INFO: task kworker/u4:1:11 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:1 state:D stack:22992 pid:11 ppid:2 flags:0x00004000
Workqueue: nvme-wq nvme_fc_connect_ctrl_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138
nvme_fc_send_ls_req drivers/nvme/host/fc.c:1142 [inline]
nvme_fc_connect_admin_queue+0x3de/0xba0 drivers/nvme/host/fc.c:1226
nvme_fc_create_association drivers/nvme/host/fc.c:3082 [inline]
nvme_fc_connect_ctrl_work+0x500/0x1220 drivers/nvme/host/fc.c:3381
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
INFO: task syz-executor:4282 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22544 pid:4282 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline]
synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962
namespace_unlock+0x23f/0x440 fs/namespace.c:1502
do_umount fs/namespace.c:1726 [inline]
path_umount+0xf23/0xfa0 fs/namespace.c:1809
ksys_umount fs/namespace.c:1832 [inline]
__do_sys_umount fs/namespace.c:1837 [inline]
__se_sys_umount fs/namespace.c:1835 [inline]
__x64_sys_umount+0x12d/0x170 fs/namespace.c:1835
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe4d099f397
RSP: 002b:00007ffd73f6d868 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007fe4d0a3448b RCX: 00007fe4d099f397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd73f6d920
RBP: 00007ffd73f6d920 R08: 00007ffd73f6e920 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd73f6e9b0
R13: 00007fe4d0a3448b R14: 00000000000496af R15: 00007ffd73f6e9f0
</TASK>
INFO: task udevd:4285 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:23664 pid:4285 ppid:3638 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
device_lock include/linux/device.h:885 [inline]
uevent_show+0x16e/0x320 drivers/base/core.c:2669
dev_attr_show+0x50/0xb0 drivers/base/core.c:2372
sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59
seq_read_iter+0x460/0xc50 fs/seq_file.c:230
call_read_iter include/linux/fs.h:2265 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x471/0x960 fs/read_write.c:470
ksys_read+0x14d/0x260 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb2834a7407
RSP: 002b:00007ffdbecc45a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fb283c71880 RCX: 00007fb2834a7407
RDX: 0000000000001000 RSI: 000055a44aaedc40 RDI: 0000000000000008
RBP: 00007fb2835efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fb2835efea0 R14: 0000000000000000 R15: 000055a44aac45f0
</TASK>
INFO: task kworker/u4:6:4334 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:6 state:D stack:22208 pid:4334 ppid:2 flags:0x00004000
Workqueue: nvme-wq nvme_fc_connect_ctrl_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138
nvme_fc_send_ls_req drivers/nvme/host/fc.c:1142 [inline]
nvme_fc_connect_admin_queue+0x3de/0xba0 drivers/nvme/host/fc.c:1226
nvme_fc_create_association drivers/nvme/host/fc.c:3082 [inline]
nvme_fc_connect_ctrl_work+0x500/0x1220 drivers/nvme/host/fc.c:3381
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
INFO: task kworker/u4:8:4438 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:8 state:D stack:22608 pid:4438 ppid:2 flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138
__synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243
fsnotify_mark_destroy_workfn+0x106/0x2e0 fs/notify/mark.c:928
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
INFO: task syz-executor:5346 blocked for more than 146 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22928 pid:5346 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
namespace_unlock+0x23f/0x440 fs/namespace.c:1502
do_umount fs/namespace.c:1726 [inline]
path_umount+0xf23/0xfa0 fs/namespace.c:1809
ksys_umount fs/namespace.c:1832 [inline]
__do_sys_umount fs/namespace.c:1837 [inline]
__se_sys_umount fs/namespace.c:1835 [inline]
__x64_sys_umount+0x12d/0x170 fs/namespace.c:1835
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f188bf9f397
RSP: 002b:00007ffda7a1b9b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007f188c03448b RCX: 00007f188bf9f397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffda7a1ba70
RBP: 00007ffda7a1ba70 R08: 00007ffda7a1ca70 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffda7a1cb00
R13: 00007f188c03448b R14: 0000000000049192 R15: 00007ffda7a1cb40
</TASK>
INFO: task kworker/u4:11:5557 blocked for more than 146 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:11 state:D stack:25936 pid:5557 ppid:2 flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138
__synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243
fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
INFO: task kworker/u4:14:5676 blocked for more than 147 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:14 state:D stack:22144 pid:5676 ppid:2 flags:0x00004000
Workqueue: nvme-wq nvme_fc_connect_ctrl_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138
nvme_fc_send_ls_req drivers/nvme/host/fc.c:1142 [inline]
nvme_fc_connect_admin_queue+0x3de/0xba0 drivers/nvme/host/fc.c:1226
nvme_fc_create_association drivers/nvme/host/fc.c:3082 [inline]
nvme_fc_connect_ctrl_work+0x500/0x1220 drivers/nvme/host/fc.c:3381
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
INFO: task syz.1.493:6378 blocked for more than 148 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.493 state:D stack:25520 pid:6378 ppid:5430 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977
synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580
vhost_vsock_dev_release+0x14d/0x3f0 drivers/vhost/vsock.c:730
__fput+0x20a/0x8b0 fs/file_table.c:320
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0a6ab9e159
RSP: 002b:00007fff80e5ec68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f0a6ae27da0 RCX: 00007f0a6ab9e159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f0a6ae27da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f0a6ae27cb0 R11: 0000000000000246 R12: 0000000000048d82
R13: 00007f0a6ae2618c R14: 0000000000048ba5 R15: 00007f0a6ae26180
</TASK>
INFO: task syz.2.497:6410 blocked for more than 148 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.497 state:D stack:28368 pid:6410 ppid:5287 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline]
synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962
synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580
isotp_release+0x728/0x9a0 net/can/isotp.c:1458
__sock_release net/socket.c:654 [inline]
sock_close+0xbf/0x210 net/socket.c:1400
__fput+0x20a/0x8b0 fs/file_table.c:320
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f46fa19e159
RSP: 002b:00007f46fb08b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007f46fa425fa0 RCX: 00007f46fa19e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f46fa23503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f46fa426038 R14: 00007f46fa425fa0 R15: 00007ffebebd7678
</TASK>
Showing all locks held in the system:
3 locks held by kworker/0:0/7:
#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900000c7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104
2 locks held by kworker/u4:1/11:
#0: ffff888025fe3938 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90000107d00 ((work_completion)(&(&ctrl->connect_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e5b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8cb2edd0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/27:
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527
2 locks held by getty/4034:
#0: ffff88802f81c098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198
4 locks held by udevd/4285:
#0: ffff88802e7179e0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0x9d/0xc50 fs/seq_file.c:182
#1: ffff88805782bc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x59/0x410 fs/kernfs/file.c:172
#2: ffff888058046578 (kn->active#5){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888058046578 (kn->active#5){.+.+}-{0:0}, at: kernfs_seq_start+0xae/0x410 fs/kernfs/file.c:173
#3: ffff8880734aa190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
#3: ffff8880734aa190 (&dev->mutex){....}-{3:3}, at: uevent_show+0x16e/0x320 drivers/base/core.c:2669
3 locks held by kworker/0:4/4320:
#0: ffff88802f651538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900044e7d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4679
2 locks held by kworker/u4:6/4334:
#0: ffff888025fe3938 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90004567d00 ((work_completion)(&(&ctrl->connect_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
5 locks held by kworker/1:8/4404:
2 locks held by kworker/u4:8/4438:
#0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90004c27d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
1 lock held by syz-executor/5346:
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
2 locks held by kworker/u4:11/5557:
#0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003527d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
2 locks held by kworker/u4:14/5676:
#0: ffff888025fe3938 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003907d00 ((work_completion)(&(&ctrl->connect_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
3 locks held by kworker/u4:16/5724:
#0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003c17d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
1 lock held by syz.1.493/6378:
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962
2 locks held by syz.2.497/6410:
#0: ffff88805612d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:764 [inline]
#0: ffff88805612d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
#0: ffff88805612d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 net/socket.c:1400
#1: ffff888033500130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#1: ffff888033500130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: isotp_release+0x4e6/0x9a0 net/can/isotp.c:1429
1 lock held by dhcpcd/6414:
#0: ffff88802984e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#0: ffff88802984e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3282
1 lock held by syz.3.500/6415:
#0: ffff88805612ca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:764 [inline]
#0: ffff88805612ca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
#0: ffff88805612ca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 net/socket.c:1400
1 lock held by dhcpcd/6417:
#0: ffff88807e2a6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#0: ffff88807e2a6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3282
1 lock held by dhcpcd/6418:
#0: ffff8880797d6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#0: ffff8880797d6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3282
1 lock held by dhcpcd/6419:
#0: ffff888059554130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#0: ffff888059554130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3282
1 lock held by syz-executor/6421:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6431:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6433:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6435:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6438:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6441:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6446:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6448:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6451:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6454:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6457:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6462:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6464:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6466:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
1 lock held by syz-executor/6469:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4404 Comm: kworker/1:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:memset_erms+0xb/0x10 arch/x86/lib/memset_64.S:65
Code: 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3 aa <4c> 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01
RSP: 0018:ffffc900001e0338 EFLAGS: 00000002
RAX: 0000000000000000 RBX: ffffc900001e03e8 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc900001e0448
RBP: dffffc0000000000 R08: ffffc900001e0447 R09: ffffc900001e0438
R10: dffffc0000000000 R11: fffff5200003c089 R12: dffffc0000000000
R13: ffffc90004a78000 R14: ffffc900001e0420 R15: ffffc900001e041d
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055acbc3b3980 CR3: 0000000030719000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
unwind_next_frame+0x8da/0x1fd0 arch/x86/kernel/unwind_orc.c:546
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x200 mm/slub.c:3700
skb_free_head net/core/skbuff.c:762 [inline]
skb_release_data+0x5e9/0x7e0 net/core/skbuff.c:791
skb_release_all net/core/skbuff.c:856 [inline]
__kfree_skb net/core/skbuff.c:870 [inline]
consume_skb+0xa2/0x100 net/core/skbuff.c:1035
ath6kl_usb_cleanup_recv_urb drivers/net/wireless/ath/ath6kl/usb.c:171 [inline]
ath6kl_usb_recv_complete+0x1b8/0x4a0 drivers/net/wireless/ath/ath6kl/usb.c:551
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
dummy_timer+0xa39/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2018
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:unwind_next_frame+0x1571/0x1fd0 arch/x86/kernel/unwind_orc.c:605
Code: 89 f9 80 e1 07 80 c1 03 38 c1 7c cc 4c 89 ff e8 c5 5e 9a 00 eb c2 4d 8d 7c 24 02 49 83 c4 03 4c 89 f8 48 c1 e8 03 0f b6 04 28 <84> c0 0f 85 0e 09 00 00 4c 89 e0 48 c1 e8 03 0f b6 04 28 84 c0 0f
RSP: 0018:ffffc90004a768c0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffc90004a76968 RCX: 0000000000000000
RDX: 1ffffffff1dc5bca RSI: 0000000000000001 RDI: ffffc90004a77148
RBP: dffffc0000000000 R08: ffffc90004a769c7 R09: ffffc90004a769b8
R10: dffffc0000000000 R11: fffff5200094ed39 R12: ffffffff8ee2de55
R13: ffffffff8ee2de56 R14: ffffc90004a769a0 R15: ffffffff8ee2de54
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xb3/0x240 mm/slab_common.c:949
kmalloc include/linux/slab.h:568 [inline]
usb_alloc_urb+0x3f/0x140 drivers/usb/core/urb.c:75
ath6kl_usb_post_recv_transfers+0x230/0x680 drivers/net/wireless/ath/ath6kl/usb.c:432
ath6kl_usb_start_recv_pipes drivers/net/wireless/ath/ath6kl/usb.c:498 [inline]
hif_start drivers/net/wireless/ath/ath6kl/usb.c:703 [inline]
ath6kl_usb_power_on+0x66/0x280 drivers/net/wireless/ath/ath6kl/usb.c:1062
ath6kl_hif_power_on drivers/net/wireless/ath/ath6kl/hif-ops.h:136 [inline]
ath6kl_core_init+0x1d6/0x10a0 drivers/net/wireless/ath/ath6kl/core.c:97
ath6kl_usb_probe+0x145d/0x1550 drivers/net/wireless/ath/ath6kl/usb.c:1168
usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x24a/0xb40 drivers/base/dd.c:638
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a7/0x480 drivers/base/dd.c:1034
bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
device_add+0xbcf/0x1050 drivers/base/core.c:3712
usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x24a/0xb40 drivers/base/dd.c:638
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a7/0x480 drivers/base/dd.c:1034
bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
device_add+0xbcf/0x1050 drivers/base/core.c:3712
usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2664
hub_port_connect drivers/usb/core/hub.c:5522 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
port_event drivers/usb/core/hub.c:5822 [inline]
hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5904
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>