INFO: task kworker/0:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:20968 pid:9 tgid:9 ppid:2 task_flags:0x4288060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xeb1/0x41f0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061 rwsem_down_write_slowpath+0x530/0x1280 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1c7/0x1f0 kernel/locking/rwsem.c:1591 kernfs_remove fs/kernfs/dir.c:1554 [inline] kernfs_remove+0x2f/0x50 fs/kernfs/dir.c:1545 sysfs_remove_dir+0xc8/0x110 fs/sysfs/dir.c:101 __kobject_del+0xe2/0x220 lib/kobject.c:604 kobject_del lib/kobject.c:627 [inline] kobject_del+0x3f/0x60 lib/kobject.c:619 device_del+0x630/0x9b0 drivers/base/core.c:3898 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1418 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task jbd2/sda1-8:2815 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:jbd2/sda1-8 state:D stack:25576 pid:2815 tgid:2815 ppid:2 task_flags:0x240040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xeb1/0x41f0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 io_schedule+0x8a/0xf0 kernel/sched/core.c:7831 bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250 __wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:105 [inline] __wait_on_buffer+0x64/0x70 fs/buffer.c:124 wait_on_buffer include/linux/buffer_head.h:420 [inline] journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline] jbd2_journal_commit_transaction+0x49a6/0x6900 fs/jbd2/commit.c:881 kjournald2+0x200/0x760 fs/jbd2/journal.c:201 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.2.2033:11334 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2033 state:D stack:29320 pid:11334 tgid:11331 ppid:2968 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xeb1/0x41f0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] class_device_constructor include/linux/device.h:913 [inline] driver_match_device drivers/base/base.h:193 [inline] __driver_attach+0x2a/0x6a0 drivers/base/dd.c:1183 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715 driver_register+0x1e2/0x360 drivers/base/driver.c:249 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1719 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline] raw_ioctl+0x1a85/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1307 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f95edd1c2bb RSP: 002b:00007f95ec76cf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f95edd1c2bb RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 RBP: 00007f95ec76dfd0 R08: 0000000000000001 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00002000000000c0 R14: 0000000000000000 R15: 0000000000000000 Showing all locks held in the system: 5 locks held by kworker/0:0/9: #0: ffff888105ecc148 ( (wq_completion)usb_hub_wq ){+.+.}-{0:0} , at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9000009fd18 ( (work_completion)(&hub->events) ){+.+.}-{0:0} , at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88810bf95198 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888135201198 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336 #4: ffff888101298188 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_remove fs/kernfs/dir.c:1554 [inline] , at: kernfs_remove+0x2f/0x50 fs/kernfs/dir.c:1545 1 lock held by kworker/R-mm_pe/13: 5 locks held by ksoftirqd/1/22: 9 locks held by kworker/1:0/23: 6 locks held by kworker/1:1/28: #0: ffff888105ecc148 ( (wq_completion)usb_hub_wq ){+.+.}-{0:0} , at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc900001e7d18 ( (work_completion)(&hub->events) ){+.+.}-{0:0} , at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88810bfd5198 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88813c771198 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1008 #4: ffff888121882160 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1008 #5: ffff888101298188 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_remove_by_name_ns+0x3d/0xf0 fs/kernfs/dir.c:1717 1 lock held by khungtaskd/30: #0: ffffffff896e05a0 ( rcu_read_lock ){....}-{1:3} , at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] , at: rcu_read_lock include/linux/rcupdate.h:850 [inline] , at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/0:3/1005: #0: ffff88810006b548 ((wq_completion)events ){+.+.}-{0:0} , at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90002d8fd18 ( free_ipc_work ){+.+.}-{0:0} , at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff896ec1b8 ( rcu_state.exp_mutex ){+.+.}-{4:4} , at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311 1 lock held by udevd/2855: #0: ffff888101298188 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0xa5/0x740 fs/kernfs/dir.c:1185 2 locks held by getty/2917: #0: ffff8881165320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000432f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 4 locks held by udevd/5215: #0: ffff8881124db0a0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183 #1: ffff88811a4bcc88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff88813c25b968 (kn->active#27){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88813c25b968 (kn->active#27){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff888104f61198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline] #3: ffff888104f61198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 6 locks held by kworker/1:4/8254: #0: ffff888105ecc148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90006d2fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88810bb75198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810bb75198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888101eea6c8 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:570 [inline] #3: ffff888101eea6c8 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0xb4/0x1660 kernel/sched/core.c:4130 #4: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:647 [inline] #4: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1615 [inline] #4: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1946 [inline] #4: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: ttwu_queue kernel/sched/core.c:3916 [inline] #4: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: try_to_wake_up+0xd90/0x1660 kernel/sched/core.c:4242 #5: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:647 [inline] #5: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1615 [inline] #5: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1946 [inline] #5: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: ttwu_queue kernel/sched/core.c:3916 [inline] #5: ffff8881f5739620 (&rq->__lock){-.-.}-{2:2}, at: try_to_wake_up+0xd90/0x1660 kernel/sched/core.c:4242 4 locks held by kworker/u8:0/9204: #0: ffff888101299148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90013fbfd18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff8aae0730 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x9e0 net/core/net_namespace.c:675 #3: ffffffff896ec1b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 6 locks held by kworker/1:5/11174: #0: ffff888105ecc148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90014017d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88810c365198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810c365198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888104f61198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888104f61198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336 #4: ffff888121887160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888121887160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1106 [inline] #4: ffff888121887160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xaa/0x600 drivers/base/dd.c:1304 #5: ffffffff8a5094c8 (input_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #5: ffffffff8a5094c8 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x184/0x4d0 drivers/input/input.c:2187 1 lock held by syz-executor/11344: #0: ffffffff8aae0730 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 1 lock held by syz-executor/11356: #0: ffffffff8aae0730 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 1 lock held by syz-executor/11368: #0: ffffffff8aae0730 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 1 lock held by syz-executor/11371: #0: ffffffff8aae0730 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 2 locks held by kworker/u8:3/11378: #0: ffff8881000ac948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9001346fd18 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 2 locks held by kworker/1:8/11400: 3 locks held by syz-executor/11419: 2 locks held by modprobe/11421: 3 locks held by modprobe/11425: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xd25/0x1050 kernel/hung_task.c:515 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 11419 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline] RIP: 0010:rcu_is_watching+0x60/0xc0 kernel/rcu/tree.c:752 Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 2b 1a 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 0f b6 14 02 <48> 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b 03 c1 e8 02 RSP: 0018:ffffc900154d71a8 EFLAGS: 00000a02 RAX: dffffc0000000000 RBX: ffff8881f5633928 RCX: 0000000000000002 RDX: 0000000000000000 RSI: ffffffff87afa3a0 RDI: ffffffff891a2be0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000200 R11: 00000000000067ab R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000555583299500(0000) GS:ffff8882686d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faea1f98e9c CR3: 00000001251b8000 CR4: 00000000003506f0 Call Trace: trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x317/0x380 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __set_page_owner+0x8c/0x540 mm/page_owner.c:341 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0xf10/0x39f0 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x273/0x2860 mm/page_alloc.c:5250 __alloc_pages_noprof mm/page_alloc.c:5284 [inline] alloc_pages_bulk_noprof+0x747/0x1240 mm/page_alloc.c:5204 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline] __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline] __kasan_populate_vmalloc+0xf0/0x210 mm/kasan/shadow.c:424 kasan_populate_vmalloc include/linux/kasan.h:580 [inline] alloc_vmap_area+0x95d/0x2bd0 mm/vmalloc.c:2129 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3232 __vmalloc_node_range_noprof+0x213/0x1530 mm/vmalloc.c:4024 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4218 kcov_ioctl+0x4c/0x720 kernel/kcov.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9d3160c2bb Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffee120a560 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000080000 RCX: 00007f9d3160c2bb RDX: 0000000000080000 RSI: ffffffff80086301 RDI: 00000000000000dd RBP: 00007f9d318864e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000003 R14: 00007ffee120a818 R15: 0000000000000000