[v5.15] BUG: MAX_LOCK_DEPTH too low!
0 views
Skip to first unread message
syzbot
Aug 4, 2026, 9:33:46 AM (18 hours ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14a813b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=bfef5b52fa56c140a335
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bfef5b...@syzkaller.appspotmail.com
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by kworker/u4:2/2433:
#0: ffff888061d7d138 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90003c4fd00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff888078accc78 (&peer->endpoint_lock){++-.}-{2:2}, at: wg_socket_send_skb_to_peer+0x50/0x1c0 drivers/net/wireguard/socket.c:173
#3: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#44: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#45: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#46: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#47: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
INFO: lockdep is turned off.
CPU: 0 PID: 2433 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313
rcu_read_lock include/linux/rcupdate.h:740 [inline]
ip6_dst_check+0xe2/0x7a0 net/ipv6/route.c:2744
dst_cache_per_cpu_get+0x1a3/0x310 net/core/dst_cache.c:51
rpl_output+0x165/0x730 net/ipv6/rpl_iptunnel.c:214
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
udp_tunnel6_xmit_skb+0x4b7/0x8b0 net/ipv6/ip6_udp_tunnel.c:110
send6+0x5a0/0x8d0 drivers/net/wireguard/socket.c:152
wg_socket_send_skb_to_peer+0x10d/0x1c0 drivers/net/wireguard/socket.c:178
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x203/0x360 drivers/net/wireguard/send.c:51
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14a813b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=bfef5b52fa56c140a335
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bfef5b...@syzkaller.appspotmail.com
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by kworker/u4:2/2433:
#0: ffff888061d7d138 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90003c4fd00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff888078accc78 (&peer->endpoint_lock){++-.}-{2:2}, at: wg_socket_send_skb_to_peer+0x50/0x1c0 drivers/net/wireguard/socket.c:173
#3: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#44: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#45: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#46: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#47: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
INFO: lockdep is turned off.
CPU: 0 PID: 2433 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313
rcu_read_lock include/linux/rcupdate.h:740 [inline]
ip6_dst_check+0xe2/0x7a0 net/ipv6/route.c:2744
dst_cache_per_cpu_get+0x1a3/0x310 net/core/dst_cache.c:51
rpl_output+0x165/0x730 net/ipv6/rpl_iptunnel.c:214
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
udp_tunnel6_xmit_skb+0x4b7/0x8b0 net/ipv6/ip6_udp_tunnel.c:110
send6+0x5a0/0x8d0 drivers/net/wireguard/socket.c:152
wg_socket_send_skb_to_peer+0x10d/0x1c0 drivers/net/wireguard/socket.c:178
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x203/0x360 drivers/net/wireguard/send.c:51
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages