syzbot

watchdog: BUG: soft lockup - CPU#1 stuck for 144s! [kworker/1:4:19193]
Modules linked in:
irq event stamp: 7108977
hardirqs last  enabled at (7108976): [<ffffffff87564fe2>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (7108976): [<ffffffff87564fe2>] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:194
hardirqs last disabled at (7108977): [<ffffffff8753b17e>] sysvec_apic_timer_interrupt+0xe/0xb0 arch/x86/kernel/apic/apic.c:1056
softirqs last  enabled at (7108964): [<ffffffff86339cdd>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last  enabled at (7108964): [<ffffffff86339cdd>] __alloc_skb+0x35d/0x410 net/core/skbuff.c:672
softirqs last disabled at (7108971): [<ffffffff817694ed>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (7108971): [<ffffffff817694ed>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (7108971): [<ffffffff817694ed>] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
CPU: 1 UID: 0 PID: 19193 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 06 e1 37 fa 48 89 df e8 ee 2e 38 fa f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 e5 b9 2b fa 65 8b 05 5e 10 75 05 85 c0 74 16 5b
RSP: 0018:ffffc900001a8c00 EFLAGS: 00000246
RAX: 0000000000000012 RBX: ffff888109fc8000 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffffff88dec71f RDI: ffffffff878e97a0
RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888134c97a10
R13: ffff88810a76e470 R14: 1ffff920000351b0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888268a6a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f78e1328060 CR3: 00000000092a8000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 dummy_timer+0x1d58/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:2012
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x516/0x990 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 06 e1 37 fa 48 89 df e8 ee 2e 38 fa f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 e5 b9 2b fa 65 8b 05 5e 10 75 05 85 c0 74 16 5b
RSP: 0018:ffffc9000200e670 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff88823fffaa60 RCX: 0000000000000040
RDX: 0000000000000000 RSI: ffffffff88dec71f RDI: ffffffff878e97a0
RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffea0006bc4208 R12: 0000000000000038
R13: dffffc0000000000 R14: 0000000000000246 R15: ffff88823fffaa60
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 rmqueue_bulk mm/page_alloc.c:2574 [inline]
 __rmqueue_pcplist+0xe78/0x1a20 mm/page_alloc.c:3332
 rmqueue_pcplist mm/page_alloc.c:3371 [inline]
 rmqueue mm/page_alloc.c:3401 [inline]
 get_page_from_freelist+0x1ed9/0x3b20 mm/page_alloc.c:3942
 __alloc_frozen_pages_noprof+0x269/0x2230 mm/page_alloc.c:5240
 alloc_pages_mpol+0xe8/0x410 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab mm/slub.c:3248 [inline]
 new_slab+0x2c4/0x440 mm/slub.c:3302
 ___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
 __slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
 __slab_alloc_node mm/slub.c:4855 [inline]
 slab_alloc_node mm/slub.c:5251 [inline]
 __do_kmalloc_node mm/slub.c:5656 [inline]
 __kmalloc_node_track_caller_noprof+0x5d4/0x9a0 mm/slub.c:5764
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:608
 __alloc_skb+0x186/0x410 net/core/skbuff.c:690
 __netdev_alloc_skb+0x7a/0x8f0 net/core/skbuff.c:754
 netdev_alloc_skb include/linux/skbuff.h:3484 [inline]
 dev_alloc_skb include/linux/skbuff.h:3497 [inline]
 ath6kl_usb_post_recv_transfers.constprop.0+0x55/0x3d0 drivers/net/wireless/ath/ath6kl/usb.c:428
 ath6kl_usb_start_recv_pipes drivers/net/wireless/ath/ath6kl/usb.c:498 [inline]
 hif_start drivers/net/wireless/ath/ath6kl/usb.c:703 [inline]
 ath6kl_usb_power_on+0x8e/0x160 drivers/net/wireless/ath/ath6kl/usb.c:1062
 ath6kl_hif_power_on drivers/net/wireless/ath/ath6kl/hif-ops.h:136 [inline]
 ath6kl_core_init+0x173/0x11b0 drivers/net/wireless/ath/ath6kl/core.c:97
 ath6kl_usb_probe+0xcd0/0x13e0 drivers/net/wireless/ath/ath6kl/usb.c:1168
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:581 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:659
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1031
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1086
 bus_probe_device+0x64/0x160 drivers/base/bus.c:574
 device_add+0x11d9/0x1950 drivers/base/core.c:3689
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:581 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:659
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1031
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1086
 bus_probe_device+0x64/0x160 drivers/base/bus.c:574
 device_add+0x11d9/0x1950 drivers/base/core.c:3689
 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
usb 7-1: pegasus_irq - nonzero urb status received: -71
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 2845 Comm: acpid Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__sanitizer_cov_trace_pc+0x54/0x70 kernel/kcov.c:222
Code: c3 cc cc cc cc 8b 82 64 15 00 00 85 c0 74 f1 8b 82 40 15 00 00 83 f8 02 75 e6 48 8b 8a 48 15 00 00 8b 92 44 15 00 00 48 8b 01 <48> 83 c0 01 48 39 d0 73 cd 48 89 01 48 89 34 c1 c3 cc cc cc cc 0f
RSP: 0018:ffffc90000007220 EFLAGS: 00000046
RAX: 0000000000009143 RBX: ffffc90000007348 RCX: ffffc90001001000
RDX: 0000000000040000 RSI: ffffffff81903c18 RDI: ffff8881173b1d40
RBP: ffffc90000007478 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000963900 R12: 1ffff92000000e47
R13: 0000000000000001 R14: 0000000000000000 R15: ffffc90000007348
FS:  00007f4aa6bb2740(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f78e05c8400 CR3: 000000011742a000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 info_print_prefix+0x1e8/0x350 kernel/printk/printk.c:1383
 record_print_text+0x143/0x3c0 kernel/printk/printk.c:1432
 printk_get_next_message+0x2d1/0x6c0 kernel/printk/printk.c:3018
 console_emit_next_record kernel/printk/printk.c:3083 [inline]
 console_flush_one_record+0x67c/0xe50 kernel/printk/printk.c:3215
 console_flush_all kernel/printk/printk.c:3289 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3359
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426
 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4914
 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4925
 __dev_printk+0xcb/0x100 drivers/base/core.c:4937
 _dev_err+0xef/0x127 drivers/base/core.c:4980
 pegasus_irq+0x584/0x5c0 drivers/input/tablet/pegasus_notetaker.c:198
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x516/0x990 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3216
Code: 00 e8 11 59 28 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 5f 76 20 00 48 85 ed 0f 85 d7 01 00 00 e8 71 7b 20 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b
RSP: 0018:ffffc90001467200 EFLAGS: 00000293
RAX: ffffffff89a50638 RBX: ffffffff89a505e0 RCX: ffffffff8190c081
RDX: ffff8881173b1d40 RSI: ffffffff8190c08f RDI: ffff8881173b1d40
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000025bfc
R13: ffffffff89a50638 R14: ffffc90001467280 R15: dffffc0000000000
 console_flush_all kernel/printk/printk.c:3289 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3359
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426
 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4914
 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4925
 __dev_printk+0xcb/0x100 drivers/base/core.c:4937
 _dev_err+0xef/0x127 drivers/base/core.c:4980
 pegasus_control_msg.constprop.0.cold+0x4f/0x5b drivers/input/tablet/pegasus_notetaker.c:120
 pegasus_set_mode drivers/input/tablet/pegasus_notetaker.c:132 [inline]
 __pegasus_open drivers/input/tablet/pegasus_notetaker.c:230 [inline]
 pegasus_open+0x1bf/0x350 drivers/input/tablet/pegasus_notetaker.c:251
 input_open_device+0x24c/0x3e0 drivers/input/input.c:601
 evdev_open_device drivers/input/evdev.c:391 [inline]
 evdev_open+0x52f/0x690 drivers/input/evdev.c:478
 chrdev_open+0x234/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x71a/0x1400 fs/open.c:962
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:4637 [inline]
 path_openat+0x21dc/0x3120 fs/namei.c:4796
 do_filp_open+0x1f7/0x420 fs/namei.c:4823
 do_sys_openat2+0x12e/0x220 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1447
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4aa6c3c407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd6aedb680 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f4aa6bb2740 RCX: 00007f4aa6c3c407
RDX: 0000000000080800 RSI: 00007ffd6aedb890 RDI: ffffffffffffff9c
RBP: 00007ffd6aedb890 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000020
R13: 00007ffd6aedb990 R14: 000056158316c7fe R15: 00007ffd6aedb990
 </TASK>