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets wireguard 1 1289d 1289d 0/26 auto-closed as invalid on 2020/11/13 10:47
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (3) wireguard 1 508d 499d 0/26 auto-obsoleted due to no activity on 2023/01/03 22:04
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (6) wireguard 1 101d 99d 0/26 auto-obsoleted due to no activity on 2024/02/14 17:18

Sample crash report:
==================================================================
BUG: KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

write to 0xffff8881bdf924c8 of 8 bytes by task 4722 on cpu 1:
 __skb_queue_head_init include/linux/skbuff.h:2194 [inline]
 skb_queue_splice_init include/linux/skbuff.h:2280 [inline]
 wg_packet_send_staged_packets+0xe5/0xae0 drivers/net/wireguard/send.c:351
 wg_xmit+0x5c8/0x6a0 drivers/net/wireguard/device.c:218
 __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
 netdev_start_xmit include/linux/netdevice.h:4917 [inline]
 xmit_one net/core/dev.c:3531 [inline]
 dev_hard_start_xmit+0x119/0x3f0 net/core/dev.c:3547
 __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335
 dev_queue_xmit include/linux/netdevice.h:3091 [inline]
 neigh_connected_output+0x258/0x2c0 net/core/neighbour.c:1592
 neigh_output include/net/neighbour.h:542 [inline]
 ip6_finish_output2+0xa73/0xd10 net/ipv6/ip6_output.c:137
 ip6_finish_output+0x438/0x540 net/ipv6/ip6_output.c:222
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0xeb/0x220 net/ipv6/ip6_output.c:243
 dst_output include/net/dst.h:450 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ndisc_send_skb+0x4a0/0x6b0 net/ipv6/ndisc.c:509
 ndisc_send_rs+0x3b8/0x3f0 net/ipv6/ndisc.c:719
 addrconf_dad_completed+0x626/0x8a0 net/ipv6/addrconf.c:4357
 addrconf_dad_work+0x891/0xbd0
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

read to 0xffff8881bdf924c8 of 8 bytes by task 21200 on cpu 0:
 skb_queue_empty include/linux/skbuff.h:1830 [inline]
 wg_packet_send_keepalive+0x20/0x100 drivers/net/wireguard/send.c:225
 wg_receive_handshake_packet drivers/net/wireguard/receive.c:186 [inline]
 wg_packet_handshake_receive_worker+0x449/0x5f0 drivers/net/wireguard/receive.c:213
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

value changed: 0xffff8881a82d2f00 -> 0xffff8881bdf924c8

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 21200 Comm: kworker/0:1 Not tainted 6.8.0-syzkaller-12955-g8e938e398669 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: wg-kex-wg2 wg_packet_handshake_receive_worker
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/22 17:48 upstream 8e938e398669 4b6cdce6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets
* Struck through repros no longer work on HEAD.