KCSAN: data-race in skb_queue_tail / wg_packet_handshake_receive

KCSAN: data-race in skb_queue_tail / wg_packet_handshake_receive_worker
Status: auto-closed as invalid on 2020/07/30 18:23
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 401d, last: 401d

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in skb_queue_tail / wg_packet_handshake_receive_worker (2)				5	139d	235d	0/22	auto-closed as invalid on 2021/04/19 00:06

Sample crash report:

==================================================================
BUG: KCSAN: data-race in skb_queue_tail / wg_packet_handshake_receive_worker

write to 0xffff8880a53a8bf0 of 4 bytes by interrupt on cpu 0:
 __skb_insert include/linux/skbuff.h:1896 [inline]
 __skb_queue_before include/linux/skbuff.h:2001 [inline]
 __skb_queue_tail include/linux/skbuff.h:2034 [inline]
 skb_queue_tail+0x80/0xa0 net/core/skbuff.c:3144
 wg_packet_receive+0x5b6/0xd70 drivers/net/wireguard/receive.c:575
 wg_receive+0x4a/0x70 drivers/net/wireguard/socket.c:325
 udpv6_queue_rcv_one_skb+0x8df/0x9e0 net/ipv6/udp.c:631
 udpv6_queue_rcv_skb+0xd2/0x460 net/ipv6/udp.c:689
 udp6_unicast_rcv_skb net/ipv6/udp.c:831 [inline]
 __udp6_lib_rcv+0xc3a/0x1640 net/ipv6/udp.c:915
 udpv6_rcv+0x1d/0x20 net/ipv6/udp.c:1017
 ip6_protocol_deliver_rcu+0x71b/0xc60 net/ipv6/ip6_input.c:433
 ip6_input_finish net/ipv6/ip6_input.c:474 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_input+0x76/0x120 net/ipv6/ip6_input.c:483
 dst_input include/net/dst.h:441 [inline]
 ip6_rcv_finish+0x1d5/0x260 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x88/0x140 net/ipv6/ip6_input.c:307
 __netif_receive_skb_one_core net/core/dev.c:5279 [inline]
 __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5393
 process_backlog+0x29f/0x4a0 net/core/dev.c:6237
 napi_poll+0x154/0x480 net/core/dev.c:6682
 net_rx_action+0x1ba/0x530 net/core/dev.c:6750
 __do_softirq+0x198/0x360 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x5d/0x80 arch/x86/kernel/irq_64.c:77
 do_softirq+0x86/0xb0 kernel/softirq.c:337
 __local_bh_enable_ip+0x63/0x70 kernel/softirq.c:189
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:251 [inline]
 _raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:279
 wg_socket_send_skb_to_peer drivers/net/wireguard/socket.c:183 [inline]
 wg_socket_send_buffer_to_peer+0x1e0/0x210 drivers/net/wireguard/socket.c:199
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0xf9/0x140 drivers/net/wireguard/send.c:51
 process_one_work+0x3cb/0x990 kernel/workqueue.c:2269
 worker_thread+0x665/0xbe0 kernel/workqueue.c:2415
 kthread+0x210/0x220 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

read to 0xffff8880a53a8bf0 of 4 bytes by task 17 on cpu 1:
 wg_receive_handshake_packet drivers/net/wireguard/receive.c:119 [inline]
 wg_packet_handshake_receive_worker+0xdd/0x480 drivers/net/wireguard/receive.c:220
 process_one_work+0x3cb/0x990 kernel/workqueue.c:2269
 worker_thread+0x665/0xbe0 kernel/workqueue.c:2415
 kthread+0x210/0x220 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.8.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: wg-kex-wg1 wg_packet_handshake_receive_worker
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-upstream-kcsan-gce	2020/06/25 18:16	upstream	8be3a53e18e0	c7b4497a	.config	log	report