INFO: task kworker/1:3:5764 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:3 state:D stack:24920 pid:5764 ppid:2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
__flush_work+0x92f/0xac0 kernel/workqueue.c:3475
__cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562
__mmc_stop_host drivers/mmc/core/core.c:2308 [inline]
mmc_stop_host+0xd9/0x460 drivers/mmc/core/core.c:2313
mmc_remove_host+0x15/0x60 drivers/mmc/core/host.c:675
vub300_disconnect+0x14f/0x2e0 drivers/mmc/host/vub300.c:2380
usb_unbind_interface+0x207/0x870 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:628 [inline]
__device_release_driver drivers/base/dd.c:1351 [inline]
device_release_driver_internal+0x458/0x6f0 drivers/base/dd.c:1374
bus_remove_device+0x43b/0x520 drivers/base/bus.c:624
device_del+0x51f/0x910 drivers/base/core.c:3889
usb_disable_device+0x3ee/0x8a0 drivers/usb/core/message.c:1474
usb_disconnect+0x340/0x8a0 drivers/usb/core/hub.c:2320
hub_port_connect drivers/usb/core/hub.c:5374 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5674 [inline]
port_event drivers/usb/core/hub.c:5838 [inline]
hub_event+0x1d69/0x4a80 drivers/usb/core/hub.c:5920
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
INFO: task kworker/0:5:5818 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:5 state:D stack:24616 pid:5818 ppid:2 flags:0x00004000
Workqueue: events_freezable mmc_rescan
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
mmc_wait_for_req_done+0x37/0x460 drivers/mmc/core/core.c:402
mmc_wait_for_cmd+0x178/0x280 drivers/mmc/core/core.c:638
mmc_io_rw_direct_host drivers/mmc/core/sdio_ops.c:83 [inline]
sdio_reset+0xf8/0x3c0 drivers/mmc/core/sdio_ops.c:209
mmc_rescan_try_freq drivers/mmc/core/core.c:2076 [inline]
mmc_rescan+0x69b/0xfb0 drivers/mmc/core/core.c:2259
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Showing all locks held in the system:
5 locks held by kworker/u4:1/12:
#0: ffff8880b8f3c258 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 kernel/sched/core.c:6696
#2: ffff888021600768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5777 [inline]
#2: ffff888021600768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x35/0x260 net/wireless/core.c:424
#3: ffffffff974ce740 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6c/0x500 lib/debugobjects.c:747
#4: ffffffff974d3de0 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed lib/debugobjects.c:1034 [inline]
#4: ffffffff974d3de0 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_check_no_obj_freed+0x9e/0x520 lib/debugobjects.c:1075
1 lock held by khungtaskd/29:
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/u4:3/49:
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90000b9fd00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90000b9fd00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
5 locks held by kworker/u4:4/59:
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900015a7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900015a7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3ca510 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606
#3: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa00 net/core/dev.c:11770
#4: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#4: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004
2 locks held by kworker/u4:5/170:
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90002ea7d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90002ea7d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
2 locks held by kworker/0:2/1192:
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000484fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000484fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by kworker/u4:9/3521:
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000cc27d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000cc27d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
2 locks held by kworker/u4:10/3542:
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000cc57d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000cc57d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
1 lock held by dhcpcd/5436:
#0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2fc/0x1d70 net/ipv4/devinet.c:1101
2 locks held by getty/5533:
#0: ffff88814cb950a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
5 locks held by kworker/1:3/5764:
#0: ffff888019ab4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888019ab4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000471fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000471fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: hub_event+0x188/0x4a80 drivers/usb/core/hub.c:5866
#3: ffff88807defc1d8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#3: ffff88807defc1d8 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0xfc/0x8a0 drivers/usb/core/hub.c:2311
#4: ffff88807ad2b1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#4: ffff88807ad2b1a8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
#4: ffff88807ad2b1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa7/0x6f0 drivers/base/dd.c:1371
3 locks held by kworker/1:4/5817:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90004aafd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90004aafd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
2 locks held by kworker/0:5/5818:
#0: ffff888017c72138 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72138 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90004f07d00 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90004f07d00 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by syz.3.379/7092:
#0: ffff8880217afc48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
#1: ffffffff8dce3548 (usb_bus_idr_lock){+.+.}-{3:3}, at: usb_device_read+0xe8/0x2c0 drivers/usb/core/devices.c:522
#2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: usb_device_read+0x17d/0x2c0 drivers/usb/core/devices.c:528
7 locks held by syz-executor/9072:
#0: ffff888031af8418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
#1: ffff88805c69b888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
#2: ffff8880247562f0 (kn->active#54){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff8880247562f0 (kn->active#54){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 fs/kernfs/file.c:344
#3: ffffffff8dcb7648 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: new_device_store+0x13d/0x690 drivers/net/netdevsim/bus.c:160
#4: ffff88801c374130 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#4: ffff88801c374130 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 drivers/base/dd.c:1084
#5: ffff888023e5b250 (&devlink->lock_key#9){+.+.}-{3:3}, at: nsim_drv_probe+0xc8/0xb90 drivers/net/netdevsim/dev.c:1537
#6: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:335 [inline]
#6: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: nsim_create+0x378/0x4a0 drivers/net/netdevsim/netdev.c:401
2 locks held by syz.4.977/9074:
#0: ffff88802cdf4870 (&usblp->wmut){+.+.}-{3:3}, at: usblp_write+0x5c/0x900 drivers/usb/class/usblp.c:750
#1: ffff88802cdf4900 (&usblp->mut){+.+.}-{3:3}, at: usblp_wwait+0x3be/0x9b0 drivers/usb/class/usblp.c:-1
1 lock held by syz.0.994/9132:
#0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3f7/0x2070 drivers/net/tun.c:3124
1 lock held by syz.0.994/9136:
#0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3f7/0x2070 drivers/net/tun.c:3124
1 lock held by syz.7.986/9135:
#0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: wext_ioctl_dispatch+0x106/0x650 net/wireless/wext-core.c:1015
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1138 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:187
Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b4 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 13 02 00 00 49 89
RSP: 0018:ffffc9000466f260 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffffffff8a00cc12
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88802ee124d2
RBP: ffffc9000466f3d0 R08: ffff88801f73a1ae R09: 1ffff11003ee7435
R10: dffffc0000000000 R11: ffffed1003ee7436 R12: ffffffff8a00cc12
R13: dffffc0000000000 R14: ffff88801f73a1a7 R15: ffff88802ee124d2
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff46a32ae9c CR3: 000000000cf32000 CR4: 00000000003506e0
Call Trace:
<TASK>
__asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
ieee80211_inform_bss+0x512/0xfd0 net/mac80211/scan.c:119
rdev_inform_bss+0x106/0x410 net/wireless/rdev-ops.h:418
cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2989 [inline]
cfg80211_inform_bss_frame_data+0xb22/0x1330 net/wireless/scan.c:3016
ieee80211_bss_info_update+0x789/0x9f0 net/mac80211/scan.c:211
ieee80211_rx_bss_info net/mac80211/ibss.c:1124 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1613 [inline]
ieee80211_ibss_rx_queued_mgmt+0x18f5/0x2dc0 net/mac80211/ibss.c:1642
ieee80211_iface_process_skb net/mac80211/iface.c:1661 [inline]
ieee80211_iface_work+0x730/0xc90 net/mac80211/iface.c:1715
cfg80211_wiphy_work+0x228/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>