INFO: task hung in usbdev_ioctl (2)

Status: premoderation: reported syz repro on 2026/07/11 15:35
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+829fa6062f8d31a5b58f@syzkaller.appspotmail.com
First crash: 69d, last: 29d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/08/13 lts (merge base) 8c9d5557c8e6 syz Didn't crash
2026/08/13 upstream (ToT) 3d6d817622b0 syz [report] INFO: task hung in usbdev_ioctl
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in usbdev_ioctl (6) usb 1 1 690d 690d 0/29 auto-obsoleted due to no activity on 2025/01/26 07:16
linux-6.1 INFO: task hung in usbdev_ioctl 1 1 900d 900d 0/3 auto-obsoleted due to no activity on 2024/07/10 11:29
upstream INFO: task hung in usbdev_ioctl (5) usb 1 4 879d 925d 0/29 auto-obsoleted due to no activity on 2024/07/21 02:28
upstream INFO: task hung in usbdev_ioctl (4) usb 1 1 1182d 1182d 0/29 auto-obsoleted due to no activity on 2023/09/22 21:55
android-6-12 INFO: task hung in usbdev_ioctl 1 1 366d 366d 0/1 auto-obsoleted due to no activity on 2025/12/16 11:45
upstream INFO: task hung in usbdev_ioctl (7) usb 1 11 254d 568d 0/29 auto-obsoleted due to no activity on 2026/04/07 22:15
upstream INFO: task hung in usbdev_ioctl (2) usb 1 1 1671d 1671d 0/29 auto-closed as invalid on 2022/05/21 06:20
upstream INFO: task hung in usbdev_ioctl (3) usb 1 4 1301d 1461d 0/29 auto-obsoleted due to no activity on 2023/05/26 15:30
linux-5.15 INFO: task hung in usbdev_ioctl 1 2 25d 25d 0/3 upstream: reported on 2026/08/24 07:30
linux-6.1 INFO: task hung in usbdev_ioctl (2) 1 8 7d05h 46d 0/3 upstream: reported on 2026/08/03 16:39
upstream INFO: task hung in usbdev_ioctl usb 1 3 1758d 1764d 0/29 closed as invalid on 2022/02/08 09:40
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/08/20 09:18 17m retest repro android16-6.12 report job log log
2026/08/20 09:18 15m retest repro android16-6.12 no crash job log log
2026/08/20 09:18 17m retest repro android16-6.12 report job log log

Sample crash report:
INFO: task syz.2.19:401 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:0     pid:401   tgid:400   ppid:386    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2608 [inline]
 usbdev_ioctl+0x13e/0x2120 drivers/usb/core/devio.c:2824
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f23ff79de59
RSP: 002b:00007f23ff5eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f23ffa25fa0 RCX: 00007f23ff79de59
RDX: 0000200000000000 RSI: 000000008008551c RDI: 0000000000000003
RBP: 00007f23ff833e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f23ffa26038 R14: 00007f23ffa25fa0 R15: 00007ffff1bb00c8
 </TASK>
INFO: task syz.5.18:405 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.18        state:D stack:0     pid:405   tgid:403   ppid:383    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2608 [inline]
 usbdev_ioctl+0x13e/0x2120 drivers/usb/core/devio.c:2824
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fa123d9de59
RSP: 002b:00007fa124c4c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa124025fa0 RCX: 00007fa123d9de59
RDX: 0000200000000000 RSI: 000000008008551c RDI: 0000000000000003
RBP: 00007fa123e33e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa124026038 R14: 00007fa124025fa0 R15: 00007fffe5125d88
 </TASK>
INFO: task syz.0.17:407 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:0     pid:407   tgid:406   ppid:382    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2608 [inline]
 usbdev_ioctl+0x13e/0x2120 drivers/usb/core/devio.c:2824
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f2e7c79de59
RSP: 002b:00007f2e7d700028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2e7ca25fa0 RCX: 00007f2e7c79de59
RDX: 0000200000000000 RSI: 000000008008551c RDI: 0000000000000003
RBP: 00007f2e7c833e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2e7ca26038 R14: 00007f2e7ca25fa0 R15: 00007fff9f3a06f8
 </TASK>
INFO: task syz.3.20:410 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:0     pid:410   tgid:409   ppid:387    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_open+0x156/0x840 drivers/usb/core/devio.c:1051
 chrdev_open+0x4e8/0x610 fs/char_dev.c:414
 do_dentry_open+0x97f/0x1510 fs/open.c:960
 vfs_open+0x86/0x240 fs/open.c:1092
 do_open fs/namei.c:3782 [inline]
 path_openat+0x2c49/0x35a0 fs/namei.c:3941
 do_filp_open+0x1f2/0x440 fs/namei.c:3968
 do_sys_openat2+0x134/0x1d0 fs/open.c:1440
 do_sys_open fs/open.c:1455 [inline]
 __do_sys_openat fs/open.c:1471 [inline]
 __se_sys_openat fs/open.c:1466 [inline]
 __x64_sys_openat+0x13a/0x170 fs/open.c:1466
 x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fae6615e68e
RSP: 002b:00007fae66ffcb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fae66ffd6c0 RCX: 00007fae6615e68e
RDX: 0000000000008001 RSI: 00007fae66ffcc00 RDI: ffffffffffffff9c
RBP: 00007fae66ffcc00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fae66426038 R14: 00007fae66425fa0 R15: 00007ffd33e535c8
 </TASK>
INFO: task syz.6.21:451 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.21        state:D stack:0     pid:451   tgid:450   ppid:432    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_open+0x156/0x840 drivers/usb/core/devio.c:1051
 chrdev_open+0x4e8/0x610 fs/char_dev.c:414
 do_dentry_open+0x97f/0x1510 fs/open.c:960
 vfs_open+0x86/0x240 fs/open.c:1092
 do_open fs/namei.c:3782 [inline]
 path_openat+0x2c49/0x35a0 fs/namei.c:3941
 do_filp_open+0x1f2/0x440 fs/namei.c:3968
 do_sys_openat2+0x134/0x1d0 fs/open.c:1440
 do_sys_open fs/open.c:1455 [inline]
 __do_sys_openat fs/open.c:1471 [inline]
 __se_sys_openat fs/open.c:1466 [inline]
 __x64_sys_openat+0x13a/0x170 fs/open.c:1466
 x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f81e675e68e
RSP: 002b:00007f81e76ccb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f81e76cd6c0 RCX: 00007f81e675e68e
RDX: 0000000000008001 RSI: 00007f81e76ccc00 RDI: ffffffffffffff9c
RBP: 00007f81e76ccc00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f81e6a26038 R14: 00007f81e6a25fa0 R15: 00007ffc5274f248
 </TASK>
INFO: task syz.8.23:454 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.23        state:D stack:0     pid:454   tgid:453   ppid:436    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_open+0x156/0x840 drivers/usb/core/devio.c:1051
 chrdev_open+0x4e8/0x610 fs/char_dev.c:414
 do_dentry_open+0x97f/0x1510 fs/open.c:960
 vfs_open+0x86/0x240 fs/open.c:1092
 do_open fs/namei.c:3782 [inline]
 path_openat+0x2c49/0x35a0 fs/namei.c:3941
 do_filp_open+0x1f2/0x440 fs/namei.c:3968
 do_sys_openat2+0x134/0x1d0 fs/open.c:1440
 do_sys_open fs/open.c:1455 [inline]
 __do_sys_openat fs/open.c:1471 [inline]
 __se_sys_openat fs/open.c:1466 [inline]
 __x64_sys_openat+0x13a/0x170 fs/open.c:1466
 x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff579b5e68e
RSP: 002b:00007ff57aa20b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff57aa216c0 RCX: 00007ff579b5e68e
RDX: 0000000000008001 RSI: 00007ff57aa20c00 RDI: ffffffffffffff9c
RBP: 00007ff57aa20c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007ff579e26038 R14: 00007ff579e25fa0 R15: 00007ffe50ccb7c8
 </TASK>
INFO: task syz.9.24:458 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.24        state:D stack:0     pid:458   tgid:455   ppid:437    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_open+0x156/0x840 drivers/usb/core/devio.c:1051
 chrdev_open+0x4e8/0x610 fs/char_dev.c:414
 do_dentry_open+0x97f/0x1510 fs/open.c:960
 vfs_open+0x86/0x240 fs/open.c:1092
 do_open fs/namei.c:3782 [inline]
 path_openat+0x2c49/0x35a0 fs/namei.c:3941
 do_filp_open+0x1f2/0x440 fs/namei.c:3968
 do_sys_openat2+0x134/0x1d0 fs/open.c:1440
 do_sys_open fs/open.c:1455 [inline]
 __do_sys_openat fs/open.c:1471 [inline]
 __se_sys_openat fs/open.c:1466 [inline]
 __x64_sys_openat+0x13a/0x170 fs/open.c:1466
 x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff443f5e68e
RSP: 002b:00007ff444e7db28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff444e7e6c0 RCX: 00007ff443f5e68e
RDX: 0000000000008001 RSI: 00007ff444e7dc00 RDI: ffffffffffffff9c
RBP: 00007ff444e7dc00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007ff444226038 R14: 00007ff444225fa0 R15: 00007ffc298f0618
 </TASK>
INFO: task syz.7.22:457 blocked for more than 125 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.22        state:D stack:0     pid:457   tgid:456   ppid:434    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6054 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7867
 __schedule_loop kernel/sched/core.c:7944 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7959
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8016
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x902/0x1b90 kernel/locking/mutex.c:806
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1136
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 device_lock include/linux/device.h:911 [inline]
 usbdev_open+0x156/0x840 drivers/usb/core/devio.c:1051
 chrdev_open+0x4e8/0x610 fs/char_dev.c:414
 do_dentry_open+0x97f/0x1510 fs/open.c:960
 vfs_open+0x86/0x240 fs/open.c:1092
 do_open fs/namei.c:3782 [inline]
 path_openat+0x2c49/0x35a0 fs/namei.c:3941
 do_filp_open+0x1f2/0x440 fs/namei.c:3968
 do_sys_openat2+0x134/0x1d0 fs/open.c:1440
 do_sys_open fs/open.c:1455 [inline]
 __do_sys_openat fs/open.c:1471 [inline]
 __se_sys_openat fs/open.c:1466 [inline]
 __x64_sys_openat+0x13a/0x170 fs/open.c:1466
 x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f8f1275e68e
RSP: 002b:00007f8f136cab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8f136cb6c0 RCX: 00007f8f1275e68e
RDX: 0000000000008001 RSI: 00007f8f136cac00 RDI: ffffffffffffff9c
RBP: 00007f8f136cac00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f8f12a26038 R14: 00007f8f12a25fa0 R15: 00007ffcf3da9728
 </TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 7d836c68f7d55d9b8be32a3afed0c3f02dc2df9e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xe45/0xf90 kernel/hung_task.c:423
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 475 Comm: kworker/1:10 Not tainted syzkaller #0 7d836c68f7d55d9b8be32a3afed0c3f02dc2df9e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
RIP: 0010:chacha_block_generic+0x11/0xdb0 lib/crypto/chacha.c:77
Code: cc cc cc cc cc cc cc cc cc b8 12 69 7d 3e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 <48> 83 e4 e0 48 81 ec c0 00 00 00 89 54 24 14 49 89 f4 49 89 ff 65
RSP: 0018:ffffc900007df228 EFLAGS: 00000293
RAX: ffffffff82b29a98 RBX: 0000000000000020 RCX: ffff88810e7e4c00
RDX: 0000000000000014 RSI: ffffc900007df2a0 RDI: ffffc900007df590
RBP: ffffc900007df250 R08: ffffc900007df2df R09: 0000000000000000
R10: ffffc900007df2a0 R11: fffff520000fbe5c R12: dffffc0000000000
R13: 1ffff920000fbe50 R14: ffff888008b93000 R15: ffffc900007df660
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555577e8a4e8 CR3: 000000010cf72000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 chacha_crypt_generic+0x85b/0x8d0 lib/crypto/libchacha.c:29
 chacha_crypt_arch+0xaa/0xe0 arch/x86/crypto/chacha_glue.c:147
 chacha_crypt include/crypto/chacha.h:100 [inline]
 chacha20_crypt include/crypto/chacha.h:108 [inline]
 chacha20poly1305_crypt_sg_inplace+0x483/0xc00 lib/crypto/chacha20poly1305.c:245
 chacha20poly1305_encrypt_sg_inplace+0x44/0x70 lib/crypto/chacha20poly1305.c:338
 encrypt_packet drivers/net/wireguard/send.c:216 [inline]
 wg_packet_encrypt_worker+0x935/0x16c0 drivers/net/wireguard/send.c:297
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/12 23:51 android16-6.12 0026e4ecedf0 d78ea535 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in usbdev_ioctl
2026/07/12 00:56 android16-6.12 0026e4ecedf0 d78ea535 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in usbdev_ioctl
2026/07/13 08:30 android16-6.12 0026e4ecedf0 d78ea535 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in usbdev_ioctl
2026/07/11 15:34 android16-6.12 0026e4ecedf0 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in usbdev_ioctl
* Struck through repros no longer work on HEAD.