================================ WARNING: inconsistent lock state syzkaller #0 Tainted: G L -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. kworker/u8:10/1169 [HC1[1]:SC0[2]:HE0:SE0] takes: ffff888030f4e868 (&dev->spinlock){?...}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline] ffff888030f4e868 (&dev->spinlock){?...}-{3:3}, at: das16m1_interrupt+0x5e/0x180 drivers/comedi/drivers/das16m1.c:460 {HARDIRQ-ON-W} state was registered at: lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:182 spin_lock_bh include/linux/spinlock.h:348 [inline] waveform_ao_cancel+0x8d/0x120 drivers/comedi/drivers/comedi_test.c:628 do_cancel drivers/comedi/comedi_fops.c:818 [inline] comedi_close+0x27e/0x5e0 drivers/comedi/comedi_fops.c:3036 __fput+0x44f/0xa60 fs/file_table.c:473 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x70f/0x22c0 kernel/exit.c:975 do_group_exit+0x21b/0x2d0 kernel/exit.c:1117 get_signal+0x1284/0x1330 kernel/signal.c:3037 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 6973561 hardirqs last enabled at (6973560): [] irqentry_exit+0x61a/0x700 kernel/entry/common.c:244 hardirqs last disabled at (6973561): [] common_interrupt+0x13/0xe0 arch/x86/kernel/irq.c:326 softirqs last enabled at (6973554): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (6973554): [] __alloc_skb+0x186/0x7d0 net/core/skbuff.c:695 softirqs last disabled at (6973556): [] wg_socket_send_skb_to_peer+0x54/0x1d0 drivers/net/wireguard/socket.c:172 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&dev->spinlock); lock(&dev->spinlock); *** DEADLOCK *** 3 locks held by kworker/u8:10/1169: #0: ffff888058399940 ((wq_completion)wg-kex-wg0#19){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3277 [inline] #0: ffff888058399940 ((wq_completion)wg-kex-wg0#19){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3385 #1: ffffc90005917c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3278 [inline] #1: ffffc90005917c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3385 #2: ffff88806aa646d0 (&peer->endpoint_lock){++-.}-{3:3}, at: wg_socket_send_skb_to_peer+0x54/0x1d0 drivers/net/wireguard/socket.c:172 stack backtrace: CPU: 0 UID: 0 PID: 1169 Comm: kworker/u8:10 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_usage_bug+0x28b/0x2e0 kernel/locking/lockdep.c:4042 valid_state kernel/locking/lockdep.c:4056 [inline] mark_lock_irq+0x410/0x420 kernel/locking/lockdep.c:-1 mark_lock+0x115/0x190 kernel/locking/lockdep.c:4753 mark_usage kernel/locking/lockdep.c:4639 [inline] __lock_acquire+0x661/0x2cf0 kernel/locking/lockdep.c:5191 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158 spin_lock include/linux/spinlock.h:342 [inline] das16m1_interrupt+0x5e/0x180 drivers/comedi/drivers/das16m1.c:460 __handle_irq_event_percpu+0x216/0x9a0 kernel/irq/handle.c:209 handle_irq_event_percpu kernel/irq/handle.c:246 [inline] handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:263 handle_edge_irq+0x23b/0x9f0 kernel/irq/chip.c:855 generic_handle_irq_desc include/linux/irqdesc.h:186 [inline] handle_irq arch/x86/kernel/irq.c:262 [inline] call_irq_handler arch/x86/kernel/irq.c:-1 [inline] __common_interrupt+0x141/0x1f0 arch/x86/kernel/irq.c:333 common_interrupt+0xb6/0xe0 arch/x86/kernel/irq.c:326 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688 RIP: 0010:lock_acquire+0x221/0x350 kernel/locking/lockdep.c:5872 Code: ff ff ff e8 61 02 18 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 1b 4e 9f 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 80 ee 1a 0a cc 48 8d 3d 98 a2 94 RSP: 0018:ffffc900059178c8 EFLAGS: 00000282 RAX: 6cec632765d81300 RBX: 0000000000000000 RCX: 0000000080000201 RDX: 00000000e04edc00 RSI: ffffffff8e37db44 RDI: ffffffff8c2a9260 RBP: ffffffff867f8a34 R08: ffffffff867f8a34 R09: ffff88806aa646d0 R10: 3169d0c4fdff5ce5 R11: f3fad27f2243ac6c R12: 0000000000000002 R13: ffff88806aa646d0 R14: 0000000000000001 R15: 0000000000000246 __raw_read_lock_bh include/linux/rwlock_api_smp.h:192 [inline] _raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:256 wg_socket_send_skb_to_peer+0x54/0x1d0 drivers/net/wireguard/socket.c:172 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline] wg_packet_handshake_send_worker+0x203/0x350 drivers/net/wireguard/send.c:51 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 comedi comedi0: fifo overflow ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 61 02 18 0a call 0xa180267 6: f7 44 24 08 00 02 00 testl $0x200,0x8(%rsp) d: 00 e: 0f 84 3a ff ff ff je 0xffffff4e 14: 65 48 8b 05 1b 4e 9f mov %gs:0x119f4e1b(%rip),%rax # 0x119f4e37 1b: 11 1c: 48 3b 44 24 58 cmp 0x58(%rsp),%rax 21: 75 33 jne 0x56 23: fb sti 24: 48 83 c4 60 add $0x60,%rsp * 28: 5b pop %rbx <-- trapping instruction 29: 41 5c pop %r12 2b: 41 5d pop %r13 2d: 41 5e pop %r14 2f: 41 5f pop %r15 31: 5d pop %rbp 32: e9 80 ee 1a 0a jmp 0xa1aeeb7 37: cc int3 38: 48 rex.W 39: 8d .byte 0x8d 3a: 3d .byte 0x3d 3b: 98 cwtl 3c: a2 .byte 0xa2 3d: 94 xchg %eax,%esp