INFO: task kworker/0:2:4008 blocked for more than 143 seconds.
Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:2 state:D stack:21808 pid: 4008 ppid: 2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xb72/0x1460 kernel/sched/core.c:6253
schedule+0x12b/0x1f0 kernel/sched/core.c:6326
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
__mutex_lock_common+0xd1f/0x2590 kernel/locking/mutex.c:680
__mutex_lock kernel/locking/mutex.c:740 [inline]
mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:792
hub_port_connect+0x51d/0x2910 drivers/usb/core/hub.c:5250
hub_port_connect_change+0x5f9/0xc20 drivers/usb/core/hub.c:5497
port_event+0xb67/0x1220 drivers/usb/core/hub.c:5643
hub_event+0x4ed/0xe40 drivers/usb/core/hub.c:5725
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/26:
#0: ffffffff8cb1db40 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by in:imklog/6218:
#0: ffff88801b238370 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:990
6 locks held by kworker/0:4/8444:
#0: ffff888141bec538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc9000f7a7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
#2: ffff88801e414220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff88801e414220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1b2/0xe40 drivers/usb/core/hub.c:5671
#3: ffff88801e4175c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline]
#3: ffff88801e4175c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect+0x4f4/0x2910 drivers/usb/core/hub.c:5249
#4: ffff88801e39a868 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect+0x51d/0x2910 drivers/usb/core/hub.c:5250
#5: ffffffff8d51ce90 (ehci_cf_port_reset_rwsem){.+.+}-{3:3}, at: hub_port_reset+0x1b5/0x1200 drivers/usb/core/hub.c:2948
5 locks held by kworker/0:12/9265:
#0: ffff888141bec538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc90002adfd20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
#2: ffff888147b17220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff888147b17220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1b2/0xe40 drivers/usb/core/hub.c:5671
#3: ffff88801e9025c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline]
#3: ffff88801e9025c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect+0x4f4/0x2910 drivers/usb/core/hub.c:5249
#4: ffff888147a93e68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect+0x51d/0x2910 drivers/usb/core/hub.c:5250
3 locks held by kworker/u4:12/9566:
5 locks held by kworker/0:2/4008:
#0: ffff888141bec538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc90003f6fd20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
#2: ffff88801e932220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff88801e932220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1b2/0xe40 drivers/usb/core/hub.c:5671
#3: ffff88801e9355c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline]
#3: ffff88801e9355c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect+0x4f4/0x2910 drivers/usb/core/hub.c:5249
#4: ffff888147a93e68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect+0x51d/0x2910 drivers/usb/core/hub.c:5250
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc82/0xcd0 kernel/hung_task.c:295
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8510 Comm: kworker/1:5 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:mark_lock+0x238/0x1e00 kernel/locking/lockdep.c:4624
Code: 00 00 00 4b c7 44 27 0f 00 00 00 00 43 c6 44 27 17 00 4b c7 44 27 1f 00 00 00 00 43 c6 44 27 27 00 65 48 8b 04 25 28 00 00 00 <48> 3b 84 24 a0 01 00 00 0f 85 b5 15 00 00 89 d8 48 8d 65 d8 5b 41
RSP: 0018:ffffc9000fa87320 EFLAGS: 00000002
RAX: 427c6f9c3b102000 RBX: 0000000000000001 RCX: ffffffff81667041
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8ff9afc0
RBP: ffffc9000fa87510 R08: dffffc0000000000 R09: fffffbfff1ff35f9
R10: fffffbfff1ff35f9 R11: 0000000000000000 R12: 1ffff92001f50e70
R13: 0000000000000004 R14: ffffffff8f937290 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feb4c0051b8 CR3: 000000000c88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
mark_held_locks kernel/locking/lockdep.c:4206 [inline]
__trace_hardirqs_on_caller kernel/locking/lockdep.c:4224 [inline]
lockdep_hardirqs_on_prepare+0x26e/0x780 kernel/locking/lockdep.c:4292
trace_hardirqs_on+0x6f/0x80 kernel/trace/trace_preemptirq.c:49
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x8b/0x130 kernel/locking/spinlock.c:194
kfence_guarded_alloc+0x1d7/0xad0 mm/kfence/core.c:372
__kfence_alloc+0x947/0xba0 mm/kfence/core.c:908
kfence_alloc include/linux/kfence.h:126 [inline]
slab_alloc_node mm/slub.c:3152 [inline]
kmem_cache_alloc_node+0x362/0x370 mm/slub.c:3270
__alloc_skb+0xd8/0x5a0 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1126 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:745 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:802 [inline]
nsim_dev_trap_report_work+0x264/0xaf0 drivers/net/netdevsim/dev.c:843
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
</TASK>
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 4b c7 add %cl,-0x39(%rbx)
5: 44 27 rex.R (bad)
7: 0f 00 00 sldt (%rax)
a: 00 00 add %al,(%rax)
c: 43 c6 44 27 17 00 movb $0x0,0x17(%r15,%r12,1)
12: 4b c7 44 27 1f 00 00 movq $0x0,0x1f(%r15,%r12,1)
19: 00 00
1b: 43 c6 44 27 27 00 movb $0x0,0x27(%r15,%r12,1)
21: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
28: 00 00
* 2a: 48 3b 84 24 a0 01 00 cmp 0x1a0(%rsp),%rax <-- trapping instruction
31: 00
32: 0f 85 b5 15 00 00 jne 0x15ed
38: 89 d8 mov %ebx,%eax
3a: 48 8d 65 d8 lea -0x28(%rbp),%rsp
3e: 5b pop %rbx
3f: 41 rex.B