INFO: task syz.0.2696:15758 blocked for more than 143 seconds.
Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.2696 state:D stack:26760 pid:15758 tgid:15757 ppid:13932 task_flags:0x400040 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5367 [inline]
__schedule+0x1129/0x5c00 kernel/sched/core.c:6748
__schedule_loop kernel/sched/core.c:6825 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6840
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6897
__mutex_lock_common kernel/locking/mutex.c:664 [inline]
__mutex_lock+0x6ae/0xb00 kernel/locking/mutex.c:732
device_lock include/linux/device.h:1030 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3845 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4004
do_filp_open+0x20b/0x470 fs/namei.c:4031
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6532f8bad0
RSP: 002b:00007f6533eaeb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f6532f8bad0
RDX: 0000000000000002 RSI: 00007f6533eaec10 RDI: 00000000ffffff9c
RBP: 00007f6533eaec10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f65331a5fa0 R15: 00007ffe84979678
Showing all locks held in the system:
3 locks held by kworker/u8:0/12:
6 locks held by kworker/1:0/24:
1 lock held by khungtaskd/31:
#0: ffffffff8e3be0c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3be0c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e3be0c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6761
3 locks held by acpid/5181:
#0: ffff8880375f8118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_open_device drivers/input/evdev.c:384 [inline]
#0: ffff8880375f8118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_open+0x2e7/0x690 drivers/input/evdev.c:478
#1: ffff8880375fb2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:203 [inline]
#1: ffff8880375fb2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_open_device+0x5c/0x390 drivers/input/input.c:582
#2: ffffffff8e3c95f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:336
2 locks held by getty/5589:
#0: ffff8880347d00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfa1/0x1450 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:4/5869:
#0: ffff8880222a5d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc90003237d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffff888144f32190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
#2: ffff888144f32190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 drivers/usb/core/hub.c:5861
#3: ffff88804df5a190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
#3: ffff88804df5a190 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x920 drivers/usb/core/hub.c:2307
#4: ffff8880375fa160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
#4: ffff8880375fa160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff8880375fa160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x620 drivers/base/dd.c:1293
#5: ffff8880375fb2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:201 [inline]
#5: ffff8880375fb2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_disconnect_device drivers/input/input.c:702 [inline]
#5: ffff8880375fb2c0 (&dev->mutex#2){+.+.}-{4:4}, at: __input_unregister_device+0x24/0x470 drivers/input/input.c:2219
1 lock held by syz.0.2696/15758:
#0: ffff888029541190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
#0: ffff888029541190 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.2.2848/16342:
#0: ffff888029541190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
#0: ffff888029541190 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
6 locks held by kworker/1:7/16760:
3 locks held by syz.4.3356/17945:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
watchdog+0xf70/0x12c0 kernel/hung_task.c:399
kthread+0x3a4/0x760 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:217 [inline]
RIP: 0010:unwind_next_frame+0x1c8/0x1ff0 arch/x86/kernel/unwind_orc.c:494
Code: 89 c3 39 d0 0f 83 cd 14 00 00 48 ba 00 00 00 00 00 fc ff df 89 c1 48 8d 3c 8d 00 bf cf 91 49 89 f8 49 c1 e8 03 45 0f b6 04 10 <48> 89 fa 83 e2 07 83 c2 03 44 38 c2 7c 2f 45 84 c0 74 2a 48 89 4c
RSP: 0018:ffffc90000a08578 EFLAGS: 00000a03
RAX: 0000000000093481 RBX: 0000000000000002 RCX: 0000000000093481
RDX: dffffc0000000000 RSI: 00000000000a614e RDI: ffffffff91f49104
RBP: ffffc90000a08630 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc90000a085e8 R11: 0000000000093481 R12: ffffc90000a08638
R13: ffffc90000a085e8 R14: ffffc90000a0861d R15: ffffffff8a3481d8
FS: 0000000000000000(0000) GS:ffff888124b54000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d515ff8 CR3: 000000002ad32000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4318 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4330
kmalloc_noprof include/linux/slab.h:906 [inline]
switchdev_deferred_enqueue+0x2b/0x2a0 net/switchdev/switchdev.c:117
switchdev_port_obj_del_defer net/switchdev/switchdev.c:407 [inline]
switchdev_port_obj_del+0xfb/0x180 net/switchdev/switchdev.c:424
br_switchdev_mdb_notify+0x173/0x3b0 net/bridge/br_switchdev.c:667
br_mdb_notify+0x69/0x6b0 net/bridge/br_mdb.c:529
br_multicast_del_pg+0x227/0xc20 net/bridge/br_multicast.c:817
br_multicast_find_del_pg+0x12d/0x180 net/bridge/br_multicast.c:850
br_multicast_port_group_expired+0x430/0x560 net/bridge/br_multicast.c:880
call_timer_fn+0x197/0x620 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2414
__run_timer_base kernel/time/timer.c:2426 [inline]
__run_timer_base kernel/time/timer.c:2418 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2435
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2445
handle_softirqs+0x216/0x8e0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3209
Code: 00 e8 a2 0a 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 40 51 20 00 48 85 db 0f 85 55 01 00 00 e8 d2 55 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 17 e6 83
RSP: 0018:ffffc900001e6868 EFLAGS: 00000246
RAX: ffffffff8f0abfb8 RBX: 0000000000000000 RCX: ffffc9001a9c4000
RDX: 0000000000100000 RSI: ffffffff819aa06e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8f0abfb8
R13: ffffffff8f0abf60 R14: ffffc900001e68f8 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3267 [inline]
console_unlock+0xd8/0x210 kernel/printk/printk.c:3307
vprintk_emit+0x422/0x6f0 kernel/printk/printk.c:2432
dev_vprintk_emit drivers/base/core.c:4891 [inline]
dev_printk_emit+0xfa/0x140 drivers/base/core.c:4902
__netdev_printk+0x1fb/0x500 net/core/dev.c:12299
netdev_err+0xe4/0x120 net/core/dev.c:12351
asix_set_sw_mii drivers/net/usb/asix_common.c:78 [inline]
asix_check_host_enable+0x18f/0x240 drivers/net/usb/asix_common.c:98
__asix_mdio_read+0x9c/0x260 drivers/net/usb/asix_common.c:506
asix_phy_reset+0x106/0x1f0 drivers/net/usb/asix_devices.c:215
ax88172_bind+0x41f/0x5d0 drivers/net/usb/asix_devices.c:275
usbnet_probe+0xab8/0x2770 drivers/net/usb/usbnet.c:1761
usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3666
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3666
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
hub_port_connect drivers/usb/core/hub.c:5533 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5673 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5915
process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c1/0xef0 kernel/workqueue.c:3400
kthread+0x3a4/0x760 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245