INFO: task kworker/1:17:17057 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:17 state:D stack:27288 pid:17057 ppid: 2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 usb_kill_urb.part.0+0x19a/0x220 drivers/usb/core/urb.c:720 usb_kill_urb+0x7f/0xa0 drivers/usb/core/urb.c:715 usb_start_wait_urb+0x24a/0x4c0 drivers/usb/core/message.c:64 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153 hub_port_init+0x82e/0x2f10 drivers/usb/core/hub.c:4829 hub_port_connect drivers/usb/core/hub.c:5280 [inline] hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] port_event drivers/usb/core/hub.c:5634 [inline] hub_event+0x2190/0x4330 drivers/usb/core/hub.c:5716 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Showing all locks held in the system: 3 locks held by kworker/u4:0/8: 1 lock held by khungtaskd/27: #0: ffffffff8b983a20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6461 1 lock held by in:imklog/6150: 2 locks held by rs:main Q:Reg/6151: #0: ffff8880720599f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 #1: ffff88814b4ae460 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x12d/0x250 fs/read_write.c:643 5 locks held by kworker/1:17/17057: #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff8880121c1538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269 #1: ffffc9000d3b7db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273 #2: ffff888147bfd220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147bfd220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662 #3: ffff88801d5205c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline] #3: ffff88801d5205c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5279 [inline] #3: ffff88801d5205c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] #3: ffff88801d5205c0 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5634 [inline] #3: ffff88801d5205c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x2178/0x4330 drivers/usb/core/hub.c:5716 #4: ffff888147b8e268 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_init+0x1b5/0x2f10 drivers/usb/core/hub.c:4703 1 lock held by syz-executor.3/16503: 1 lock held by syz-executor.2/16524: 3 locks held by syz-executor.1/16564: 2 locks held by syz-executor.4/16549: #0: ffffffff8d0e3d50 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2f5/0x760 net/core/net_namespace.c:466 #1: ffffffff8d0f74a8 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x6fa/0xa80 net/core/dev.c:10629 2 locks held by syz-executor.4/16552: #0: ffffffff8d0e3d50 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2f5/0x760 net/core/net_namespace.c:466 #1: ffffffff8d0f74a8 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x6fa/0xa80 net/core/dev.c:10629 1 lock held by syz-executor.5/16685: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 16524 Comm: syz-executor.2 Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:110 Code: c7 00 18 f3 8e e8 78 34 8b 00 eb b0 66 0f 1f 44 00 00 be 01 00 00 00 e9 96 0c 2e 00 cc cc cc cc cc cc 89 ff 89 b7 00 c0 5f ff 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb 48 RSP: 0018:ffffc90000dc0c00 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffffffff8b34fa80 RCX: 0000000000000020 RDX: 1ffffffff1669f52 RSI: 000000000000003e RDI: 0000000000000380 RBP: ffff8880b9d27300 R08: 000000000000003f R09: 0000000000000000 R10: ffffffff816a59e7 R11: 0000000000000000 R12: 000000000000003e R13: 0000000000000020 R14: 0000000000000002 R15: ffff8880b9d2a400 FS: 00007fd97db78700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7c495f0030 CR3: 00000001cf631000 CR4: 0000000000350ee0 Call Trace: apic_write arch/x86/include/asm/apic.h:394 [inline] lapic_next_event+0x4d/0x80 arch/x86/kernel/apic/apic.c:469 clockevents_program_event+0x254/0x370 kernel/time/clockevents.c:334 tick_program_event+0xac/0x140 kernel/time/tick-oneshot.c:44 hrtimer_interrupt+0x36e/0x790 kernel/time/hrtimer.c:1824 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202 Code: 0f 1f 44 00 00 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5e f6 20 f8 48 89 ef e8 a6 6c 21 f8 e8 f1 1b 42 f8 fb bf 01 00 00 00 d6 36 14 f8 65 8b 05 4f 8e c6 76 85 c0 74 02 5d c3 0f 1f 44 00 RSP: 0018:ffffc90000dc0e08 EFLAGS: 00000202 RAX: 000000000003a5a8 RBX: ffffffff873d3c80 RCX: 1ffffffff1fa9386 RDX: 0000000000000000 RSI: 0000000000000101 RDI: 0000000000000001 RBP: ffff8880b9d28280 R08: 0000000000000001 R09: ffffffff8fd43a0f R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90000dc0e98 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8880b9d28280 expire_timers kernel/time/timer.c:1465 [inline] __run_timers.part.0+0x665/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5608 Code: 99 a5 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24 RSP: 0018:ffffc90011ab77c0 EFLAGS: 00000206 RAX: dffffc0000000000 RBX: 1ffff92002356efa RCX: f4d672f5b9097ca7 RDX: 1ffff1103a1d114b RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fd43a07 R10: fffffbfff1fa8740 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: ffffffff8b983a20 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:268 [inline] rcu_read_lock include/linux/rcupdate.h:688 [inline] inet_twsk_purge+0x117/0x7d0 net/ipv4/inet_timewait_sock.c:268 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171 setup_net+0x639/0xa30 net/core/net_namespace.c:349 copy_net_ns+0x318/0x760 net/core/net_namespace.c:470 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178 copy_process+0x2da7/0x75a0 kernel/fork.c:2194 kernel_clone+0xe7/0xab0 kernel/fork.c:2581 __do_sys_clone+0xc8/0x110 kernel/fork.c:2698 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd980623ae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd97db78188 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007fd980737020 RCX: 00007fd980623ae9 RDX: 00000000200000c0 RSI: 0000000000000000 RDI: 000000004020f202 RBP: 00007fd98067df25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd15e77e3f R14: 00007fd97db78300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: c7 00 18 f3 8e e8 movl $0xe88ef318,(%rax) 6: 78 34 js 0x3c 8: 8b 00 mov (%rax),%eax a: eb b0 jmp 0xffffffbc c: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 12: be 01 00 00 00 mov $0x1,%esi 17: e9 96 0c 2e 00 jmpq 0x2e0cb2 1c: cc int3 1d: cc int3 1e: cc int3 1f: cc int3 20: cc int3 21: cc int3 22: 89 ff mov %edi,%edi 24: 89 b7 00 c0 5f ff mov %esi,-0xa04000(%rdi) * 2a: c3 retq <-- trapping instruction 2b: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 32: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 39: fc ff df 3c: 53 push %rbx 3d: 89 fb mov %edi,%ebx 3f: 48 rex.W