INFO: task kworker/1:0:23 blocked for more than 151 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D
running task
stack:22248 pid:23 tgid:23 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:608
device_del+0x605/0x9b0 drivers/base/core.c:3896
device_unregister+0x1d/0xe0 drivers/base/core.c:3919
device_destroy+0x99/0xe0 drivers/base/core.c:4473
usb_deregister_dev+0x70/0x210 drivers/usb/core/file.c:184
usblp_disconnect+0x4a/0x1e0 drivers/usb/class/usblp.c:1409
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:573 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:565
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x42e/0x600 drivers/base/dd.c:1307
bus_remove_device+0x22f/0x440 drivers/base/bus.c:616
device_del+0x376/0x9b0 drivers/base/core.c:3878
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1418
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
process_scheduled_works kernel/workqueue.c:3358 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3439
kthread+0x370/0x450 kernel/kthread.c:467
ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz.4.706:7803 blocked for more than 180 seconds.
Not tainted syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.706 state:D
stack:27432 pid:7803 tgid:7790 ppid:2970 task_flags:0x40044c flags:0x00080003
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:608
device_remove+0xcb/0x180 drivers/base/dd.c:571
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x42e/0x600 drivers/base/dd.c:1307
driver_detach+0xd8/0x1b0 drivers/base/dd.c:1370
bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:784
driver_unregister+0x76/0xb0 drivers/base/driver.c:277
usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1751
raw_release+0x19b/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
__fput+0x3ff/0xb40 fs/file_table.c:469
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x829/0x2aa0 kernel/exit.c:971
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x7e/0x430 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x671/0x7b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f20cee1c42b
RSP: 002b:00007f20cd853f50 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007f20cee1c42b
RDX: 00007f20cd854fe0 RSI: 0000000080085502 RDI: 0000000000000003
RBP: 00007f20ceeb2bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000200000005740
R13: 0000200000005580 R14: 00007f20cf096090 R15: 00007ffd468dfeb8
</TASK>
INFO: task syz-executor:7806 blocked for more than 180 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:27736 pid:7806 tgid:7806 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
setup_net+0x118/0x3a0 net/core/net_namespace.c:446
copy_net_ns+0x440/0x780 net/core/net_namespace.c:581
create_new_namespaces+0x3ea/0xc00 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x455/0xab0 kernel/fork.c:3174
__do_sys_unshare kernel/fork.c:3245 [inline]
__se_sys_unshare kernel/fork.c:3243 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f896e26da67
RSP: 002b:00007ffd276c3338 EFLAGS: 00000202
ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f896e4e5f40 RCX: 00007f896e26da67
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f896e4e67b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffd276c3578 R15: 0000000000000000
</TASK>
INFO: task syz-executor:7809 blocked for more than 161 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:27096 pid:7809 tgid:7809 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
setup_net+0x118/0x3a0 net/core/net_namespace.c:446
copy_net_ns+0x440/0x780 net/core/net_namespace.c:581
create_new_namespaces+0x3ea/0xc00 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x455/0xab0 kernel/fork.c:3174
__do_sys_unshare kernel/fork.c:3245 [inline]
__se_sys_unshare kernel/fork.c:3243 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6936b3da67
RSP: 002b:00007ffd96be3f18 EFLAGS: 00000206
ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f6936db5f40 RCX: 00007f6936b3da67
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f6936db67b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffd96be4158 R15: 0000000000000000
</TASK>
INFO: task syz-executor:7822 blocked for more than 161 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:27736 pid:7822 tgid:7822 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
setup_net+0x118/0x3a0 net/core/net_namespace.c:446
copy_net_ns+0x440/0x780 net/core/net_namespace.c:581
create_new_namespaces+0x3ea/0xc00 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x455/0xab0 kernel/fork.c:3174
__do_sys_unshare kernel/fork.c:3245 [inline]
__se_sys_unshare kernel/fork.c:3243 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f447540da67
RSP: 002b:00007ffd2019ed68 EFLAGS: 00000202
ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f4475685f40 RCX: 00007f447540da67
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f44756867b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffd2019efa8 R15: 0000000000000000
</TASK>
INFO: task syz-executor:7826 blocked for more than 162 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:27736 pid:7826 tgid:7826 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
setup_net+0x118/0x3a0 net/core/net_namespace.c:446
copy_net_ns+0x440/0x780 net/core/net_namespace.c:581
create_new_namespaces+0x3ea/0xc00 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x455/0xab0 kernel/fork.c:3174
__do_sys_unshare kernel/fork.c:3245 [inline]
__se_sys_unshare kernel/fork.c:3243 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f88d0a3da67
RSP: 002b:00007ffc4806ae88 EFLAGS: 00000202
ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f88d0cb5f40 RCX: 00007f88d0a3da67
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f88d0cb67b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffc4806b0c8 R15: 0000000000000000
</TASK>
INFO: task syz-executor:7836 blocked for more than 163 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:27736 pid:7836 tgid:7836 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
setup_net+0x118/0x3a0 net/core/net_namespace.c:446
copy_net_ns+0x440/0x780 net/core/net_namespace.c:581
create_new_namespaces+0x3ea/0xc00 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x455/0xab0 kernel/fork.c:3174
__do_sys_unshare kernel/fork.c:3245 [inline]
__se_sys_unshare kernel/fork.c:3243 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff3287cda67
RSP: 002b:00007ffff61bac18 EFLAGS: 00000206
ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007ff328a45f40 RCX: 00007ff3287cda67
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007ff328a467b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffff61bae58 R15: 0000000000000000
</TASK>
Showing all locks held in the system:
8 locks held by kworker/0:0/9:
3 locks held by kworker/0:1/10:
3 locks held by kworker/1:0/23:
#0:
ffff888103e99948
(
(wq_completion)usb_hub_wq
){+.+.}-{0:0}
, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
#1:
ffffc9000018fd18
(
(work_completion)(&hub->events)
){+.+.}-{0:0}
, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
#2:
ffff88810b362198
(
&dev->mutex
){....}-{4:4}
, at: device_lock include/linux/device.h:895 [inline]
, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
1 lock held by khungtaskd/30:
#0:
ffffffff896e05a0
(rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
5 locks held by kworker/u8:8/1657:
#0:
ffff888101299148
(
(wq_completion)netns
){+.+.}-{0:0}
, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
#1:
ffffc900043afd18
(
net_cleanup_work
){+.+.}-{0:0}
, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
#2:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: cleanup_net+0xb8/0x9e0 net/core/net_namespace.c:675
#3:
ffffffff8aaf8e68
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
#4:
ffffffff896ec1b8
(
rcu_state.exp_mutex
){+.+.}-{4:4}
, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
5 locks held by kworker/0:2/2332:
5 locks held by kworker/0:3/2812:
2 locks held by getty/2916:
#0:
ffff8881163e90a0
(
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1:
ffffc900000432f0
(
&ldata->atomic_read_lock
){+.+.}-{4:4}
, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
4 locks held by udevd/5189:
4 locks held by kworker/0:6/5283:
2 locks held by syz.4.706/7803:
1 lock held by syz.2.708/7794:
1 lock held by syz.1.709/7799:
#0:
ffffffff896ec1b8
(
rcu_state.exp_mutex
){+.+.}-{4:4}
, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.3.710/7802:
2 locks held by syz-executor/7806:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7809:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7822:
#0: ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7826:
#0: ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1: ffffffff8ade4a08
(uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7836:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7855:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7858:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08 (
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7865:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7873:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7880:
#0: ffffffff8aae0830
(pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7907:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7919:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7921:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1: ffffffff8ade4a08
(uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7923:
#0:
ffffffff8aae0830
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08 (
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
2 locks held by syz-executor/7937:
#0:
ffffffff8aae0830 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
#1:
ffffffff8ade4a08
(
uevent_sock_mutex
){+.+.}-{4:4}
, at: uevent_net_init+0x210/0x330 lib/kobject_uevent.c:794
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xd25/0x1050 kernel/hung_task.c:515
kthread+0x370/0x450 kernel/kthread.c:467
ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
yealink 4-1:36.0: unexpected response 0
yealink 4-1:36.0: urb_ctl_callback - urb status -71
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events free_obj_work
RIP: 0010:__sanitizer_cov_trace_switch+0x6/0x90 kernel/kcov.c:327
Code: 89 fe bf 07 00 00 00 e9 f8 fd ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 <41> 55 41 54 49 89 fc 55 48 89 f5 53 48 8b 46 08 48 83 f8 20 74 63
RSP: 0018:ffffc90000007060 EFLAGS: 00000082
RAX: 0000000000000000 RBX: ffffffff878aa301 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff88880ce0 RDI: 0000000000000000
RBP: ffffc90000007160 R08: 0000000000000001 R09: 0000000000000025
R10: 0000000000000025 R11: 00000000002b6be0 R12: 0000000000000000
R13: ffffc90000007368 R14: ffffffff878aa300 R15: 1ffff92000000e1a
FS: 0000000000000000(0000) GS:ffff8882686d3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2df23ffc CR3: 0000000117898000 CR4: 00000000003506f0
Call Trace:
<IRQ>
vsnprintf+0x1fe/0x1240 lib/vsprintf.c:2892
sprintf+0xcc/0x100 lib/vsprintf.c:3111
print_time kernel/printk/printk.c:1359 [inline]
info_print_prefix+0x25a/0x350 kernel/printk/printk.c:1385
record_print_text+0x143/0x3c0 kernel/printk/printk.c:1434
printk_get_next_message+0x2d1/0x6c0 kernel/printk/printk.c:3072
console_emit_next_record kernel/printk/printk.c:3137 [inline]
console_flush_one_record+0x67c/0xe50 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4913
dev_printk_emit+0xd2/0x10d drivers/base/core.c:4924
__dev_printk+0xcb/0x100 drivers/base/core.c:4936
_dev_err+0xef/0x127 drivers/base/core.c:4979
urb_ctl_callback.cold+0x41/0x8c drivers/input/misc/yealink.c:456
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866
handle_softirqs+0x1de/0x9d0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 aa 97 23 fa 48 89 df e8 92 e7 23 fa e8 7d 8c 4e fa fb bf 01 00 00 00 <e8> 32 6f 17 fa 65 8b 05 fb af 89 05 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc9000009fc48 EFLAGS: 00000202
RAX: 00000000001f3c9b RBX: ffff8881f5638500 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8901db96 RDI: 0000000000000001
RBP: ffffffff89b2eb80 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000800010
R13: 0000000000000000 R14: ffffffff8aeff284 R15: 0000000000000001
process_one_work+0x825/0x1920 kernel/workqueue.c:3244
process_scheduled_works kernel/workqueue.c:3358 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3439
kthread+0x370/0x450 kernel/kthread.c:467
ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>