INFO: task kworker/0:2:4403 blocked for more than 143 seconds. Not tainted 5.6.0-rc5-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:2 D24096 4403 2 0x80004000 Workqueue: usb_hub_wq hub_event Call Trace: schedule+0xcd/0x2b0 kernel/sched/core.c:4154 schedule_timeout+0x682/0xb20 kernel/time/timer.c:1871 do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x26f/0x3c0 kernel/sched/completion.c:136 kthread_stop+0x17a/0x780 kernel/kthread.c:559 hwrng_unregister+0x24f/0x330 drivers/char/hw_random/core.c:556 chaoskey_disconnect+0x216/0x290 drivers/usb/misc/chaoskey.c:232 usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:436 __device_release_driver drivers/base/dd.c:1137 [inline] device_release_driver_internal+0x42f/0x500 drivers/base/dd.c:1168 bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:533 device_del+0x481/0xd30 drivers/base/core.c:2677 usb_disable_device+0x23d/0x790 drivers/usb/core/message.c:1237 usb_disconnect+0x293/0x900 drivers/usb/core/hub.c:2211 hub_port_connect drivers/usb/core/hub.c:5046 [inline] hub_port_connect_change drivers/usb/core/hub.c:5335 [inline] port_event drivers/usb/core/hub.c:5481 [inline] hub_event+0x1a1d/0x4300 drivers/usb/core/hub.c:5563 process_one_work+0x94b/0x1620 kernel/workqueue.c:2264 worker_thread+0x96/0xe20 kernel/workqueue.c:2410 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Showing all locks held in the system: 1 lock held by khungtaskd/23: #0: ffffffff87109060 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x264 kernel/locking/lockdep.c:5331 1 lock held by rsyslogd/1669: #0: ffff8881d00e1260 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xe3/0x100 fs/file.c:821 2 locks held by getty/1760: #0: ffff8881cef00090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc900008472e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by getty/1761: #0: ffff8881cea60090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc900008632e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by getty/1762: #0: ffff8881cef06090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc9000084f2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by getty/1763: #0: ffff8881cea81090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc900008672e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by getty/1764: #0: ffff8881cea80090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc9000085f2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by getty/1765: #0: ffff8881cf390090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc900008372e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 5 locks held by kworker/0:2/4403: #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: __write_once_size include/linux/compiler.h:226 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: process_one_work+0x82a/0x1620 kernel/workqueue.c:2235 #1: ffff8881cdbffdd0 ((work_completion)(&hub->events)){+.+.}, at: process_one_work+0x85e/0x1620 kernel/workqueue.c:2239 #2: ffff8881d4937200 (&dev->mutex){....}, at: device_lock include/linux/device.h:771 [inline] #2: ffff8881d4937200 (&dev->mutex){....}, at: hub_event+0x1be/0x4300 drivers/usb/core/hub.c:5509 #3: ffff8881d13ad200 (&dev->mutex){....}, at: device_lock include/linux/device.h:771 [inline] #3: ffff8881d13ad200 (&dev->mutex){....}, at: usb_disconnect+0x91/0x900 drivers/usb/core/hub.c:2202 #4: ffff8881ad294190 (&dev->mutex){....}, at: device_release_driver_internal+0x23/0x500 drivers/base/dd.c:1165 3 locks held by kworker/1:5/4527: #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: __write_once_size include/linux/compiler.h:226 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: process_one_work+0x82a/0x1620 kernel/workqueue.c:2235 #1: ffff8881c3a87dd0 ((work_completion)(&hcd->wakeup_work)){+.+.}, at: process_one_work+0x85e/0x1620 kernel/workqueue.c:2239 #2: ffff8881d48d1200 (&dev->mutex){....}, at: device_lock include/linux/device.h:771 [inline] #2: ffff8881d48d1200 (&dev->mutex){....}, at: usb_remote_wakeup+0x1f/0xe0 drivers/usb/core/hub.c:3612 3 locks held by kworker/0:5/4693: #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: __write_once_size include/linux/compiler.h:226 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8881d8861928 ((wq_completion)usb_hub_wq){+.+.}, at: process_one_work+0x82a/0x1620 kernel/workqueue.c:2235 #1: ffff8881d9627dd0 ((work_completion)(&hub->events)){+.+.}, at: process_one_work+0x85e/0x1620 kernel/workqueue.c:2239 #2: ffff8881d4985200 (&dev->mutex){....}, at: device_lock include/linux/device.h:771 [inline] #2: ffff8881d4985200 (&dev->mutex){....}, at: hub_event+0x1be/0x4300 drivers/usb/core/hub.c:5509 2 locks held by kworker/1:8/9713: #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: __write_once_size include/linux/compiler.h:226 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8881da2fc528 ((wq_completion)pm){+.+.}, at: process_one_work+0x82a/0x1620 kernel/workqueue.c:2235 #1: ffff8881d299fdd0 ((work_completion)(&dev->power.work)){+.+.}, at: process_one_work+0x85e/0x1620 kernel/workqueue.c:2239 2 locks held by getty/9770: #0: ffff8881ad296090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc90011e7c2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x21d/0x1b30 drivers/tty/n_tty.c:2156 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 23 Comm: khungtaskd Not tainted 5.6.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xef/0x16e lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1db/0x207 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xa99/0xfd0 kernel/hung_task.c:289 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 12646 Comm: udevd Not tainted 5.6.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mark_held_locks+0x0/0xe0 kernel/locking/lockdep.c:3347 Code: ff ff 48 c7 c7 34 17 e6 87 e8 0c 2b 42 00 e9 5a f6 ff ff e8 12 2b 42 00 e9 63 f5 ff ff e8 f8 2a 42 00 e9 ec f5 ff ff 0f 1f 00 <48> b8 00 00 00 00 00 fc ff df 41 56 41 55 41 54 49 89 fc 48 81 c7 RSP: 0018:ffff8881d6dcf8a0 EFLAGS: 00000002 RAX: 0000000000000001 RBX: ffff8881c7eb6200 RCX: 0000000000000002 RDX: 1ffff11038fd6d47 RSI: 0000000000000006 RDI: ffff8881c7eb6200 RBP: ffffffff858f50d9 R08: ffff8881c7eb6200 R09: fffffbfff1266e91 R10: fffffbfff1266e90 R11: ffffffff89337487 R12: ffff8881cb7b5000 R13: ffffffff897b4368 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fda8b568db8 CR3: 00000001cf175000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __trace_hardirqs_on_caller kernel/locking/lockdep.c:3388 [inline] lockdep_hardirqs_on+0x382/0x580 kernel/locking/lockdep.c:3433 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 __debug_check_no_obj_freed lib/debugobjects.c:977 [inline] debug_check_no_obj_freed+0x20f/0x445 lib/debugobjects.c:998 slab_free_hook mm/slub.c:1441 [inline] slab_free_freelist_hook mm/slub.c:1477 [inline] slab_free mm/slub.c:3024 [inline] kmem_cache_free+0x183/0x360 mm/slub.c:3040 anon_vma_chain_free mm/rmap.c:135 [inline] unlink_anon_vmas+0x29c/0x830 mm/rmap.c:421 free_pgtables+0x1ab/0x2f0 mm/memory.c:413 exit_mmap+0x287/0x4d0 mm/mmap.c:3127 __mmput kernel/fork.c:1082 [inline] mmput+0xce/0x3d0 kernel/fork.c:1103 exec_mmap fs/exec.c:1051 [inline] flush_old_exec+0x89c/0x1e90 fs/exec.c:1284 load_elf_binary+0x851/0x4900 fs/binfmt_elf.c:848 search_binary_handler fs/exec.c:1662 [inline] search_binary_handler+0x16b/0x580 fs/exec.c:1639 exec_binprm fs/exec.c:1705 [inline] __do_execve_file.isra.0+0x1331/0x2290 fs/exec.c:1825 do_execveat_common fs/exec.c:1871 [inline] do_execve fs/exec.c:1888 [inline] __do_sys_execve fs/exec.c:1964 [inline] __se_sys_execve fs/exec.c:1959 [inline] __x64_sys_execve+0x8a/0xb0 fs/exec.c:1959 do_syscall_64+0xb6/0x5a0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f056f893207 Code: Bad RIP value. RSP: 002b:00007ffcd50bdd48 EFLAGS: 00000206 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f056f893207 RDX: 0000000000a09680 RSI: 00007ffcd50bde40 RDI: 00007ffcd50bee50 RBP: 0000000000625500 R08: 0000000000002646 R09: 0000000000002646 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000a09680 R13: 0000000000000008 R14: 00000000009e7250 R15: 0000000000000007