syzbot
BUG: MAX_LOCK_DEPTH too low!
Status:
upstream: reported on 2026/08/04 13:33
Reported-by: syzbot+bfef5b52fa56c140a335@syzkaller.appspotmail.com
First crash: 1d06h, last: 34m
Sample crash report:
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by kworker/u4:0/9:
#0: ffff888062652138 ((wq_completion)wg-kex-wg2#5){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ce7d00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff888021458ad8 (&peer->endpoint_lock){++-.}-{2:2}, at: wg_socket_send_skb_to_peer+0x50/0x1c0 drivers/net/wireguard/socket.c:173
#3: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#44: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#45: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#46: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#47: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
INFO: lockdep is turned off.
CPU: 1 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313
rcu_read_lock include/linux/rcupdate.h:740 [inline]
ip6_dst_check+0xe2/0x7a0 net/ipv6/route.c:2744
dst_cache_per_cpu_get+0x1a3/0x310 net/core/dst_cache.c:51
rpl_output+0x165/0x730 net/ipv6/rpl_iptunnel.c:214
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
udp_tunnel6_xmit_skb+0x4b7/0x8b0 net/ipv6/ip6_udp_tunnel.c:110
send6+0x5a0/0x8d0 drivers/net/wireguard/socket.c:152
wg_socket_send_skb_to_peer+0x10d/0x1c0 drivers/net/wireguard/socket.c:178
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x203/0x360 drivers/net/wireguard/send.c:51
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
* Struck through repros no longer work on HEAD.