UBSAN: signed-integer-overflow in ip_idents_reserve

================================================================================
UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
1965623319 + 619165624 cannot be represented in type 'int'
CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
 <IRQ>
 dump_stack+0xfd/0x16e lib/dump_stack.c:118
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:148
 handle_overflow+0x18e/0x1a0 lib/ubsan.c:180
 arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
 atomic_add_return include/asm-generic/atomic-instrumented.h:73 [inline]
 ip_idents_reserve+0x146/0x160 net/ipv4/route.c:521
 __ip_select_ident+0xe4/0x1b0 net/ipv4/route.c:538
 ip_select_ident_segs include/net/ip.h:525 [inline]
 ip_select_ident include/net/ip.h:532 [inline]
 __ip_make_skb+0xf73/0x19b0 net/ipv4/ip_output.c:1551
 ip_finish_skb include/net/ip.h:244 [inline]
 ip_push_pending_frames+0x27/0x80 net/ipv4/ip_output.c:1606
 __icmp_send+0xc1b/0xf60 net/ipv4/icmp.c:776
 icmp_send include/net/icmp.h:43 [inline]
 __udp4_lib_rcv+0x14e5/0x2070 net/ipv4/udp.c:2438
 ip_protocol_deliver_rcu+0x3ad/0x790 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1d5/0x330 net/ipv4/ip_input.c:231
 NF_HOOK+0x255/0x2c0 include/linux/netfilter.h:296
 NF_HOOK+0x255/0x2c0 include/linux/netfilter.h:296
 __netif_receive_skb_one_core net/core/dev.c:5395 [inline]
 __netif_receive_skb+0xcc/0x290 net/core/dev.c:5509
 process_backlog+0x4ef/0x6e0 net/core/dev.c:6416
 napi_poll net/core/dev.c:6867 [inline]
 net_rx_action+0x4ae/0xc20 net/core/dev.c:6937
 __do_softirq+0x263/0x914 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x9b/0xe0 arch/x86/kernel/irq_64.c:77
 do_softirq+0xc4/0x100 kernel/softirq.c:343
 __local_bh_enable_ip+0x11b/0x160 kernel/softirq.c:195
 wg_socket_send_skb_to_peer+0x167/0x1c0 drivers/net/wireguard/socket.c:184
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x16b/0x270 drivers/net/wireguard/send.c:51
 process_one_work+0x855/0xfd0 kernel/workqueue.c:2282
 worker_thread+0xa9b/0x1410 kernel/workqueue.c:2428
 kthread+0x320/0x3b0 kernel/kthread.c:328
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
================================================================================


Warning: Permanently added '10.128.0.223' (ED25519) to the list of known hosts.
2025/08/25 20:49:41 parsed 1 programs
[   66.324080][ T6031] cgroup: Unknown subsys name 'net'
[   66.488600][ T6031] cgroup: Unknown subsys name 'rlimit'
[   68.009768][ T6031] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k FS
[   69.202287][ T6036] IPVS: ftp: loaded support on port[0] = 21
[   69.343606][ T6040] IPVS: ftp: loaded support on port[0] = 21
[   69.473079][ T6044] IPVS: ftp: loaded support on port[0] = 21
[   69.577836][ T6048] IPVS: ftp: loaded support on port[0] = 21
[   69.769802][ T6052] IPVS: ftp: loaded support on port[0] = 21
[   70.048435][ T6056] IPVS: ftp: loaded support on port[0] = 21
[   70.217640][ T6060] IPVS: ftp: loaded support on port[0] = 21
[   70.319826][ T6064] IPVS: ftp: loaded support on port[0] = 21
[   70.474700][ T6068] IPVS: ftp: loaded support on port[0] = 21
[   70.633904][ T6072] IPVS: ftp: loaded support on port[0] = 21
[   70.686470][ T6068] syz-executor (6068) used greatest stack depth: 23784 bytes left
[   70.762739][ T6072] chnl_net:caif_netlink_parms(): no params data found
[   70.821761][ T6072] bridge0: port 1(bridge_slave_0) entered blocking state
[   70.829883][ T6072] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.838196][ T6072] device bridge_slave_0 entered promiscuous mode
[   70.848045][ T6072] bridge0: port 2(bridge_slave_1) entered blocking state
[   70.855260][ T6072] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.863529][ T6072] device bridge_slave_1 entered promiscuous mode
[   70.887520][ T6072] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   70.899967][ T6072] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   70.925301][ T6072] team0: Port device team_slave_0 added
[   70.933854][ T6072] team0: Port device team_slave_1 added
[   70.952277][ T6072] batman_adv: batadv0: Adding interface: batadv_slave_0
[   70.959256][ T6072] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.985337][ T6072] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   70.998670][ T6072] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.005800][ T6072] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.031867][ T6072] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.067474][ T6072] device hsr_slave_0 entered promiscuous mode
[   71.074909][ T6072] device hsr_slave_1 entered promiscuous mode
[   71.188976][ T6072] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   71.199268][ T6072] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   71.208758][ T6072] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   71.219051][ T6072] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   71.269630][ T6072] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.282684][ T6072] bridge0: port 2(bridge_slave_1) entered forwarding state
[   71.291547][ T6072] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.298712][ T6072] bridge0: port 1(bridge_slave_0) entered forwarding state
[   71.392317][ T6072] 8021q: adding VLAN 0 to HW filter on device bond0
[   71.406853][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   71.416783][   T23] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.426170][   T23] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.439446][ T6072] 8021q: adding VLAN 0 to HW filter on device team0
[   71.451361][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   71.460194][   T23] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.467911][   T23] bridge0: port 1(bridge_slave_0) entered forwarding state
[   71.479479][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   71.488708][    T7] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.495851][    T7] bridge0: port 2(bridge_slave_1) entered forwarding state
[   71.517297][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   71.525928][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   71.538566][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   71.550556][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   71.564996][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   71.576295][ T6072] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   71.664953][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   71.673088][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   71.686189][ T6072] 8021q: adding VLAN 0 to HW filter on device batadv0
[   71.705145][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[   71.714655][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   71.733771][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[   71.743752][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   71.771306][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   71.781020][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   71.791138][ T6072] device veth0_vlan entered promiscuous mode
[   71.803584][ T6072] device veth1_vlan entered promiscuous mode
[   71.841298][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   71.849676][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   71.858132][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   71.867040][   T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   71.880244][ T6072] device veth0_macvtap entered promiscuous mode
[   71.905622][ T6072] device veth1_macvtap entered promiscuous mode
[   71.920936][ T6072] batman_adv: batadv0: Interface activated: batadv_slave_0
[   71.929976][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   71.938201][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   71.946726][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   71.956017][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   71.986475][ T6072] batman_adv: batadv0: Interface activated: batadv_slave_1
[   71.994498][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   72.003552][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   72.015508][ T6072] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   72.024889][ T6072] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   72.033761][ T6072] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   72.043370][ T6072] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   72.065816][    C1] ================================================================================
[   72.075426][    C1] UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
[   72.084114][    C1] 1965623319 + 619165624 cannot be represented in type 'int'
[   72.091520][    C1] CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
[   72.098897][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[   72.108970][    C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[   72.115916][    C1] Call Trace:
[   72.119190][    C1]  <IRQ>
[   72.122042][    C1]  dump_stack+0xfd/0x16e
[   72.126277][    C1]  ubsan_epilogue+0xa/0x30
[   72.130725][    C1]  handle_overflow+0x18e/0x1a0
[   72.135497][    C1]  ip_idents_reserve+0x146/0x160
[   72.140435][    C1]  __ip_select_ident+0xe4/0x1b0
[   72.145327][    C1]  __ip_make_skb+0xf73/0x19b0
[   72.150449][    C1]  ip_push_pending_frames+0x27/0x80
[   72.155764][    C1]  __icmp_send+0xc1b/0xf60
[   72.160199][    C1]  __udp4_lib_rcv+0x14e5/0x2070
[   72.165083][    C1]  ip_protocol_deliver_rcu+0x3ad/0x790
[   72.170541][    C1]  ip_local_deliver_finish+0x1d5/0x330
[   72.176018][    C1]  ? NF_HOOK+0x2c0/0x2c0
[   72.180280][    C1]  NF_HOOK+0x255/0x2c0
[   72.184368][    C1]  ? NF_HOOK+0x2c0/0x2c0
[   72.188606][    C1]  ? ip_rcv_core+0xa90/0xa90
[   72.193211][    C1]  NF_HOOK+0x255/0x2c0
[   72.197299][    C1]  ? ip_rcv_core+0xa90/0xa90
[   72.202051][    C1]  ? ip_local_deliver_finish+0x330/0x330
[   72.207690][    C1]  __netif_receive_skb+0xcc/0x290
[   72.212745][    C1]  ? lockdep_hardirqs_on_prepare+0x3d0/0x710
[   72.218735][    C1]  process_backlog+0x4ef/0x6e0
[   72.223529][    C1]  net_rx_action+0x4ae/0xc20
[   72.228165][    C1]  __do_softirq+0x263/0x914
[   72.232676][    C1]  ? asm_call_irq_on_stack+0xf/0x20
[   72.237874][    C1]  asm_call_irq_on_stack+0xf/0x20
[   72.242893][    C1]  </IRQ>
[   72.245848][    C1]  do_softirq_own_stack+0x9b/0xe0
[   72.250866][    C1]  do_softirq+0xc4/0x100
[   72.255109][    C1]  ? wg_socket_send_skb_to_peer+0x167/0x1c0
[   72.260997][    C1]  __local_bh_enable_ip+0x11b/0x160
[   72.266202][    C1]  wg_socket_send_skb_to_peer+0x167/0x1c0
[   72.271916][    C1]  wg_packet_handshake_send_worker+0x16b/0x270
[   72.278084][    C1]  process_one_work+0x855/0xfd0
[   72.283052][    C1]  worker_thread+0xa9b/0x1410
[   72.287740][    C1]  kthread+0x320/0x3b0
[   72.291819][    C1]  ? rcu_lock_release+0x20/0x20
[   72.296687][    C1]  ? kthread_blkcg+0xd0/0xd0
[   72.301272][    C1]  ret_from_fork+0x1f/0x30
[   72.305768][    C1] ================================================================================
[   72.315134][    C1] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[   72.322349][    C1] CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
[   72.329749][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[   72.339808][    C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[   72.346741][    C1] Call Trace:
[   72.350036][    C1]  <IRQ>
[   72.352914][    C1]  dump_stack+0xfd/0x16e
[   72.357159][    C1]  panic+0x2f0/0x9b0
[   72.361055][    C1]  check_panic_on_warn+0x91/0xd0
[   72.366077][    C1]  handle_overflow+0x18e/0x1a0
[   72.370864][    C1]  ip_idents_reserve+0x146/0x160
[   72.375935][    C1]  __ip_select_ident+0xe4/0x1b0
[   72.380789][    C1]  __ip_make_skb+0xf73/0x19b0
[   72.385482][    C1]  ip_push_pending_frames+0x27/0x80
[   72.390682][    C1]  __icmp_send+0xc1b/0xf60
[   72.395126][    C1]  __udp4_lib_rcv+0x14e5/0x2070
[   72.400013][    C1]  ip_protocol_deliver_rcu+0x3ad/0x790
[   72.405476][    C1]  ip_local_deliver_finish+0x1d5/0x330
[   72.410935][    C1]  ? NF_HOOK+0x2c0/0x2c0
[   72.415172][    C1]  NF_HOOK+0x255/0x2c0
[   72.419235][    C1]  ? NF_HOOK+0x2c0/0x2c0
[   72.423936][    C1]  ? ip_rcv_core+0xa90/0xa90
[   72.428516][    C1]  NF_HOOK+0x255/0x2c0
[   72.432582][    C1]  ? ip_rcv_core+0xa90/0xa90
[   72.437163][    C1]  ? ip_local_deliver_finish+0x330/0x330
[   72.442890][    C1]  __netif_receive_skb+0xcc/0x290
[   72.447934][    C1]  ? lockdep_hardirqs_on_prepare+0x3d0/0x710
[   72.453923][    C1]  process_backlog+0x4ef/0x6e0
[   72.458701][    C1]  net_rx_action+0x4ae/0xc20
[   72.463298][    C1]  __do_softirq+0x263/0x914
[   72.467920][    C1]  ? asm_call_irq_on_stack+0xf/0x20
[   72.473267][    C1]  asm_call_irq_on_stack+0xf/0x20
[   72.478303][    C1]  </IRQ>
[   72.481257][    C1]  do_softirq_own_stack+0x9b/0xe0
[   72.486300][    C1]  do_softirq+0xc4/0x100
[   72.490550][    C1]  ? wg_socket_send_skb_to_peer+0x167/0x1c0
[   72.496441][    C1]  __local_bh_enable_ip+0x11b/0x160
[   72.501642][    C1]  wg_socket_send_skb_to_peer+0x167/0x1c0
[   72.507378][    C1]  wg_packet_handshake_send_worker+0x16b/0x270
[   72.513546][    C1]  process_one_work+0x855/0xfd0
[   72.518410][    C1]  worker_thread+0xa9b/0x1410
[   72.523151][    C1]  kthread+0x320/0x3b0
[   72.527236][    C1]  ? rcu_lock_release+0x20/0x20
[   72.532106][    C1]  ? kthread_blkcg+0xd0/0xd0
[   72.536696][    C1]  ret_from_fork+0x1f/0x30
[   72.541496][    C1] Kernel Offset: disabled
[   72.545964][    C1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1003196050=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at ed351ea732
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=ed351ea732d889c7798e7f0226bcaec65a8a6b52 -X github.com/google/syzkaller/prog.gitRevisionDate=20250523-163038"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"ed351ea732d889c7798e7f0226bcaec65a8a6b52\"
/usr/bin/ld: /tmp/cchavOiX.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking