WARNING: locking bug in tcp_tsq_handler

Status: upstream: reported syz repro on 2026/08/24 15:44
Subsystems: net
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+2d770620059281e225a4@syzkaller.appspotmail.com
First crash: 23d, last: 1h40m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c87b2d7f assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ WARNING: locking bug in tcp_tsq_handler 2026/08/09 06:49 2026/08/09 06:49 2026/08/09 07:36 5d63f80b
Discussions (3)
Title Replies (including bot) Last reply
[PATCH] locking/lockdep: Invalidate stale class_cache entries for zapped classes 20 (21) 2026/08/28 09:00
[syzbot] [kernfs?] possible deadlock in kernfs_link_sibling (2) 3 (8) 2026/08/27 10:33
[syzbot] [net?] WARNING: locking bug in tcp_tsq_handler 0 (1) 2026/08/24 15:44
Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/08/26 22:50 2h35m hdanton@sina.com patch upstream report job log log
2026/08/25 00:29 20m hdanton@sina.com patch upstream report job log log
2026/08/24 12:12 2h28m edumazet@google.com patch upstream OK job log log

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#1: kworker/1:0/24
WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4870 [inline], CPU#1: kworker/1:0/24
WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x382/0x2cf0 kernel/locking/lockdep.c:5203, CPU#1: kworker/1:0/24
Modules linked in:
CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-crypt-wg0 wg_packet_tx_worker
RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4870 [inline]
RIP: 0010:__lock_acquire+0x389/0x2cf0 kernel/locking/lockdep.c:5203
Code: 83 3d fa 48 f9 18 00 75 27 90 e8 b2 88 35 03 85 c0 74 1c 83 3d eb 3f d7 0e 00 75 13 48 8d 3d 1e 43 da 0e 48 c7 c6 8f 4c 59 8e <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f
RSP: 0018:ffffc90000a089b8 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000042000 RCX: ffff88801eaaddc0
RDX: 8000000000000100 RSI: ffffffff8e594c8f RDI: ffffffff907cef80
RBP: 0000000000000001 R08: 0000000000000100 R09: 1ffffffff20f3d88
R10: dffffc0000000000 R11: fffffbfff20f3d89 R12: 0000000000000949
R13: ffff88801eaaea08 R14: ffff88801eaaddc0 R15: ffff88801eaae968
FS:  0000000000000000(0000) GS:ffff888124df4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f390df782c0 CR3: 000000007747a000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
 spin_lock include/linux/spinlock.h:347 [inline]
 tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
 tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 bh_worker+0x451/0x870 kernel/workqueue.c:3773
 tasklet_action+0xc/0x70 kernel/softirq.c:997
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 wg_socket_send_skb_to_peer+0x16b/0x1d0 drivers/net/wireguard/socket.c:183
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x1c8/0x7e0 drivers/net/wireguard/send.c:276
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	83 3d fa 48 f9 18 00 	cmpl   $0x0,0x18f948fa(%rip)        # 0x18f94901
   7:	75 27                	jne    0x30
   9:	90                   	nop
   a:	e8 b2 88 35 03       	call   0x33588c1
   f:	85 c0                	test   %eax,%eax
  11:	74 1c                	je     0x2f
  13:	83 3d eb 3f d7 0e 00 	cmpl   $0x0,0xed73feb(%rip)        # 0xed74005
  1a:	75 13                	jne    0x2f
  1c:	48 8d 3d 1e 43 da 0e 	lea    0xeda431e(%rip),%rdi        # 0xeda4341
  23:	48 c7 c6 8f 4c 59 8e 	mov    $0xffffffff8e594c8f,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	90                   	nop
  30:	31 c0                	xor    %eax,%eax
  32:	0f b6 98 c4 00 00 00 	movzbl 0xc4(%rax),%ebx
  39:	41 8b 45 20          	mov    0x20(%r13),%eax
  3d:	25                   	.byte 0x25
  3e:	ff 1f                	lcall  *(%rdi)

Crashes (49):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/24 01:58 upstream 388b607d107c 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/28 13:08 upstream 1b78070aaef6 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/25 01:13 upstream 0a0d1d55dad5 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/24 16:27 upstream 0a0d1d55dad5 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/23 22:25 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/23 22:20 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/23 22:19 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/22 03:17 upstream 26260251022f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/20 18:12 upstream a4ff2be345d0 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/20 14:53 upstream a4ff2be345d0 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/20 06:51 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/19 15:40 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 18:07 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 16:39 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 16:36 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 16:34 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 16:33 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 16:27 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/18 11:39 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/18 07:51 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/16 23:51 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: locking bug in tcp_tsq_handler
2026/08/15 14:47 upstream 15ef2f78c49d 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/11 15:57 upstream d58772d8520c 37a258dd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/11 05:57 upstream d58772d8520c 039457bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/10 15:59 upstream db2ddb871435 039457bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: locking bug in tcp_tsq_handler
2026/08/10 15:59 upstream db2ddb871435 039457bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: locking bug in tcp_tsq_handler
2026/08/10 15:59 upstream db2ddb871435 039457bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: locking bug in tcp_tsq_handler
2026/08/10 00:01 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 23:45 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 23:44 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 23:33 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 23:33 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 21:08 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 20:29 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 20:13 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 20:04 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/09 17:22 upstream 06cf61899d64 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/09 08:42 upstream 06cf61899d64 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in tcp_tsq_handler
2026/08/08 17:11 upstream a59f57e2aa12 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/05 05:25 upstream c21bb4193868 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/13 12:47 upstream 3d6d817622b0 4d118901 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: locking bug in tcp_tsq_handler
2026/08/19 14:38 upstream b126f6f5940f 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: locking bug in tcp_tsq_handler
2026/08/25 06:08 linux-next 4b18edbd8e70 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/21 22:28 linux-next 903c1cf6dff9 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING: locking bug in tcp_tsq_handler
2026/08/17 04:23 linux-next 4477a78374a5 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
2026/08/12 06:00 linux-next 5e6de6a2b522 f8d35649 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING: locking bug in tcp_tsq_handler
* Struck through repros no longer work on HEAD.