syzbot

INFO: task kworker/0:0:9 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0     state:D stack:22888 pid:9     tgid:9     ppid:2      task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0xeb9/0x4040 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:6960
 rpm_resume+0x579/0x12f0 drivers/base/power/runtime.c:859
 rpm_resume+0x721/0x12f0 drivers/base/power/runtime.c:917
 __pm_runtime_resume+0xb6/0x170 drivers/base/power/runtime.c:1197
 pm_runtime_get_active include/linux/pm_runtime.h:520 [inline]
 pm_runtime_resume_and_get include/linux/pm_runtime.h:539 [inline]
 usb_autopm_get_interface+0x20/0xe0 drivers/usb/core/driver.c:1864
 aqc111_write_cmd drivers/net/usb/aqc111.c:132 [inline]
 aqc111_write32_cmd drivers/net/usb/aqc111.c:180 [inline]
 aqc111_suspend+0x7f8/0x9d0 drivers/net/usb/aqc111.c:1409
 usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
 usb_suspend_both+0x306/0xc40 drivers/usb/core/driver.c:1445
 usb_runtime_suspend+0x49/0x120 drivers/usb/core/driver.c:1997
 __rpm_callback+0xc8/0x620 drivers/base/power/runtime.c:406
 rpm_callback+0xb4/0x1b0 drivers/base/power/runtime.c:457
 rpm_suspend+0x2f4/0x1160 drivers/base/power/runtime.c:698
 __pm_runtime_suspend+0xba/0x1a0 drivers/base/power/runtime.c:1167
 pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:752 [inline]
 usb_new_device.cold+0xd61/0x115c drivers/usb/core/hub.c:2727
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
INFO: task dhcpcd:2898 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:24632 pid:2898  tgid:2898  ppid:2897   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0xeb9/0x4040 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:6960
 rpm_resume+0x579/0x12f0 drivers/base/power/runtime.c:859
 rpm_resume+0x721/0x12f0 drivers/base/power/runtime.c:917
 __pm_runtime_resume+0xb6/0x170 drivers/base/power/runtime.c:1197
 pm_runtime_get_active include/linux/pm_runtime.h:520 [inline]
 pm_runtime_resume_and_get include/linux/pm_runtime.h:539 [inline]
 usb_autopm_get_interface+0x20/0xe0 drivers/usb/core/driver.c:1864
 usbnet_open+0x71/0x710 drivers/net/usb/usbnet.c:902
 __dev_open+0x3a3/0x800 net/core/dev.c:1683
 __dev_change_flags+0x558/0x6f0 net/core/dev.c:9734
 netif_change_flags+0x8d/0x160 net/core/dev.c:9797
 dev_change_flags+0xb6/0x170 net/core/dev_api.c:68
 devinet_ioctl+0x110b/0x1f10 net/ipv4/devinet.c:1199
 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1009
 sock_do_ioctl+0x118/0x280 net/socket.c:1254
 sock_ioctl+0x465/0x690 net/socket.c:1375
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5646963378
RSP: 002b:00007ffd167c8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f5646963378
RDX: 00007ffd167d8360 RSI: 0000000000008914 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd167e8500
R13: 00007f56468636c8 R14: 0000000000000028 R15: 0000000000008914
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:0/9:
 #0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffff88810a7e7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88810a7e7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
1 lock held by rcu_preempt/15:
 #0: ffff8881f57390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:639 [inline]
 #0: ffff8881f57390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1558 [inline]
 #0: ffff8881f57390d8 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1885 [inline]
 #0: ffff8881f57390d8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2c5/0x4040 kernel/sched/core.c:6768
1 lock held by khungtaskd/30:
 #0: ffffffff894ccc60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff894ccc60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff894ccc60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:8/1096:
 #0: ffff888112838948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90001e5fca8 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8a87a1a8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8a87a1a8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734
1 lock held by dhcpcd/2898:
 #0: ffffffff8a87a1a8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8a87a1a8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x1bd/0x1f10 net/ipv4/devinet.c:1120
2 locks held by getty/2921:
 #0: ffff8881129430a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 2841 Comm: syslogd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:124 [inline]
RIP: 0010:lock_release+0x75/0x2e0 kernel/locking/lockdep.c:5881
Code: 37 09 45 85 c0 0f 84 48 01 00 00 65 8b 05 ab 71 36 0b 85 c0 0f 85 39 01 00 00 65 4c 8b 25 cb 2d 36 0b 41 8b bc 24 a4 0a 00 00 <85> ff 0f 85 21 01 00 00 48 81 3b 40 cd c9 8c 0f 84 14 01 00 00 9c
RSP: 0018:ffffc9000142f4e8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff894ccc60 RCX: 0000000060d470d3
RDX: 0000000000000000 RSI: ffffffff878a88a0 RDI: 0000000000000000
RBP: ffffffff819bc808 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000200 R11: 0000000000000000 R12: ffff888117529d40
R13: ffffc9000142f650 R14: 0000000000000000 R15: ffff888117529d40
FS:  00007f157efb0c80(0000) GS:ffff888268adb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c007c27000 CR3: 00000001175b0000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:897 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1195 [inline]
 is_module_text_address+0x14d/0x220 kernel/module/main.c:3856
 kernel_text_address kernel/extable.c:119 [inline]
 kernel_text_address+0x81/0x100 kernel/extable.c:94
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
 arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6670 [inline]
 kfree+0x1ad/0x630 mm/slub.c:6878
 skb_kfree_head net/core/skbuff.c:1068 [inline]
 skb_free_head+0x119/0x220 net/core/skbuff.c:1080
 skb_release_data+0x540/0x700 net/core/skbuff.c:1107
 skb_release_all net/core/skbuff.c:1182 [inline]
 __kfree_skb net/core/skbuff.c:1196 [inline]
 consume_skb net/core/skbuff.c:1428 [inline]
 consume_skb+0xc4/0x110 net/core/skbuff.c:1422
 __unix_dgram_recvmsg+0x754/0xc30 net/unix/af_unix.c:2658
 unix_dgram_recvmsg+0xd0/0x110 net/unix/af_unix.c:2675
 sock_recvmsg_nosec net/socket.c:1078 [inline]
 sock_recvmsg+0x1f9/0x250 net/socket.c:1100
 sock_read_iter+0x2c6/0x3c0 net/socket.c:1170
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x957/0xb30 fs/read_write.c:572
 ksys_read+0x1f8/0x250 fs/read_write.c:715
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f157f100407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffceea27670 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f157efb0c80 RCX: 00007f157f100407
RDX: 00000000000000ff RSI: 000055be47d73300 RDI: 0000000000000000
RBP: 000055be47d732c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055be47d7334d
R13: 0000000000000000 R14: 000055be47d73300 R15: 000055be37958d98
 </TASK>