diff options
| author |   Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> | 2026-10-11 17:23:22 +0700 |
|---|---|---|
| committer |   Jason A. Donenfeld <Jason@zx2c4.com> | 2026-11-10 17:19:07 +0100 |
| commit | 1c7027826cb7697749f4666f8d651ea88c406c53 (patch) | |
| tree | 6236628c6a874df7d14ddba79d308c0c355663a7 /include/uapi/linux/netfilter/ipset | |
| parent | wireguard: noise: reject response consumption after intermediate initiation (diff) | |
wg_set_device_doit() updates peer->persistent_keepalive_interval under
device_update_lock, while the RX/TX paths read it locklessly in
wg_timers_any_authenticated_packet_traversal() and in the persistent
keepalive timer. KCSAN reports the race:
BUG: KCSAN: data-race in set_peer / wg_timers_any_authenticated_packet_traversal
write to ... by task 3648 on cpu 1:
set_peer+0x... drivers/net/wireguard/netlink.c:457
wg_set_device_doit+0x...
read to ... by task 3652 on cpu 0:
wg_timers_any_authenticated_packet_traversal+0x... timers.c:217
wg_packet_consume_data_done+0x...
wg_packet_rx_poll+0x...
The race is benign, but the reader also loads the field twice, so the
zero check and the timer expiry computation can see different values.
Load it once with READ_ONCE() and mark the writer and the other lockless
reader accordingly.
Reported-by: syzbot+de9701a2cad597c14d34@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de9701a2cad597c14d34
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'include/uapi/linux/netfilter/ipset')
0 files changed, 0 insertions, 0 deletions