UBSAN: signed-integer-overflow in ip_idents_reserve
================================================================================
UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
1563201173 + 1189317890 cannot be represented in type 'int'
CPU: 1 PID: 222 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
dump_stack+0xfd/0x16e lib/dump_stack.c:118
ubsan_epilogue+0xa/0x30 lib/ubsan.c:148
handle_overflow+0x18e/0x1a0 lib/ubsan.c:180
arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
atomic_add_return include/asm-generic/atomic-instrumented.h:73 [inline]
ip_idents_reserve+0x146/0x160 net/ipv4/route.c:521
__ip_select_ident+0xe4/0x1b0 net/ipv4/route.c:538
ip_select_ident_segs include/net/ip.h:525 [inline]
ip_select_ident include/net/ip.h:532 [inline]
__ip_make_skb+0xf73/0x19b0 net/ipv4/ip_output.c:1551
ip_finish_skb include/net/ip.h:244 [inline]
ip_push_pending_frames+0x27/0x80 net/ipv4/ip_output.c:1606
__icmp_send+0xc1b/0xf60 net/ipv4/icmp.c:776
icmp_send include/net/icmp.h:43 [inline]
__udp4_lib_rcv+0x14e5/0x2070 net/ipv4/udp.c:2438
ip_protocol_deliver_rcu+0x3ad/0x790 net/ipv4/ip_input.c:204
ip_local_deliver_finish+0x1d5/0x330 net/ipv4/ip_input.c:231
NF_HOOK+0x255/0x2c0 include/linux/netfilter.h:296
NF_HOOK+0x255/0x2c0 include/linux/netfilter.h:296
__netif_receive_skb_one_core net/core/dev.c:5395 [inline]
__netif_receive_skb+0xcc/0x290 net/core/dev.c:5509
process_backlog+0x4ef/0x6e0 net/core/dev.c:6416
napi_poll net/core/dev.c:6867 [inline]
net_rx_action+0x4ae/0xc20 net/core/dev.c:6937
__do_softirq+0x263/0x914 kernel/softirq.c:298
asm_call_irq_on_stack+0xf/0x20
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x9b/0xe0 arch/x86/kernel/irq_64.c:77
do_softirq+0xc4/0x100 kernel/softirq.c:343
__local_bh_enable_ip+0x11b/0x160 kernel/softirq.c:195
wg_socket_send_skb_to_peer+0x167/0x1c0 drivers/net/wireguard/socket.c:184
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x16b/0x270 drivers/net/wireguard/send.c:51
process_one_work+0x855/0xfd0 kernel/workqueue.c:2282
worker_thread+0xa9b/0x1410 kernel/workqueue.c:2428
kthread+0x320/0x3b0 kernel/kthread.c:328
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
================================================================================
Warning: Permanently added '10.128.1.246' (ED25519) to the list of known hosts.
2025/09/07 12:29:33 parsed 1 programs
[ 74.278128][ T6034] cgroup: Unknown subsys name 'net'
[ 74.422193][ T6034] cgroup: Unknown subsys name 'rlimit'
[ 75.901128][ T6034] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 76.509912][ T3304] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.516539][ T3304] ieee802154 phy1 wpan1: encryption failed: -22
[ 77.124742][ T6046] IPVS: ftp: loaded support on port[0] = 21
[ 77.390460][ T6050] IPVS: ftp: loaded support on port[0] = 21
[ 77.680498][ T6056] IPVS: ftp: loaded support on port[0] = 21
[ 77.813449][ T6060] IPVS: ftp: loaded support on port[0] = 21
[ 77.949141][ T6063] IPVS: ftp: loaded support on port[0] = 21
[ 78.042083][ T6065] IPVS: ftp: loaded support on port[0] = 21
[ 78.192084][ T6069] IPVS: ftp: loaded support on port[0] = 21
[ 78.322106][ T6073] IPVS: ftp: loaded support on port[0] = 21
[ 78.576839][ T6080] IPVS: ftp: loaded support on port[0] = 21
[ 78.722889][ T6084] IPVS: ftp: loaded support on port[0] = 21
[ 78.939328][ T6088] IPVS: ftp: loaded support on port[0] = 21
[ 79.135433][ T6088] chnl_net:caif_netlink_parms(): no params data found
[ 79.192855][ T6088] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.200267][ T6088] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.208681][ T6088] device bridge_slave_0 entered promiscuous mode
[ 79.218577][ T6088] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.226291][ T6088] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.234280][ T6088] device bridge_slave_1 entered promiscuous mode
[ 79.259729][ T6088] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.271098][ T6088] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 79.298601][ T6088] team0: Port device team_slave_0 added
[ 79.310370][ T6088] team0: Port device team_slave_1 added
[ 79.338126][ T6088] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 79.345245][ T6088] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.372111][ T6088] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 79.394334][ T6088] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 79.401881][ T6088] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.428997][ T6088] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 79.478773][ T6088] device hsr_slave_0 entered promiscuous mode
[ 79.488414][ T6088] device hsr_slave_1 entered promiscuous mode
[ 79.575175][ T6088] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 79.586176][ T6088] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 79.595223][ T6088] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 79.604898][ T6088] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 79.628391][ T6088] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.635600][ T6088] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 79.643697][ T6088] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.650833][ T6088] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 79.697516][ T6088] 8021q: adding VLAN 0 to HW filter on device bond0
[ 79.711561][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 79.722812][ T222] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.731158][ T222] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.746546][ T6088] 8021q: adding VLAN 0 to HW filter on device team0
[ 79.759209][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 79.768312][ T222] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.775395][ T222] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 79.790236][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 79.800168][ T222] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.807290][ T222] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 79.846771][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 79.855557][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 79.866837][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 79.881300][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 79.913789][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 79.924528][ T6088] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 80.028345][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 80.039083][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 80.055073][ T6088] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 80.085218][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 80.094878][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 80.118538][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 80.127744][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 80.158373][ T6088] device veth0_vlan entered promiscuous mode
[ 80.165584][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 80.174433][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 80.187761][ T6088] device veth1_vlan entered promiscuous mode
[ 80.231514][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 80.239985][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 80.248267][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 80.256924][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 80.268100][ T6088] device veth0_macvtap entered promiscuous mode
[ 80.293349][ T6088] device veth1_macvtap entered promiscuous mode
[ 80.309672][ T6088] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 80.319792][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 80.329070][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 80.337635][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 80.347072][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 80.361389][ T6088] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 80.369977][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 80.378863][ T222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 80.402927][ T6088] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.412241][ T6088] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.421550][ T6088] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.431781][ T6088] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.457635][ C1] ================================================================================
[ 80.467162][ C1] UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
[ 80.475876][ C1] 1563201173 + 1189317890 cannot be represented in type 'int'
[ 80.483483][ C1] CPU: 1 PID: 222 Comm: kworker/u4:5 Not tainted syzkaller #0
[ 80.490952][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 80.501026][ C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[ 80.507979][ C1] Call Trace:
[ 80.511253][ C1]
[ 80.514101][ C1] dump_stack+0xfd/0x16e
[ 80.518344][ C1] ubsan_epilogue+0xa/0x30
[ 80.522754][ C1] handle_overflow+0x18e/0x1a0
[ 80.527629][ C1] ip_idents_reserve+0x146/0x160
[ 80.532585][ C1] __ip_select_ident+0xe4/0x1b0
[ 80.537445][ C1] __ip_make_skb+0xf73/0x19b0
[ 80.542212][ C1] ip_push_pending_frames+0x27/0x80
[ 80.547408][ C1] __icmp_send+0xc1b/0xf60
[ 80.551853][ C1] __udp4_lib_rcv+0x14e5/0x2070
[ 80.556711][ C1] ip_protocol_deliver_rcu+0x3ad/0x790
[ 80.562188][ C1] ip_local_deliver_finish+0x1d5/0x330
[ 80.567646][ C1] ? NF_HOOK+0x2c0/0x2c0
[ 80.571899][ C1] NF_HOOK+0x255/0x2c0
[ 80.576061][ C1] ? NF_HOOK+0x2c0/0x2c0
[ 80.580314][ C1] ? ip_rcv_core+0xa90/0xa90
[ 80.584912][ C1] NF_HOOK+0x255/0x2c0
[ 80.588977][ C1] ? ip_rcv_core+0xa90/0xa90
[ 80.593575][ C1] ? ip_local_deliver_finish+0x330/0x330
[ 80.599209][ C1] __netif_receive_skb+0xcc/0x290
[ 80.604247][ C1] ? lockdep_hardirqs_on_prepare+0x3d0/0x710
[ 80.610227][ C1] process_backlog+0x4ef/0x6e0
[ 80.615036][ C1] net_rx_action+0x4ae/0xc20
[ 80.619629][ C1] __do_softirq+0x263/0x914
[ 80.624142][ C1] ? asm_call_irq_on_stack+0xf/0x20
[ 80.629347][ C1] asm_call_irq_on_stack+0xf/0x20
[ 80.634537][ C1]
[ 80.637471][ C1] do_softirq_own_stack+0x9b/0xe0
[ 80.642484][ C1] do_softirq+0xc4/0x100
[ 80.646727][ C1] ? wg_socket_send_skb_to_peer+0x167/0x1c0
[ 80.652615][ C1] __local_bh_enable_ip+0x11b/0x160
[ 80.657813][ C1] wg_socket_send_skb_to_peer+0x167/0x1c0
[ 80.663617][ C1] wg_packet_handshake_send_worker+0x16b/0x270
[ 80.669777][ C1] process_one_work+0x855/0xfd0
[ 80.674631][ C1] worker_thread+0xa9b/0x1410
[ 80.679329][ C1] kthread+0x320/0x3b0
[ 80.683401][ C1] ? rcu_lock_release+0x20/0x20
[ 80.688265][ C1] ? kthread_blkcg+0xd0/0xd0
[ 80.692942][ C1] ret_from_fork+0x1f/0x30
[ 80.697414][ C1] ================================================================================
[ 80.706757][ C1] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 80.714072][ C1] CPU: 1 PID: 222 Comm: kworker/u4:5 Not tainted syzkaller #0
[ 80.721539][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 80.731609][ C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[ 80.738562][ C1] Call Trace:
[ 80.741854][ C1]
[ 80.744710][ C1] dump_stack+0xfd/0x16e
[ 80.748955][ C1] panic+0x2f0/0x9b0
[ 80.752923][ C1] check_panic_on_warn+0x91/0xd0
[ 80.757869][ C1] handle_overflow+0x18e/0x1a0
[ 80.762669][ C1] ip_idents_reserve+0x146/0x160
[ 80.767755][ C1] __ip_select_ident+0xe4/0x1b0
[ 80.772619][ C1] __ip_make_skb+0xf73/0x19b0
[ 80.777309][ C1] ip_push_pending_frames+0x27/0x80
[ 80.782525][ C1] __icmp_send+0xc1b/0xf60
[ 80.787022][ C1] __udp4_lib_rcv+0x14e5/0x2070
[ 80.791889][ C1] ip_protocol_deliver_rcu+0x3ad/0x790
[ 80.797382][ C1] ip_local_deliver_finish+0x1d5/0x330
[ 80.802847][ C1] ? NF_HOOK+0x2c0/0x2c0
[ 80.807122][ C1] NF_HOOK+0x255/0x2c0
[ 80.811219][ C1] ? NF_HOOK+0x2c0/0x2c0
[ 80.815462][ C1] ? ip_rcv_core+0xa90/0xa90
[ 80.820059][ C1] NF_HOOK+0x255/0x2c0
[ 80.824132][ C1] ? ip_rcv_core+0xa90/0xa90
[ 80.828732][ C1] ? ip_local_deliver_finish+0x330/0x330
[ 80.834551][ C1] __netif_receive_skb+0xcc/0x290
[ 80.839593][ C1] ? lockdep_hardirqs_on_prepare+0x3d0/0x710
[ 80.845666][ C1] process_backlog+0x4ef/0x6e0
[ 80.850439][ C1] net_rx_action+0x4ae/0xc20
[ 80.855032][ C1] __do_softirq+0x263/0x914
[ 80.859539][ C1] ? asm_call_irq_on_stack+0xf/0x20
[ 80.864758][ C1] asm_call_irq_on_stack+0xf/0x20
[ 80.869778][ C1]
[ 80.872718][ C1] do_softirq_own_stack+0x9b/0xe0
[ 80.877772][ C1] do_softirq+0xc4/0x100
[ 80.882010][ C1] ? wg_socket_send_skb_to_peer+0x167/0x1c0
[ 80.887895][ C1] __local_bh_enable_ip+0x11b/0x160
[ 80.893110][ C1] wg_socket_send_skb_to_peer+0x167/0x1c0
[ 80.898828][ C1] wg_packet_handshake_send_worker+0x16b/0x270
[ 80.904990][ C1] process_one_work+0x855/0xfd0
[ 80.909850][ C1] worker_thread+0xa9b/0x1410
[ 80.914658][ C1] kthread+0x320/0x3b0
[ 80.919092][ C1] ? rcu_lock_release+0x20/0x20
[ 80.924071][ C1] ? kthread_blkcg+0xd0/0xd0
[ 80.928667][ C1] ret_from_fork+0x1f/0x30
[ 80.933626][ C1] Kernel Offset: disabled
[ 80.938079][ C1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3326734779=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=)
HEAD detached at ed351ea732
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=ed351ea732d889c7798e7f0226bcaec65a8a6b52 -X github.com/google/syzkaller/prog.gitRevisionDate=20250523-163038" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"ed351ea732d889c7798e7f0226bcaec65a8a6b52\"
/usr/bin/ld: /tmp/ccXXMyjz.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking