KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ca57f02295f1 afs: Fix fileserver probe RTT handling
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1649f2c3880000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1cbef5d9146e0f4
dashboard link: https://syzkaller.appspot.com/bug?extid=6ffa235134911e85d8a7
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
CC: [Ja...@zx2c4.com da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org pab...@redhat.com wire...@lists.zx2c4.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e014cbc38fca/disk-ca57f022.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1de8402be89f/vmlinux-ca57f022.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b228cf94b807/bzImage-ca57f022.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6ffa23...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

write to 0xffff888139fdd318 of 8 bytes by interrupt on cpu 0:
__skb_queue_head_init include/linux/skbuff.h:2126 [inline]
skb_queue_splice_init include/linux/skbuff.h:2212 [inline]
wg_packet_send_staged_packets+0xee/0xa80 drivers/net/wireguard/send.c:350
wg_xmit+0x5df/0x6b0 drivers/net/wireguard/device.c:217
__netdev_start_xmit include/linux/netdevice.h:4840 [inline]
netdev_start_xmit include/linux/netdevice.h:4854 [inline]
xmit_one+0xc0/0x2a0 net/core/dev.c:3590
dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606
__dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4256
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_connected_output+0x25c/0x2d0 net/core/neighbour.c:1600
neigh_output include/net/neighbour.h:546 [inline]
ip6_finish_output2+0xa12/0xc30 net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x395/0x4f0 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0x49f/0x650 net/ipv6/ndisc.c:508
ndisc_send_rs+0x3c0/0x3f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x1de/0x320 net/ipv6/addrconf.c:3931
call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
expire_timers+0x116/0x240 kernel/time/timer.c:1519
__run_timers+0x350/0x400 kernel/time/timer.c:1790
run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
__do_softirq+0xf2/0x2c7 kernel/softirq.c:571
__irq_exit_rcu kernel/softirq.c:650 [inline]
irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
acpi_idle_do_entry drivers/acpi/processor_idle.c:572 [inline]
acpi_idle_enter+0x283/0x340 drivers/acpi/processor_idle.c:709
cpuidle_enter_state+0x2de/0x960 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x1a7/0x250 kernel/sched/idle.c:303
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
rest_init+0xe8/0xf0 init/main.c:729
start_kernel+0x0/0x660 init/main.c:890
start_kernel+0x5db/0x660 init/main.c:1145
secondary_startup_64_no_verify+0xcf/0xdb

read to 0xffff888139fdd318 of 8 bytes by interrupt on cpu 1:
skb_queue_empty include/linux/skbuff.h:1762 [inline]
wg_packet_send_keepalive+0x1c/0x100 drivers/net/wireguard/send.c:225
wg_expired_send_persistent_keepalive+0x38/0x50 drivers/net/wireguard/timers.c:141
call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
expire_timers+0x116/0x240 kernel/time/timer.c:1519
__run_timers+0x350/0x400 kernel/time/timer.c:1790
run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
__do_softirq+0xf2/0x2c7 kernel/softirq.c:571
__irq_exit_rcu kernel/softirq.c:650 [inline]
irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
acpi_idle_do_entry drivers/acpi/processor_idle.c:572 [inline]
acpi_idle_enter+0x283/0x340 drivers/acpi/processor_idle.c:709
cpuidle_enter_state+0x2de/0x960 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x1a7/0x250 kernel/sched/idle.c:303
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
start_secondary+0x78/0x80 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xcf/0xdb

value changed: 0xffff888139fdd318 -> 0xffff88810763c200

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.