syzbot

INFO: task systemd-shutdow:1 blocked for more than 143 seconds.
      Not tainted 5.10.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:systemd-shutdow state:D stack:23976 pid:    1 ppid:     0 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:3774 [inline]
 __schedule+0x92c/0xcb0 kernel/sched/core.c:4523
 schedule+0x14b/0x200 kernel/sched/core.c:4601
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4660
 __mutex_lock_common+0x122f/0x2f20 kernel/locking/mutex.c:1033
 __mutex_lock kernel/locking/mutex.c:1103 [inline]
 mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118
 device_lock include/linux/device.h:731 [inline]
 device_shutdown+0x216/0x68c drivers/base/core.c:4038
 kernel_restart_prepare kernel/reboot.c:76 [inline]
 kernel_restart kernel/reboot.c:246 [inline]
 __do_sys_reboot kernel/reboot.c:347 [inline]
 __se_sys_reboot+0x2a5/0x4a0 kernel/reboot.c:310
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f39e9c058c6
Code: Unable to access opcode bytes at RIP 0x7f39e9c0589c.
RSP: 002b:00007ffe45b0fae8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a9
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f39e9c058c6
RDX: 0000000001234567 RSI: 0000000028121969 RDI: fffffffffee1dead
RBP: 00007ffe45b0fb78 R08: 0000000000002800 R09: 0000000000000005
R10: 0000000000000002 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000563954d11150 R15: 00007ffe45b0fe68
INFO: task kworker/0:4:9666 blocked for more than 143 seconds.
      Not tainted 5.10.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:27296 pid: 9666 ppid:     2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
 context_switch kernel/sched/core.c:3774 [inline]
 __schedule+0x92c/0xcb0 kernel/sched/core.c:4523
 schedule+0x14b/0x200 kernel/sched/core.c:4601
 usb_kill_urb+0x165/0x260 drivers/usb/core/urb.c:711
 usb_start_wait_urb+0x1d3/0x470 drivers/usb/core/message.c:64
 usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
 usb_control_msg+0x23b/0x420 drivers/usb/core/message.c:153
 hub_port_init+0xa43/0x2ca0 drivers/usb/core/hub.c:4707
 hub_port_connect+0xb4d/0x2540 drivers/usb/core/hub.c:5154
 hub_port_connect_change+0x600/0xb00 drivers/usb/core/hub.c:5362
 port_event+0xae9/0x10a0 drivers/usb/core/hub.c:5508
 hub_event+0x417/0xcb0 drivers/usb/core/hub.c:5590
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2272
 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2418
 kthread+0x36b/0x390 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Showing all locks held in the system:
2 locks held by systemd-shutdow/1:
 #0: ffffffff8bba25a8 (system_transition_mutex){+.+.}-{3:3}, at: __do_sys_reboot kernel/reboot.c:344 [inline]
 #0: ffffffff8bba25a8 (system_transition_mutex){+.+.}-{3:3}, at: __se_sys_reboot+0x177/0x4a0 kernel/reboot.c:310
 #1: ffff88814482a218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:731 [inline]
 #1: ffff88814482a218 (&dev->mutex){....}-{3:3}, at: device_shutdown+0x216/0x68c drivers/base/core.c:4038
5 locks held by kworker/u4:7/290:
1 lock held by khungtaskd/1646:
 #0: ffffffff8bce68c0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 arch/x86/pci/mmconfig_64.c:151
5 locks held by kworker/0:4/9666:
 #0: ffff8880151cb938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x6f4/0xfc0 kernel/workqueue.c:2245
 #1: ffffc900161a7d80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x733/0xfc0 kernel/workqueue.c:2247
 #2: ffff88814482a218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:731 [inline]
 #2: ffff88814482a218 (&dev->mutex){....}-{3:3}, at: hub_event+0x112/0xcb0 drivers/usb/core/hub.c:5536
 #3: ffff88814482e588 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3029 [inline]
 #3: ffff88814482e588 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect+0xb35/0x2540 drivers/usb/core/hub.c:5153
 #4: ffff88801c878268 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_init+0x1ee/0x2ca0 drivers/usb/core/hub.c:4581

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1646 Comm: khungtaskd Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x137/0x1be lib/dump_stack.c:118
 nmi_cpu_backtrace+0x16c/0x190 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x191/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
 watchdog+0xcb0/0xcf0 kernel/hung_task.c:294
 kthread+0x36b/0x390 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 290 Comm: kworker/u4:7 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_connect_worker
RIP: 0010:__lock_acquire+0xd72/0x6210 kernel/locking/lockdep.c:4803
Code: 00 00 fc ff df 48 0f a3 1d 6b 1f 91 0d 0f 83 a9 19 00 00 49 8d 9c 24 00 09 00 00 48 89 d8 48 c1 e8 03 48 89 84 24 c0 00 00 00 <42> 80 3c 00 00 74 12 48 89 df e8 bf 28 5e 00 49 b8 00 00 00 00 00
RSP: 0018:ffffc90001c7f830 EFLAGS: 00000802
RAX: 1ffff110023d8120 RBX: ffff888011ec0900 RCX: ffffffff8158f383
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8eea1380
RBP: ffffc90001c7f9d8 R08: dffffc0000000000 R09: fffffbfff1dd4271
R10: fffffbfff1dd4271 R11: 0000000000000000 R12: ffff888011ec0000
R13: ffff888011ec09d0 R14: ffff888011ec09b0 R15: ffff888011ec09d0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4f819c160 CR3: 000000000ba8e000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 lock_acquire+0x114/0x5e0 kernel/locking/lockdep.c:5435
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:359 [inline]
 inet_csk_find_open_port net/ipv4/inet_connection_sock.c:229 [inline]
 inet_csk_get_port+0x666/0xd90 net/ipv4/inet_connection_sock.c:367
 __inet_bind+0x52a/0xb30 net/ipv4/af_inet.c:528
 rds_tcp_conn_path_connect+0x446/0x9c0 net/rds/tcp_connect.c:144
 rds_connect_worker+0x1c3/0x270 net/rds/threads.c:176
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2272
 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2418
 kthread+0x36b/0x390 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296