linux-kernel - [BUG] lockdep: MAX_LOCKDEP_KEYS too low when destroying workqueues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <34e8a1ee.3323c.19ad4011944.Coremail.xudongjie25@mails.ucas.ac.cn>
Date: Sun, 30 Nov 2025 17:03:53 +0800 (GMT+08:00)
From: 许东洁 <xudongjie25@...ls.ucas.ac.cn>
To: Heo <tj@...nel.org>, Zijlstra <peterz@...radead.org>
Cc: Jiangshan <jiangshanlai@...il.com>, Molnar <mingo@...hat.com>, 
	Deacon <will@...nel.org>, Feng <boqun.feng@...il.com>, 
	Long <longman@...hat.com>, linux-kernel@...r.kernel.org
Subject: [BUG] lockdep: MAX_LOCKDEP_KEYS too low when destroying workqueues

Hello,

I found a lockdep issue using syzkaller where repeatedly destroying workqueues exhausts 
MAX_LOCKDEP_KEYS and disables the lock validator.

The bug triggers through:
nci_unregister_device -&gt; destroy_workqueue -&gt; drain_workqueue -&gt; touch_wq_lockdep_map

Kernel output:
BUG: MAX_LOCKOCKDEP_KEYS too low!
turning off the locking correctness validator.

It appears workqueue lock classes are not properly released in destroy_workqueue, 
causing lock class leakage.

Config file: https://github.com/j1akai/KConfigFuzz_bug/blob/main/x86/mainline-config
Additional fuzzing context(report file, reproduce file, etc.):https://github.com/PLASSICAxu/OS-bug/tree/main/lockdep

Acknowledgments
Xu Dongjie
University of Chinese Academy of Sciences