KASAN: global-out-of-bounds Read in wg_ratelimiter_gc_entries

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0966d385830d riscv: Fix auipc+jalr relocation range checks
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=11eb4bfe080000
kernel config: https://syzkaller.appspot.com/x/.config?x=6295d67591064921
dashboard link: https://syzkaller.appspot.com/bug?extid=3c30512a976a4db505e8
compiler: riscv64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: riscv64
CC: [Ja...@zx2c4.com da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org pab...@redhat.com wire...@lists.zx2c4.com]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3c3051...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: global-out-of-bounds in wg_ratelimiter_gc_entries+0x1d6/0x31a drivers/net/wireguard/ratelimiter.c:72
Read of size 8 at addr ffffffff858c4c40 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff8047479e>] print_address_description.constprop.0+0x2a/0x330 mm/kasan/report.c:255
[<ffffffff80474d4c>] __kasan_report mm/kasan/report.c:442 [inline]
[<ffffffff80474d4c>] kasan_report+0x184/0x1e0 mm/kasan/report.c:459
[<ffffffff80475b20>] check_region_inline mm/kasan/generic.c:183 [inline]
[<ffffffff80475b20>] __asan_load8+0x6e/0x96 mm/kasan/generic.c:256
[<ffffffff8176ba4c>] wg_ratelimiter_gc_entries+0x1d6/0x31a drivers/net/wireguard/ratelimiter.c:72
[<ffffffff80093b44>] process_one_work+0x654/0xffe kernel/workqueue.c:2307
[<ffffffff8009484e>] worker_thread+0x360/0x8fa kernel/workqueue.c:2454
[<ffffffff800a7f58>] kthread+0x19e/0x1fa kernel/kthread.c:377
[<ffffffff80005724>] ret_from_exception+0x0/0x10

The buggy address belongs to the variable:
__key.0+0x20/0x40

Memory state around the buggy address:
ffffffff858c4b00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9
ffffffff858c4b80: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff858c4c00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9
^
ffffffff858c4c80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff858c4d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.