BUG: workqueue lockup in wg_packet_decrypt_worker

Status: premoderation: reported syz repro on 2026/10/12 09:28
Reported-by: syzbot+f8f9aaa4114a2694a4d6@syzkaller.appspotmail.com
First crash: 1d10h, last: 1d10h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: workqueue lockup in wg_packet_decrypt_worker prio:high wireguard -1 syz, C 30 11h08m 27d 0/29 upstream: reported C repro on 2026/09/15 21:33

Sample crash report:
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 184s!
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 184s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: vmstat_shepherd, fqdir_free_fn
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: psi_avgs_work
workqueue events_unbound: flags=0x2
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=4 refcnt=5
    pending: toggle_allocation_gate, linkwatch_event, flush_memcg_stats_dwork, crng_reseed
workqueue events_freezable: flags=0x4
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: update_balloon_stats_func
workqueue events_power_efficient: flags=0x80
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_ratelimiter_gc_entries, check_lifetime
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=5 refcnt=6
    pending: 2*neigh_managed_work, gc_worker, 2*neigh_periodic_work
workqueue kvfree_rcu_reclaim: flags=0xa
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: kfree_rcu_monitor
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: kfree_rcu_monitor
workqueue mm_percpu_wq: flags=0x8
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: vmstat_update
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: vmstat_update
workqueue writeback: flags=0x4a
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: wb_workfn
workqueue mld: flags=0x40008
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=70
    pending: mld_ifc_work
    inactive: 4*mld_ifc_work, mld_dad_work, 6*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, mld_ifc_work, 2*mld_dad_work, mld_ifc_work, 2*mld_dad_work, 3*mld_ifc_work, 3*mld_dad_work, 7*mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, 2*mld_ifc_work, mld_dad_work, 9*mld_ifc_work, mld_dad_work, 2*mld_ifc_work, mld_dad_work, 4*mld_ifc_work, mld_dad_work, mld_ifc_work
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=73
    in-flight: 396:mld_ifc_work
    inactive: mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, 7*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, mld_ifc_work, 2*mld_dad_work, 10*mld_ifc_work, 6*mld_dad_work, 7*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, 3*mld_dad_work, 7*mld_ifc_work, 3*mld_dad_work, 3*mld_ifc_work, mld_dad_work, 6*mld_ifc_work
workqueue ipv6_addrconf: flags=0x6000a
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=208
    pending: addrconf_dad_work
    inactive: 199*addrconf_dad_work, 5*addrconf_verify_work
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=2 refcnt=3
    pending: 2*wg_packet_handshake_send_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=2 refcnt=3
    pending: 2*wg_packet_handshake_send_worker
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=2 refcnt=3
    pending: 2*wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg0: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    in-flight: 31:wg_packet_decrypt_worker
    pending: wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x28
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: wg_packet_encrypt_worker
pool 6: cpus=1 node=0 flags=0x0 nice=0 hung=0s workers=3 idle: 45
Showing backtraces of running workers in stalled CPU-bound worker pools:
pool 6:
task:kworker/1:0     state:R  running task     stack:0     pid:31    tgid:31    ppid:2      flags:0x00004000
Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x16fe/0x23d0 kernel/sched/core.c:7883
 preempt_schedule_irq+0xab/0x110 kernel/sched/core.c:8205
 raw_irqentry_exit_cond_resched+0x32/0x40 kernel/entry/common.c:311
 irqentry_exit+0x4a/0x60 kernel/entry/common.c:354
 sysvec_apic_timer_interrupt+0x50/0x90 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__napi_schedule+0x2bf/0x350 net/core/dev.c:6301
Code: 00 02 00 00 31 ff e8 80 a4 03 fd 48 81 e3 00 02 00 00 75 07 e8 92 9f 03 fd eb 06 e8 8b 9f 03 fd fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24
RSP: 0018:ffffc900002076e0 EFLAGS: 00000293
RAX: ffffffff8485ad35 RBX: 0000000000000200 RCX: ffff88810367cf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000207790 R08: ffff88810367cf07 R09: 1ffff110206cf9e0
R10: dffffc0000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff92000040ee0 R14: ffff8881f6d5143c R15: 0000000000000001
 napi_schedule include/linux/netdevice.h:527 [inline]
 wg_queue_enqueue_per_peer_rx drivers/net/wireguard/queueing.h:201 [inline]
 wg_packet_decrypt_worker+0x887/0xd50 drivers/net/wireguard/receive.c:503
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
pool 6:
task:kworker/1:2     state:R  running task     stack:0     pid:396   tgid:396   ppid:2      flags:0x00004000
Workqueue: mld mld_ifc_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x16fe/0x23d0 kernel/sched/core.c:7883
 preempt_schedule_irq+0xab/0x110 kernel/sched/core.c:8205
 raw_irqentry_exit_cond_resched+0x32/0x40 kernel/entry/common.c:311
 irqentry_exit+0x4a/0x60 kernel/entry/common.c:354
 sysvec_apic_timer_interrupt+0x50/0x90 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0x52/0x6b0 arch/x86/kernel/unwind_frame.c:273
Code: 03 43 0f b6 04 37 84 c0 0f 85 89 05 00 00 83 3b 00 0f 84 fb 04 00 00 4c 89 7d b0 4c 8d 7b 58 4c 89 f8 48 c1 e8 03 48 89 45 c8 <42> 80 3c 30 00 74 08 4c 89 ff e8 ff 30 9e 00 4d 8b 3f 4d 85 ff 74
RSP: 0018:ffffc90008346ec8 EFLAGS: 00000a06
RAX: 1ffff92001068df0 RBX: ffffc90008346f28 RCX: 1ffff92001068d00
RDX: dffffc0000000000 RSI: ffffffff81777a5a RDI: ffffc90008346f28
RBP: ffffc90008346f18 R08: ffffc90008346ff0 R09: ffffc90008346fe8
R10: 0000000000000000 R11: ffffffff81777ac0 R12: ffff88810d3b62c0
R13: 1ffff11021a76d30 R14: dffffc0000000000 R15: ffffc90008346f80
 arch_stack_walk+0x138/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 save_stack+0x125/0x240 mm/page_owner.c:174
 __set_page_owner+0x8e/0x600 mm/page_owner.c:338
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1864
 prep_new_page+0x2d/0x180 mm/page_alloc.c:1872
 get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3949
 __alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5316
 alloc_slab_page+0x6b/0x1e0 mm/slub.c:-1
 allocate_slab+0x69/0x430 mm/slub.c:2687
 new_slab mm/slub.c:2741 [inline]
 ___slab_alloc+0x591/0x8c0 mm/slub.c:3934
 __slab_alloc mm/slub.c:4025 [inline]
 __slab_alloc_node mm/slub.c:4078 [inline]
 slab_alloc_node mm/slub.c:4239 [inline]
 __do_kmalloc_node mm/slub.c:4394 [inline]
 __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 mm/slub.c:4414
 kmalloc_reserve+0x144/0x4f0 net/core/skbuff.c:618
 __alloc_skb+0x13f/0x360 net/core/skbuff.c:687
 alloc_skb include/linux/skbuff.h:1363 [inline]
 mld_newpack+0x162/0xa10 net/ipv6/mcast.c:1744
 add_grhead net/ipv6/mcast.c:1855 [inline]
 add_grec+0xf20/0x1400 net/ipv6/mcast.c:1993
 mld_send_cr net/ipv6/mcast.c:2119 [inline]
 mld_ifc_work+0x71d/0xc40 net/ipv6/mcast.c:2655
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 02                	add    %al,(%rdx)
   2:	00 00                	add    %al,(%rax)
   4:	31 ff                	xor    %edi,%edi
   6:	e8 80 a4 03 fd       	call   0xfd03a48b
   b:	48 81 e3 00 02 00 00 	and    $0x200,%rbx
  12:	75 07                	jne    0x1b
  14:	e8 92 9f 03 fd       	call   0xfd039fab
  19:	eb 06                	jmp    0x21
  1b:	e8 8b 9f 03 fd       	call   0xfd039fab
  20:	fb                   	sti
  21:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  28:	e0 45
* 2a:	4b c7 44 25 00 00 00 	movq   $0x0,0x0(%r13,%r12,1) <-- trapping instruction
  31:	00 00
  33:	65 48 8b 04 25 28 00 	mov    %gs:0x28,%rax
  3a:	00 00
  3c:	48                   	rex.W
  3d:	3b                   	.byte 0x3b
  3e:	44                   	rex.R
  3f:	24                   	.byte 0x24

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/12 09:28 android16-6.12 c82b35cb007f 4f92358f .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust BUG: workqueue lockup in wg_packet_decrypt_worker
* Struck through repros no longer work on HEAD.