syzbot


INFO: task hung in p54u_load_firmware_cb

Status: auto-closed as invalid on 2019/10/25 14:21
Subsystems: kernel
[Documentation on labels]
First crash: 1837d, last: 1740d

Sample crash report:
INFO: task kworker/0:2:107 blocked for more than 143 seconds.
      Not tainted 5.2.0-rc6+ #15
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:2     D24760   107      2 0x80004000
Workqueue: events request_firmware_work_func
Call Trace:
 schedule+0x96/0x240 /kernel/sched/core.c:3509
 schedule_preempt_disabled+0xc/0x20 /kernel/sched/core.c:3568
 __mutex_lock_common /kernel/locking/mutex.c:1003 [inline]
 __mutex_lock+0x7fb/0x12b0 /kernel/locking/mutex.c:1073
 device_lock /./include/linux/device.h:1208 [inline]
 p54u_load_firmware_cb.cold+0xfb/0x13d /drivers/net/wireless/intersil/p54/p54usb.c:938
 request_firmware_work_func+0x126/0x242 /drivers/base/firmware_loader/main.c:785
 process_one_work+0x905/0x1570 /kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 /kernel/workqueue.c:2415
 kthread+0x30b/0x410 /kernel/kthread.c:255
 ret_from_fork+0x24/0x30 /arch/x86/entry/entry_64.S:352

Showing all locks held in the system:
6 locks held by kworker/0:0/5:
6 locks held by kworker/1:0/17:
1 lock held by khungtaskd/23:
 #0: 00000000212bf897 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x269 /kernel/locking/lockdep.c:5147
3 locks held by kworker/0:2/107:
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: __write_once_size /./include/linux/compiler.h:221 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: arch_atomic64_set /./arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: atomic64_set /./include/asm-generic/atomic-instrumented.h:855 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: atomic_long_set /./include/asm-generic/atomic-long.h:40 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: set_work_data /kernel/workqueue.c:620 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: set_work_pool_and_clear_pending /kernel/workqueue.c:647 [inline]
 #0: 0000000057e1f54c ((wq_completion)events){+.+.}, at: process_one_work+0x81a/0x1570 /kernel/workqueue.c:2240
 #1: 00000000e5d8c21c ((work_completion)(&fw_work->work)){+.+.}, at: process_one_work+0x84e/0x1570 /kernel/workqueue.c:2244
 #2: 00000000207e13eb (&dev->mutex){....}, at: device_lock /./include/linux/device.h:1208 [inline]
 #2: 00000000207e13eb (&dev->mutex){....}, at: p54u_load_firmware_cb.cold+0xfb/0x13d /drivers/net/wireless/intersil/p54/p54usb.c:938
1 lock held by rsyslogd/1635:
2 locks held by getty/1725:
 #0: 000000002cf07416 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 00000000e9cccaeb (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1726:
 #0: 0000000079462f59 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 000000002cfb17d3 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1727:
 #0: 00000000e3b57042 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 00000000663bdda8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1728:
 #0: 000000007a224f98 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 00000000bef50de0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1729:
 #0: 00000000a9888ba1 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 0000000069600a37 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1730:
 #0: 00000000cd867f6a (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 00000000733b4b1b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
2 locks held by getty/1731:
 #0: 000000000994860d (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 /drivers/tty/tty_ldisc.c:272
 #1: 0000000024e6109c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1a50 /drivers/tty/n_tty.c:2156
6 locks held by kworker/1:2/2037:
3 locks held by kworker/1:4/2783:
3 locks held by kworker/0:5/2797:
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: __write_once_size /./include/linux/compiler.h:221 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: arch_atomic64_set /./arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: atomic64_set /./include/asm-generic/atomic-instrumented.h:855 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: atomic_long_set /./include/asm-generic/atomic-long.h:40 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_data /kernel/workqueue.c:620 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_pool_and_clear_pending /kernel/workqueue.c:647 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: process_one_work+0x81a/0x1570 /kernel/workqueue.c:2240
 #1: 00000000b9ae72e5 ((work_completion)(&hub->events)){+.+.}, at: process_one_work+0x84e/0x1570 /kernel/workqueue.c:2244
 #2: 00000000d6c4a065 (&dev->mutex){....}, at: device_lock /./include/linux/device.h:1208 [inline]
 #2: 00000000d6c4a065 (&dev->mutex){....}, at: hub_event+0x179/0x3550 /drivers/usb/core/hub.c:5387
3 locks held by kworker/0:6/2808:
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: __write_once_size /./include/linux/compiler.h:221 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: arch_atomic64_set /./arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: atomic64_set /./include/asm-generic/atomic-instrumented.h:855 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: atomic_long_set /./include/asm-generic/atomic-long.h:40 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_data /kernel/workqueue.c:620 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_pool_and_clear_pending /kernel/workqueue.c:647 [inline]
 #0: 000000008ed2fa77 ((wq_completion)usb_hub_wq){+.+.}, at: process_one_work+0x81a/0x1570 /kernel/workqueue.c:2240
 #1: 000000008962915f ((work_completion)(&hub->events)){+.+.}, at: process_one_work+0x84e/0x1570 /kernel/workqueue.c:2244
 #2: 000000008a879a5a (&dev->mutex){....}, at: device_lock /./include/linux/device.h:1208 [inline]
 #2: 000000008a879a5a (&dev->mutex){....}, at: hub_event+0x179/0x3550 /drivers/usb/core/hub.c:5387

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 5.2.0-rc6+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e /lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x48/0x87 /lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1a6/0x1bd /lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace /./include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks /kernel/hung_task.c:205 [inline]
 watchdog+0x989/0xe20 /kernel/hung_task.c:289
 kthread+0x30b/0x410 /kernel/kthread.c:255
 ret_from_fork+0x24/0x30 /arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2808 Comm: kworker/0:6 Not tainted 5.2.0-rc6+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:get_current /./arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:console_lock_spinning_enable /kernel/printk/printk.c:1640 [inline]
RIP: 0010:console_unlock+0xeb/0xbf0 /kernel/printk/printk.c:2460
Code: 42 0f b6 04 38 84 c0 74 08 3c 01 0f 8e 6a 0a 00 00 0f b7 6b 40 bf 14 00 00 00 83 e5 14 89 ee e8 eb 4d 15 00 66 83 fd 14 75 9e <65> 48 8b 04 25 80 ee 01 00 48 89 44 24 40 e8 82 4c 15 00 9c 8f 44
RSP: 0018:ffff8881aea276c8 EFLAGS: 00000202
RAX: 0000000000000002 RBX: 0000000000000001 RCX: ffffffff81278e9f
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff8881aea27798 R08: ffff8881c566e000 R09: 0000000000000001
R10: ffff8881c566e8b0 R11: ffff8881c566e000 R12: 000000000000004d
R13: ffff8881d9e63000 R14: 0000000000000246 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f71e74cf000 CR3: 00000001d4fc9000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 vprintk_emit+0x171/0x3e0 /kernel/printk/printk.c:1986
 dev_vprintk_emit+0x4fc/0x541 /drivers/base/core.c:3190
 dev_printk_emit+0xba/0xf1 /drivers/base/core.c:3201
 __dev_printk+0x1db/0x203 /drivers/base/core.c:3213
 _dev_info+0xd7/0x109 /drivers/base/core.c:3259
 announce_device /drivers/usb/core/hub.c:2257 [inline]
 usb_new_device.cold+0x2f7/0xe61 /drivers/usb/core/hub.c:2516
 hub_port_connect /drivers/usb/core/hub.c:5098 [inline]
 hub_port_connect_change /drivers/usb/core/hub.c:5213 [inline]
 port_event /drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x1abd/0x3550 /drivers/usb/core/hub.c:5441
 process_one_work+0x905/0x1570 /kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 /kernel/workqueue.c:2415
 kthread+0x30b/0x410 /kernel/kthread.c:255
 ret_from_fork+0x24/0x30 /arch/x86/entry/entry_64.S:352

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/22 00:26 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config console log report ci2-upstream-usb
2019/06/25 09:27 https://github.com/google/kasan.git usb-fuzzer 9939f56ee6c0 82c13b6b .config console log report ci2-upstream-usb
2019/06/19 08:12 https://github.com/google/kasan.git usb-fuzzer 9939f56ee6c0 34bf9440 .config console log report ci2-upstream-usb
2019/06/09 13:30 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 0159583c .config console log report ci2-upstream-usb
2019/06/02 15:30 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 02:51 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/05/19 04:04 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce 5a4461b0 .config console log report ci2-upstream-usb
2019/05/07 23:24 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce a7383bfa .config console log report ci2-upstream-usb
2019/04/16 17:27 https://github.com/google/kasan.git usb-fuzzer 9a33b36996cb 505ab413 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.