INFO: task syz.8.1703:12999 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.1703 state:D stack:23784 pid:12999 tgid:12988 ppid:11058 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0x1585/0x5340 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
device_lock include/linux/device.h:895 [inline]
usbdev_open+0x182/0x770 drivers/usb/core/devio.c:1054
chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
do_dentry_open+0x785/0x14e0 fs/open.c:949
vfs_open+0x3b/0x340 fs/open.c:1081
do_open fs/namei.c:4671 [inline]
path_openat+0x2e08/0x3860 fs/namei.c:4830
do_file_open+0x23e/0x4a0 fs/namei.c:4859
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fae60f5c84e
RSP: 002b:00007fae5ed90b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fae5ed916c0 RCX: 00007fae60f5c84e
RDX: 0000000000101301 RSI: 00007fae5ed90c00 RDI: ffffffffffffff9c
RBP: 00007fae5ed90c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fae61216308 R14: 00007fae61216270 R15: 00007fae6133fa48
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e7603e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e7603e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e7603e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:2/1209:
2 locks held by dhcpcd/5486:
#0: ffff88803105d6f0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 net/netlink/af_netlink.c:2404
#1: ffffffff8fbc9d08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8fbc9d08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 net/core/rtnetlink.c:6826
2 locks held by getty/5583:
#0: ffff888036ecd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:7/5939:
#0: ffff888020696548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
#0: ffff888020696548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
#1: ffffc90004317c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#1: ffffc90004317c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
#2: ffff888029ec0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff888029ec0198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
#3: ffff888029252198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888029252198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
#4: ffff888022a8a160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888022a8a160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
#5: ffffffff8e5fd770 (umhelper_sem){++++}-{4:4}, at: usermodehelper_read_trylock+0xfc/0x2c0 kernel/umh.c:214
4 locks held by udevd/6587:
#0: ffff888034227790 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 fs/seq_file.c:183
#1: ffff888078488088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172
#2: ffff88805bab7b48 (kn->active#29){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88805bab7b48 (kn->active#29){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173
#3: ffff888029252198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
#3: ffff888029252198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
8 locks held by kworker/0:2/11326:
#0: ffff888020696548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
#0: ffff888020696548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
#1: ffffc900044efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#1: ffffc900044efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
#2: ffff88802a5b6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802a5b6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
#3: ffff8880341b2198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff8880341b2198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 drivers/usb/core/hub.c:2336
#4: ffff8880288af160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff8880288af160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1106 [inline]
#4: ffff8880288af160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x860 drivers/base/dd.c:1304
#5: ffffffff8fbc9d08 (rtnl_mutex){+.+.}-{4:4}, at: ieee802154_unregister_hw+0x5a/0xe0 net/mac802154/main.c:280
#6: ffff888065964788 (&local->iflist_mtx#2){+.+.}-{4:4}, at: ieee802154_remove_interfaces+0x33/0x1d0 net/mac802154/iface.c:702
#7: ffffffff8e766678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#7: ffffffff8e766678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
3 locks held by kworker/0:4/11689:
#0: ffff88813fe0f548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
#0: ffff88813fe0f548 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
#1: ffffc9000444fc40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#1: ffffc9000444fc40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
#2: ffffffff8fbc9d08 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
1 lock held by syz.8.1703/12999:
#0: ffff88802a596198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a596198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x182/0x770 drivers/usb/core/devio.c:1054
4 locks held by udevd/14918:
#0: ffff8880540789e0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 fs/seq_file.c:183
#1: ffff8880576d3888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172
#2: ffff88804fdca5a8 (kn->active#29){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88804fdca5a8 (kn->active#29){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173
#3: ffff8880341b2198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
#3: ffff8880341b2198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
2 locks held by syz.1.2268/15223:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfd9/0x1030 kernel/hung_task.c:515
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:_static_cpu_has arch/x86/include/asm/cpufeature.h:101 [inline]
RIP: 0010:build_cr3 arch/x86/mm/tlb.c:165 [inline]
RIP: 0010:load_new_mm_cr3+0xa5/0x1d0 arch/x86/mm/tlb.c:572
Code: 89 e0 c1 e8 06 49 8d 3c c7 48 81 c7 d6 ab 1c 93 be 08 00 00 00 e8 5b 32 b7 00 4d 0f ab a7 d6 ab 1c 93 4c 89 f7 e8 6b eb ff ff fb 00 00 00 0f b7 cb 81 f9 ff 07 00 00 0f 83 94 00 00 00 f7 c3
RSP: 0018:ffffc900001276e8 EFLAGS: 00000093
RAX: 000000013fe2c000 RBX: 0000000000000000 RCX: ffff88801daedac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88813fe394ff R09: 1ffff11027fc729f
R10: dffffc0000000000 R11: ffffed1027fc72a0 R12: 000000000005c18d
R13: dffffc0000000000 R14: ffff88813fe2c000 R15: 0000000000010000
FS: 0000000000000000(0000) GS:ffff88812556f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd1ad8a9990 CR3: 000000000e54c000 CR4: 00000000003526f0
Call Trace:
switch_mm_irqs_off+0x45c/0x690 arch/x86/mm/tlb.c:951
use_temporary_mm+0x98/0x140 arch/x86/mm/tlb.c:1029
__text_poke+0x632/0x9a0 arch/x86/kernel/alternative.c:2581
text_poke arch/x86/kernel/alternative.c:2645 [inline]
smp_text_poke_batch_finish+0x923/0x1160 arch/x86/kernel/alternative.c:2978
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210
static_key_enable+0x1a/0x20 kernel/jump_label.c:223
toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:899
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245