syzbot


KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (3)

Status: auto-obsoleted due to no activity on 2023/01/03 22:04
Subsystems: wireguard
[Documentation on labels]
Reported-by: syzbot+6ffa235134911e85d8a7@syzkaller.appspotmail.com
First crash: 507d, last: 507d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (2) wireguard 1 1227d 1227d 0/26 auto-closed as invalid on 2021/01/13 19:06
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (7) wireguard 1 28d 28d 0/26 moderation: reported on 2024/03/22 19:02
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (4) wireguard 1 223d 223d 0/26 auto-obsoleted due to no activity on 2023/10/14 08:22
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (5) wireguard 1 180d 180d 0/26 auto-obsoleted due to no activity on 2023/11/26 10:20
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets wireguard 1 1288d 1288d 0/26 auto-closed as invalid on 2020/11/13 10:47
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (6) wireguard 1 100d 98d 0/26 auto-obsoleted due to no activity on 2024/02/14 17:18

Sample crash report:
==================================================================
BUG: KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

write to 0xffff888139fdd318 of 8 bytes by interrupt on cpu 0:
 __skb_queue_head_init include/linux/skbuff.h:2126 [inline]
 skb_queue_splice_init include/linux/skbuff.h:2212 [inline]
 wg_packet_send_staged_packets+0xee/0xa80 drivers/net/wireguard/send.c:350
 wg_xmit+0x5df/0x6b0 drivers/net/wireguard/device.c:217
 __netdev_start_xmit include/linux/netdevice.h:4840 [inline]
 netdev_start_xmit include/linux/netdevice.h:4854 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3590
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606
 __dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4256
 dev_queue_xmit include/linux/netdevice.h:3008 [inline]
 neigh_connected_output+0x25c/0x2d0 net/core/neighbour.c:1600
 neigh_output include/net/neighbour.h:546 [inline]
 ip6_finish_output2+0xa12/0xc30 net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
 ip6_finish_output+0x395/0x4f0 net/ipv6/ip6_output.c:206
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:227
 dst_output include/net/dst.h:445 [inline]
 NF_HOOK include/linux/netfilter.h:302 [inline]
 ndisc_send_skb+0x49f/0x650 net/ipv6/ndisc.c:508
 ndisc_send_rs+0x3c0/0x3f0 net/ipv6/ndisc.c:718
 addrconf_rs_timer+0x1de/0x320 net/ipv6/addrconf.c:3931
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
 expire_timers+0x116/0x240 kernel/time/timer.c:1519
 __run_timers+0x350/0x400 kernel/time/timer.c:1790
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
 __do_softirq+0xf2/0x2c7 kernel/softirq.c:571
 __irq_exit_rcu kernel/softirq.c:650 [inline]
 irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1107
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:572 [inline]
 acpi_idle_enter+0x283/0x340 drivers/acpi/processor_idle.c:709
 cpuidle_enter_state+0x2de/0x960 drivers/cpuidle/cpuidle.c:239
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:356
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x1a7/0x250 kernel/sched/idle.c:303
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
 rest_init+0xe8/0xf0 init/main.c:729
 start_kernel+0x0/0x660 init/main.c:890
 start_kernel+0x5db/0x660 init/main.c:1145
 secondary_startup_64_no_verify+0xcf/0xdb

read to 0xffff888139fdd318 of 8 bytes by interrupt on cpu 1:
 skb_queue_empty include/linux/skbuff.h:1762 [inline]
 wg_packet_send_keepalive+0x1c/0x100 drivers/net/wireguard/send.c:225
 wg_expired_send_persistent_keepalive+0x38/0x50 drivers/net/wireguard/timers.c:141
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
 expire_timers+0x116/0x240 kernel/time/timer.c:1519
 __run_timers+0x350/0x400 kernel/time/timer.c:1790
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
 __do_softirq+0xf2/0x2c7 kernel/softirq.c:571
 __irq_exit_rcu kernel/softirq.c:650 [inline]
 irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1107
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:572 [inline]
 acpi_idle_enter+0x283/0x340 drivers/acpi/processor_idle.c:709
 cpuidle_enter_state+0x2de/0x960 drivers/cpuidle/cpuidle.c:239
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:356
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x1a7/0x250 kernel/sched/idle.c:303
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
 start_secondary+0x78/0x80 arch/x86/kernel/smpboot.c:262
 secondary_startup_64_no_verify+0xcf/0xdb

value changed: 0xffff888139fdd318 -> 0xffff88810763c200

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/29 22:04 upstream ca57f02295f1 579a3740 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets
* Struck through repros no longer work on HEAD.