Oops: general protection fault, probably for non-canonical address 0xe003fbfffff80000: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x001fffffffc00000-0x001fffffffc00007]
CPU: 0 UID: 0 PID: 3000 Comm: kworker/u8:6 Not tainted 6.15.0-rc2-syzkaller-00042-g1a1d569a75f3 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker
RIP: 0010:get_work_pool+0xea/0x180 kernel/workqueue.c:887
Code: de e8 fa 7a 38 00 81 fb ff ff ff 7f 75 37 e8 0d 76 38 00 31 c0 eb 25 e8 04 76 38 00 48 81 e3 00 fe ff ff 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 77 1e a0 00 48 8b 03 5b 41 5e 5d
RSP: 0018:ffffc90000007148 EFLAGS: 00010006
RAX: 0003fffffff80000 RBX: 001fffffffc00000 RCX: ffff888030a05a00
RDX: 0000000000000100 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff818ace39 R09: 1ffffd1ffffa6590
R10: dffffc0000000000 R11: fffff91ffffa6591 R12: 1ffff1100446fd38
R13: ffff88807d38e800 R14: dffffc0000000000 R15: ffffe8ffffd32c80
FS: 0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558f48669668 CR3: 0000000054cf2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__queue_work+0x602/0x10a0 kernel/workqueue.c:2283
queue_work_on+0x1c4/0x380 kernel/workqueue.c:2392
wg_packet_receive+0x1344/0x2580 drivers/net/wireguard/receive.c:570
wg_receive+0x75/0xa0 drivers/net/wireguard/socket.c:326
udp_queue_rcv_one_skb+0x1616/0x1820 net/ipv4/udp.c:2385
udp_unicast_rcv_skb+0x255/0x3d0 net/ipv4/udp.c:2623
__udp4_lib_rcv+0x136d/0x2720 net/ipv4/udp.c:2699
ip_protocol_deliver_rcu+0x290/0x450 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x343/0x600 net/ipv4/ip_input.c:233
NF_HOOK+0x3a0/0x450 include/linux/netfilter.h:314
NF_HOOK+0x3a0/0x450 include/linux/netfilter.h:314
__netif_receive_skb_one_core net/core/dev.c:5885 [inline]
__netif_receive_skb+0x2c9/0x670 net/core/dev.c:5998
process_backlog+0x664/0x15c0 net/core/dev.c:6350
__napi_poll+0xcb/0x480 net/core/dev.c:7322
napi_poll net/core/dev.c:7386 [inline]
net_rx_action+0x89d/0x1240 net/core/dev.c:7508
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
do_softirq+0x11f/0x1e0 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x1be/0x200 kernel/softirq.c:407
wg_socket_send_skb_to_peer+0x176/0x1d0 drivers/net/wireguard/socket.c:184
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x1ef/0x330 drivers/net/wireguard/send.c:51
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd50 kernel/workqueue.c:3400
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:get_work_pool+0xea/0x180 kernel/workqueue.c:887
Code: de e8 fa 7a 38 00 81 fb ff ff ff 7f 75 37 e8 0d 76 38 00 31 c0 eb 25 e8 04 76 38 00 48 81 e3 00 fe ff ff 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 77 1e a0 00 48 8b 03 5b 41 5e 5d
RSP: 0018:ffffc90000007148 EFLAGS: 00010006
RAX: 0003fffffff80000 RBX: 001fffffffc00000 RCX: ffff888030a05a00
RDX: 0000000000000100 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff818ace39 R09: 1ffffd1ffffa6590
R10: dffffc0000000000 R11: fffff91ffffa6591 R12: 1ffff1100446fd38
R13: ffff88807d38e800 R14: dffffc0000000000 R15: ffffe8ffffd32c80
FS: 0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558f48669668 CR3: 0000000054cf2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 fa 7a 38 00 call 0x387aff
5: 81 fb ff ff ff 7f cmp $0x7fffffff,%ebx
b: 75 37 jne 0x44
d: e8 0d 76 38 00 call 0x38761f
12: 31 c0 xor %eax,%eax
14: eb 25 jmp 0x3b
16: e8 04 76 38 00 call 0x38761f
1b: 48 81 e3 00 fe ff ff and $0xfffffffffffffe00,%rbx
22: 48 89 d8 mov %rbx,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 77 1e a0 00 call 0xa01eaf
38: 48 8b 03 mov (%rbx),%rax
3b: 5b pop %rbx
3c: 41 5e pop %r14
3e: 5d pop %rbp