INFO: task kworker/1:17:3203 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:17 state:D stack:24688 pid: 3203 ppid: 2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xb72/0x1460 kernel/sched/core.c:6250
schedule+0x12b/0x1f0 kernel/sched/core.c:6323
usb_kill_urb+0x1d5/0x310 drivers/usb/core/urb.c:720
usb_start_wait_urb+0x265/0x530 drivers/usb/core/message.c:64
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153
hub_port_init+0x9f1/0x2df0 drivers/usb/core/hub.c:4829
hub_port_connect+0xcf8/0x27d0 drivers/usb/core/hub.c:5280
hub_port_connect_change+0x5f9/0xc20 drivers/usb/core/hub.c:5488
port_event+0xb67/0x1220 drivers/usb/core/hub.c:5634
hub_event+0x4ed/0xe40 drivers/usb/core/hub.c:5716
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8cb1d8c0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by in:imklog/6169:
3 locks held by kworker/u4:7/8631:
5 locks held by kworker/1:17/3203:
#0: ffff888016248538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc9000e5e7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
#2: ffff88801e3a7220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff88801e3a7220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1b2/0xe40 drivers/usb/core/hub.c:5662
#3: ffff88801e4b25c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline]
#3: ffff88801e4b25c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect+0xce1/0x27d0 drivers/usb/core/hub.c:5279
#4: ffff88801dc3b268 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_init+0x1ef/0x2df0 drivers/usb/core/hub.c:4703
1 lock held by syz-executor.4/13904:
#0: ffff88801ad1bb60 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x6d/0x9b0 drivers/block/loop.c:1106
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc82/0xcd0 kernel/hung_task.c:295
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 789 Comm: kworker/u4:3 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:trace_hardirqs_on+0x73/0x80 kernel/trace/trace_preemptirq.c:50
Code: f9 ff 48 8b 7c 24 08 31 f6 e8 29 00 00 00 65 c7 05 36 55 78 7e 00 00 00 00 48 8b 5c 24 08 48 89 df e8 c1 90 da ff 48 89 df 5b 58 2b 75 08 0f 1f 84 00 00 00 00 00 55 41 57 41 56 53 49 89 f6
RSP: 0018:ffffc90003b3f7d8 EFLAGS: 00000046
RAX: 35a8f9b4a5904100 RBX: ffff8881406fa558 RCX: ffffffff816634e1
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffffffff812fe18a
RBP: ffffc90003b3f990 R08: dffffc0000000000 R09: fffffbfff1fee1df
R10: fffffbfff1fee1df R11: 0000000000000000 R12: ffffffff81cee6d5
R13: ffff88801a775700 R14: ffffc90003b3f860 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f124640ea21 CR3: 000000000c88e000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__text_poke+0x7da/0x9f0 arch/x86/kernel/alternative.c:1058
text_poke arch/x86/kernel/alternative.c:1083 [inline]
text_poke_bp_batch+0x6b0/0x940 arch/x86/kernel/alternative.c:1361
text_poke_flush arch/x86/kernel/alternative.c:1451 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1458
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x12d/0x250 kernel/jump_label.c:177
static_key_enable+0x16/0x20 kernel/jump_label.c:190
toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:626
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
----------------
Code disassembly (best guess):
0: f9 stc
1: ff 48 8b decl -0x75(%rax)
4: 7c 24 jl 0x2a
6: 08 31 or %dh,(%rcx)
8: f6 e8 imul %al
a: 29 00 sub %eax,(%rax)
c: 00 00 add %al,(%rax)
e: 65 c7 05 36 55 78 7e movl $0x0,%gs:0x7e785536(%rip) # 0x7e78554f
15: 00 00 00 00
19: 48 8b 5c 24 08 mov 0x8(%rsp),%rbx
1e: 48 89 df mov %rbx,%rdi
21: e8 c1 90 da ff callq 0xffda90e7
26: 48 89 df mov %rbx,%rdi
29: 5b pop %rbx
* 2a: e9 58 2b 75 08 jmpq 0x8752b87 <-- trapping instruction
2f: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
36: 00
37: 55 push %rbp
38: 41 57 push %r15
3a: 41 56 push %r14
3c: 53 push %rbx
3d: 49 89 f6 mov %rsi,%r14