BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by kworker/u4:2/154:
#0: ffff8880616cf138 ((wq_completion)wg-kex-wg0#7){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc9000124fd00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff8880213f0178 (&peer->endpoint_lock){++-.}-{2:2}, at: wg_socket_send_skb_to_peer+0x50/0x1c0 drivers/net/wireguard/socket.c:173
#3: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffff88801e7adeb0 (&vkms_out->lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#43: ffff88801e7adeb0 (&vkms_out->lock){-.-.}-{2:2}, at: vkms_vblank_simulate+0xb8/0x320 drivers/gpu/drm/vkms/vkms_crtc.c:28
#44: ffff88801e7ac3e8 (&dev->event_lock){-.-.}-{2:2}, at: drm_handle_vblank+0xbd/0x5d0 drivers/gpu/drm/drm_vblank.c:1945
#45: ffff88801e7ac350 (&dev->vblank_time_lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#45: ffff88801e7ac350 (&dev->vblank_time_lock){-.-.}-{2:2}, at: drm_handle_vblank+0xd0/0x5d0 drivers/gpu/drm/drm_vblank.c:1951
#46: ffff88801e152120 (&(&vblank->seqlock)->lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#46: ffff88801e152120 (&(&vblank->seqlock)->lock){-.-.}-{2:2}, at: write_seqlock include/linux/seqlock.h:937 [inline]
#46: ffff88801e152120 (&(&vblank->seqlock)->lock){-.-.}-{2:2}, at: store_vblank+0xe2/0x220 drivers/gpu/drm/drm_vblank.c:179
#47: ffff88801e1520d8 (&____s->seqcount#6){----}-{0:0}, at: drm_update_vblank_count+0x70d/0x930 drivers/gpu/drm/drm_vblank.c:367
INFO: lockdep is turned off.
CPU: 0 PID: 154 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
do_write_seqcount_begin_nested include/linux/seqlock.h:519 [inline]
do_write_seqcount_begin include/linux/seqlock.h:545 [inline]
write_seqlock include/linux/seqlock.h:938 [inline]
store_vblank+0x106/0x220 drivers/gpu/drm/drm_vblank.c:179
drm_update_vblank_count+0x70d/0x930 drivers/gpu/drm/drm_vblank.c:367
drm_handle_vblank+0x106/0x5d0 drivers/gpu/drm/drm_vblank.c:1960
vkms_vblank_simulate+0xc0/0x320 drivers/gpu/drm/vkms/vkms_crtc.c:29
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x4ea/0xb60 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49
Code: 48 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d9 90 c3 90 90 90 90 90 90 90 b9 00 10 00 00 31 c0 aa c3 00 00 cc cc 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec
RSP: 0018:ffffc9000124b2f0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802d012000 RCX: 0000000000000640
RDX: 0000000000000000 RSI: 0000000000000200 RDI: ffff88802d0129c0
RBP: 00000000001c2a20 R08: ffffea0000b40037 R09: ffffed1005a00000
R10: dffffc0000000000 R11: fffff94000168007 R12: 00000000000001ee
R13: 1ffff110039bc2f1 R14: ffff88801cde1788 R15: dffffc0000000000
clear_page arch/x86/include/asm/page_64.h:49 [inline]
clear_highpage include/linux/highmem.h:181 [inline]
kernel_init_free_pages+0x7c/0xf0 mm/page_alloc.c:1278
post_alloc_hook+0x106/0x220 mm/page_alloc.c:2416
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
__alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
__alloc_pages_node include/linux/gfp.h:570 [inline]
alloc_pages_node include/linux/gfp.h:584 [inline]
kmalloc_large_node+0x7d/0x1a0 mm/slub.c:4426
__kmalloc_node_track_caller+0x219/0x3a0 mm/slub.c:4949
kmalloc_reserve net/core/skbuff.c:356 [inline]
pskb_expand_head+0x128/0x1100 net/core/skbuff.c:1710
__skb_cow include/linux/skbuff.h:3406 [inline]
skb_cow_head include/linux/skbuff.h:3440 [inline]
rpl_do_srh_inline net/ipv6/rpl_iptunnel.c:157 [inline]
rpl_do_srh+0x50a/0xe50 net/ipv6/rpl_iptunnel.c:201
rpl_output+0x178/0x730 net/ipv6/rpl_iptunnel.c:217
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
udp_tunnel6_xmit_skb+0x4b7/0x8b0 net/ipv6/ip6_udp_tunnel.c:110
send6+0x5a0/0x8d0 drivers/net/wireguard/socket.c:152
wg_socket_send_skb_to_peer+0x10d/0x1c0 drivers/net/wireguard/socket.c:178
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x203/0x360 drivers/net/wireguard/send.c:51
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
vkms_vblank_simulate: vblank timer overrun
hrtimer: interrupt took 2246755431 ns
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
0: 48 89 47 18 mov %rax,0x18(%rdi)
4: 48 89 47 20 mov %rax,0x20(%rdi)
8: 48 89 47 28 mov %rax,0x28(%rdi)
c: 48 89 47 30 mov %rax,0x30(%rdi)
10: 48 89 47 38 mov %rax,0x38(%rdi)
14: 48 8d 7f 40 lea 0x40(%rdi),%rdi
18: 75 d9 jne 0xfffffff3
1a: 90 nop
1b: c3 ret
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: b9 00 10 00 00 mov $0x1000,%ecx
28: 31 c0 xor %eax,%eax
* 2a: f3 aa rep stos %al,%es:(%rdi) <-- trapping instruction
2c: c3 ret
2d: 00 00 add %al,(%rax)
2f: cc int3
30: cc int3
31: 00 00 add %al,(%rax)
33: 55 push %rbp
34: 41 57 push %r15
36: 41 56 push %r14
38: 41 55 push %r13
3a: 41 54 push %r12
3c: 53 push %rbx
3d: 48 rex.W
3e: 83 .byte 0x83
3f: ec in (%dx),%al