The shaper devices uses sleep_on for it's wait queue. The implementation is racy, the attached patch replaces it with an explicit add/remove_wait_queue.