INFO: task kworker/1:2:119 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2 state:D stack:21128 pid:119 tgid:119 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0x1585/0x5310 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
hub_port_connect drivers/usb/core/hub.c:5465 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x21a2/0x4f30 drivers/usb/core/hub.c:5953
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
3 locks held by kworker/0:1/10:
#0: ffff888021aea948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
#1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
#2: ffff88802aedc198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802aedc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
1 lock held by khungtaskd/30:
#0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
5 locks held by kworker/1:2/119:
#0: ffff888021aea948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
#1: ffffc90002dc7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
#2: ffff88802bf1b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802bf1b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
#3: ffff88802bf18518 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3252 [inline]
#3: ffff88802bf18518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5464 [inline]
#3: ffff88802bf18518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#3: ffff88802bf18518 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#3: ffff88802bf18518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 drivers/usb/core/hub.c:5953
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5465 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 drivers/usb/core/hub.c:5953
2 locks held by getty/5579:
#0: ffff888032d680a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000362b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
4 locks held by udevd/7139:
#0: ffff88805d5448b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 fs/seq_file.c:183
#1: ffff888088aa1c88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172
#2: ffff88805aaea3c8 (kn->active#29){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88805aaea3c8 (kn->active#29){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173
#3: ffff88803af4f198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
#3: ffff88803af4f198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
1 lock held by udevd/8644:
#0: ffff8880272ac358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 block/bdev.c:961
5 locks held by kworker/1:7/17948:
#0: ffff888021aea948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
#1: ffffc9000e21fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
#2: ffff88802bf2d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802bf2d198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
#3: ffff88802bf4a518 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3252 [inline]
#3: ffff88802bf4a518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5464 [inline]
#3: ffff88802bf4a518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#3: ffff88802bf4a518 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#3: ffff88802bf4a518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 drivers/usb/core/hub.c:5953
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5465 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#4: ffff88802bdea468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 drivers/usb/core/hub.c:5953
3 locks held by kworker/0:3/2030:
#0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
#1: ffffc9000f0dfc40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
#2: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
5 locks held by kworker/1:3/18478:
#0: ffff888021aea948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
#1: ffffc900042ffc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
#2: ffff88802af68198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802af68198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
#3: ffff88803af4f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88803af4f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
#4: ffff88803af4e160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88803af4e160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
2 locks held by kworker/u8:9/19541:
2 locks held by syz.7.6811/20171:
#0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline]
#0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436
#1: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#1: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
1 lock held by syz.4.6815/20201:
#0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bc/0x1e30 drivers/net/tun.c:3078
1 lock held by syz.4.6815/20202:
#0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x32b/0x1b30 net/ipv4/devinet.c:1120
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
watchdog+0x103d/0x1090 kernel/hung_task.c:516
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:match_held_lock+0x78/0xb0 kernel/locking/lockdep.c:5337
Code: 00 00 48 c7 c2 10 84 e9 93 48 29 d0 48 c1 f8 03 48 ba 29 5c 8f c2 f5 28 5c 8f 48 0f af d0 bb 01 00 00 00 48 39 ca 74 02 31 db <89> d8 5b 41 5e c3 cc cc cc cc cc 90 e8 17 ec fa f8 85 c0 74 1c 83
RSP: 0018:ffffc900001d75b8 EFLAGS: 00000046
RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000080000100
RDX: ffffc900001d7701 RSI: ffffffff8e960320 RDI: ffff88801dec8b40
RBP: ffff88801dec8b40 R08: ffffc900001d7830 R09: 0000000000000000
R10: ffffc900001d7758 R11: fffff5200003aeed R12: 0000000000000001
R13: 0000000000000001 R14: ffffffff8e960320 R15: ffff88801dec8000
FS: 0000000000000000(0000) GS:ffff888125115000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555a5b94e8 CR3: 000000007d3e6000 CR4: 00000000003526f0
Call Trace:
find_held_lock kernel/locking/lockdep.c:5350 [inline]
__lock_release kernel/locking/lockdep.c:5535 [inline]
lock_release+0x10c/0x3d0 kernel/locking/lockdep.c:5889
rcu_lock_release include/linux/rcupdate.h:322 [inline]
rcu_read_unlock include/linux/rcupdate.h:881 [inline]
class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0x1aaa/0x23c0 arch/x86/kernel/unwind_orc.c:695
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2667 [inline]
__rcu_free_sheaf_prepare+0x129/0x290 mm/slub.c:2897
rcu_free_sheaf+0x31/0x200 mm/slub.c:5725
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1067
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 c7 c2 10 84 e9 93 mov $0xffffffff93e98410,%rdx
9: 48 29 d0 sub %rdx,%rax
c: 48 c1 f8 03 sar $0x3,%rax
10: 48 ba 29 5c 8f c2 f5 movabs $0x8f5c28f5c28f5c29,%rdx
17: 28 5c 8f
1a: 48 0f af d0 imul %rax,%rdx
1e: bb 01 00 00 00 mov $0x1,%ebx
23: 48 39 ca cmp %rcx,%rdx
26: 74 02 je 0x2a
28: 31 db xor %ebx,%ebx
* 2a: 89 d8 mov %ebx,%eax <-- trapping instruction
2c: 5b pop %rbx
2d: 41 5e pop %r14
2f: c3 ret
30: cc int3
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: 90 nop
36: e8 17 ec fa f8 call 0xf8faec52
3b: 85 c0 test %eax,%eax
3d: 74 1c je 0x5b
3f: 83 .byte 0x83