syzbot


KCSAN: data-race in __ip_select_ident / crng_fast_key_erasure

Status: auto-obsoleted due to no activity on 2025/10/08 12:00
Subsystems: net
[Documentation on labels]
First crash: 59d, last: 59d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __ip_select_ident / crng_fast_key_erasure

read to 0xffff88811f9765a8 of 8 bytes by task 10 on cpu 0:
 siphash_key_is_zero include/linux/siphash.h:27 [inline]
 __ip_select_ident+0x2e/0x1a0 net/ipv4/route.c:496
 iptunnel_xmit+0x344/0x480 net/ipv4/ip_tunnel_core.c:82
 udp_tunnel_xmit_skb+0x1aa/0x1f0 net/ipv4/udp_tunnel_core.c:192
 geneve_xmit_skb drivers/net/geneve.c:922 [inline]
 geneve_xmit+0x16ff/0x1940 drivers/net/geneve.c:1048
 __netdev_start_xmit include/linux/netdevice.h:5219 [inline]
 netdev_start_xmit include/linux/netdevice.h:5228 [inline]
 xmit_one net/core/dev.c:3827 [inline]
 dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3843
 __dev_queue_xmit+0x10f9/0x2000 net/core/dev.c:4713
 dev_queue_xmit include/linux/netdevice.h:3358 [inline]
 neigh_resolve_output+0x3f3/0x460 net/core/neighbour.c:1595
 neigh_output include/net/neighbour.h:547 [inline]
 ip6_finish_output2+0xa66/0xd30 net/ipv6/ip6_output.c:141
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x3a4/0x540 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0xfd/0x240 net/ipv6/ip6_output.c:248
 dst_output include/net/dst.h:461 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 mld_sendpack+0x42b/0x6f0 net/ipv6/mcast.c:1860
 mld_send_cr net/ipv6/mcast.c:2159 [inline]
 mld_ifc_work+0x55c/0x840 net/ipv6/mcast.c:2698
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

write to 0xffff88811f9765a8 of 16 bytes by task 4348 on cpu 1:
 crng_fast_key_erasure+0xd9/0x110 drivers/char/random.c:329
 crng_make_state+0xc0/0x250 drivers/char/random.c:392
 _get_random_bytes+0x85/0x190 drivers/char/random.c:406
 get_random_bytes+0x1d/0x30 drivers/char/random.c:438
 __ip_select_ident+0x198/0x1a0 net/ipv4/route.c:497
 iptunnel_xmit+0x344/0x480 net/ipv4/ip_tunnel_core.c:82
 udp_tunnel_xmit_skb+0x1aa/0x1f0 net/ipv4/udp_tunnel_core.c:192
 send4+0x494/0x580 drivers/net/wireguard/socket.c:85
 wg_socket_send_skb_to_peer+0x95/0x130 drivers/net/wireguard/socket.c:175
 wg_socket_send_buffer_to_peer+0xf1/0x120 drivers/net/wireguard/socket.c:200
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x10d/0x160 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4348 Comm: kworker/u8:56 Tainted: G        W           6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/13 11:58 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ip_select_ident / crng_fast_key_erasure
* Struck through repros no longer work on HEAD.