On 4/26/20 10:57 AM, syzbot wrote: > syzbot has bisected this bug to: > > commit e7096c131e5161fa3b8e52a650d7719d2857adfd > Author: Jason A. Donenfeld <Jason@xxxxxxxxx> > Date: Sun Dec 8 23:27:34 2019 +0000 > > net: WireGuard secure network tunnel > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15258fcfe00000 > start commit: b2768df2 Merge branch 'for-linus' of git://git.kernel.org/.. > git tree: upstream > final crash: https://syzkaller.appspot.com/x/report.txt?x=17258fcfe00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=13258fcfe00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=b7a70e992f2f9b68 > dashboard link: https://syzkaller.appspot.com/bug?extid=0251e883fe39e7a0cb0a > userspace arch: i386 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f5f47fe00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e8efb4100000 > > Reported-by: syzbot+0251e883fe39e7a0cb0a@xxxxxxxxxxxxxxxxxxxxxxxxx > Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection > I have not looked at the repro closely, but WireGuard has some workers that might loop forever, cond_resched() might help a bit. diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index da3b782ab7d31df11e381529b144bcc494234a38..349a71e1907e081c61967c77c9f25a6ec5e57a24 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -518,6 +518,7 @@ void wg_packet_decrypt_worker(struct work_struct *work) &PACKET_CB(skb)->keypair->receiving)) ? PACKET_STATE_CRYPTED : PACKET_STATE_DEAD; wg_queue_enqueue_per_peer_napi(skb, state); + cond_resched(); } } diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c index 7348c10cbae3db54bfcb31f23c2753185735f876..f5b88693176c84b4bfdf8c4e05071481a3ce45b5 100644 --- a/drivers/net/wireguard/send.c +++ b/drivers/net/wireguard/send.c @@ -281,6 +281,7 @@ void wg_packet_tx_worker(struct work_struct *work) wg_noise_keypair_put(keypair, false); wg_peer_put(peer); + cond_resched(); } }