[moderation] [wireguard?] KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (7)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8e938e398669 Merge tag '6.9-rc-smb3-client-fixes-part2' of..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14cdfc6e180000
kernel config: https://syzkaller.appspot.com/x/.config?x=5bd3d8ca9a9838e3
dashboard link: https://syzkaller.appspot.com/bug?extid=39260a0ec8ecfc780719
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [Ja...@zx2c4.com da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org pab...@redhat.com wire...@lists.zx2c4.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8db346cb0f59/disk-8e938e39.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9fa19b3e1d2a/vmlinux-8e938e39.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b7cb7ec4e17d/bzImage-8e938e39.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+39260a...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

write to 0xffff8881bdf924c8 of 8 bytes by task 4722 on cpu 1:
__skb_queue_head_init include/linux/skbuff.h:2194 [inline]
skb_queue_splice_init include/linux/skbuff.h:2280 [inline]
wg_packet_send_staged_packets+0xe5/0xae0 drivers/net/wireguard/send.c:351
wg_xmit+0x5c8/0x6a0 drivers/net/wireguard/device.c:218
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x119/0x3f0 net/core/dev.c:3547
__dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
neigh_connected_output+0x258/0x2c0 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0xa73/0xd10 net/ipv6/ip6_output.c:137
ip6_finish_output+0x438/0x540 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0xeb/0x220 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0x4a0/0x6b0 net/ipv6/ndisc.c:509
ndisc_send_rs+0x3b8/0x3f0 net/ipv6/ndisc.c:719
addrconf_dad_completed+0x626/0x8a0 net/ipv6/addrconf.c:4357
addrconf_dad_work+0x891/0xbd0
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
worker_thread+0x526/0x730 kernel/workqueue.c:3416
kthread+0x1d1/0x210 kernel/kthread.c:388
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

read to 0xffff8881bdf924c8 of 8 bytes by task 21200 on cpu 0:
skb_queue_empty include/linux/skbuff.h:1830 [inline]
wg_packet_send_keepalive+0x20/0x100 drivers/net/wireguard/send.c:225
wg_receive_handshake_packet drivers/net/wireguard/receive.c:186 [inline]
wg_packet_handshake_receive_worker+0x449/0x5f0 drivers/net/wireguard/receive.c:213
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
worker_thread+0x526/0x730 kernel/workqueue.c:3416
kthread+0x1d1/0x210 kernel/kthread.c:388
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

value changed: 0xffff8881a82d2f00 -> 0xffff8881bdf924c8

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 21200 Comm: kworker/0:1 Not tainted 6.8.0-syzkaller-12955-g8e938e398669 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: wg-kex-wg2 wg_packet_handshake_receive_worker
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.