Nikita Zhandarovich
abdad2c152
UPSTREAM: wireguard: receive: annotate data-race around receiving_counter.counter
...
Syzkaller with KCSAN identified a data-race issue when accessing
keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE()
annotations to mark the data race as intentional.
BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll
write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0:
counter_validate drivers/net/wireguard/receive.c:321 [inline]
wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461
__napi_poll+0x60/0x3b0 net/core/dev.c:6536
napi_poll net/core/dev.c:6605 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6738
__do_softirq+0xc4/0x279 kernel/softirq.c:553
do_softirq+0x5e/0x90 kernel/softirq.c:454
__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
spin_unlock_bh include/linux/spinlock.h:396 [inline]
ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499
process_one_work kernel/workqueue.c:2633 [inline]
...
read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1:
decrypt_packet drivers/net/wireguard/receive.c:252 [inline]
wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706
worker_thread+0x525/0x730 kernel/workqueue.c:2787
...
Bug: 254441685
Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter")
Reported-by: syzbot+d1de830e4ecdaac83d89@syzkaller.appspotmail.com
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
(cherry picked from commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I89aa56c54a02d1746759b072981448cc8f056065
2025-09-24 12:16:41 +02:00
..
accessibility
acpi
This is the 5.4.296 stable release
2025-07-18 10:57:54 +00:00
amba
android
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
ata
ata: pata_cs5536: fix build on 32-bit UML
2025-07-17 18:24:57 +02:00
atm
atm: idt77252: Add missing dma_map_error()
2025-07-17 18:25:05 +02:00
auxdisplay
base
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
bcma
block
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
bluetooth
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
bus
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
cdrom
char
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
clk
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
clocksource
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
connector
counter
cpufreq
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
cpuidle
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
crypto
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
dax
dca
devfreq
dio
dma
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
dma-buf
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
edac
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
eisa
extcon
firewire
firmware
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
fpga
fpga: altera-cvp: Increase credit timeout
2025-06-04 14:32:32 +02:00
fsi
gnss
gpio
gpio: zynq: Fix wakeup source leaks on device unbind
2025-05-02 07:39:17 +02:00
gpu
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
greybus
hid
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
hsi
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
hv
hwmon
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
hwspinlock
hwtracing
Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-05-18 08:00:20 +00:00
i2c
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
i3c
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
ide
idle
iio
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
infiniband
This is the 5.4.296 stable release
2025-07-18 10:57:54 +00:00
input
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
interconnect
iommu
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
ipack
irqchip
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
isdn
leds
Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-05-18 08:00:20 +00:00
lightnvm
macintosh
mailbox
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
mcb
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
md
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
media
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
memory
memstick
message
mfd
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
misc
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
mmc
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
mtd
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
mux
net
UPSTREAM: wireguard: receive: annotate data-race around receiving_counter.counter
2025-09-24 12:16:41 +02:00
nfc
ntb
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
nubus
nvdimm
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvme
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem
Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-05-18 08:00:20 +00:00
of
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
opp
oprofile
parisc
parport
pci
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
pcmcia
perf
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
phy
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
pinctrl
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
platform
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
pnp
power
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
powercap
pps
ps3
ptp
pwm
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
rapidio
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
ras
regulator
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
remoteproc
reset
rpmsg
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
rtc
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
s390
scsi: s390: zfcp: Ensure synchronous unit_add
2025-06-27 11:02:56 +01:00
sbus
scsi
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
sfi
sh
siox
slimbus
Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-05-18 08:00:20 +00:00
soc
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
soundwire
spi
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
spmi
ssb
staging
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
target
This is the 5.4.294 stable release
2025-06-05 07:11:21 +00:00
tc
tee
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
thunderbolt
thunderbolt: Do not double dequeue a configuration request
2025-06-27 11:02:44 +01:00
tty
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
uio
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
usb
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-12 18:48:05 +03:00
vfio
vhost
video
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-09-01 13:17:46 +03:00
virt
virtio
visorbus
vlynq
vme
w1
watchdog
watchdog: da9052_wdt: respect TWDMIN
2025-06-27 11:02:55 +01:00
xen
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
zorro
Kconfig
Makefile
OWNERS