INFO: task syz-executor.4:10699 blocked for more than 143 seconds. Not tainted 5.16.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:28176 pid:10699 ppid: 7113 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4972 [inline] __schedule+0x90d/0x26c0 kernel/sched/core.c:6253 schedule+0xd2/0x260 kernel/sched/core.c:6326 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385 __mutex_lock_common kernel/locking/mutex.c:680 [inline] __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740 sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 usb_open+0x1d5/0x2a0 drivers/usb/core/file.c:48 chrdev_open+0x20f/0x650 fs/char_dev.c:414 do_dentry_open+0x429/0x1040 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x9ea/0x2250 fs/namei.c:3559 do_filp_open+0x199/0x3d0 fs/namei.c:3586 do_sys_openat2+0x11e/0x400 fs/open.c:1212 do_sys_open fs/open.c:1228 [inline] __do_sys_openat fs/open.c:1244 [inline] __se_sys_openat fs/open.c:1239 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4196e4 RSP: 002b:00007fd0f5d64cc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004196e4 RDX: 0000000000000002 RSI: 00007fd0f5d64d60 RDI: 00000000ffffff9c RBP: 00007fd0f5d64d60 R08: 0000000000000000 R09: 000000000000000f R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 R13: 00007ffd84067e3f R14: 00007fd0f5d65300 R15: 0000000000022000 INFO: task syz-executor.1:10708 blocked for more than 143 seconds. Not tainted 5.16.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.1 state:D stack:28520 pid:10708 ppid: 7117 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4972 [inline] __schedule+0x90d/0x26c0 kernel/sched/core.c:6253 schedule+0xd2/0x260 kernel/sched/core.c:6326 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385 __mutex_lock_common kernel/locking/mutex.c:680 [inline] __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740 sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 usb_open+0x1d5/0x2a0 drivers/usb/core/file.c:48 chrdev_open+0x20f/0x650 fs/char_dev.c:414 do_dentry_open+0x429/0x1040 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x9ea/0x2250 fs/namei.c:3559 do_filp_open+0x199/0x3d0 fs/namei.c:3586 do_sys_openat2+0x11e/0x400 fs/open.c:1212 do_sys_open fs/open.c:1228 [inline] __do_sys_openat fs/open.c:1244 [inline] __se_sys_openat fs/open.c:1239 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4196e4 RSP: 002b:00007f29d4232cc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004196e4 RDX: 0000000000000002 RSI: 00007f29d4232d60 RDI: 00000000ffffff9c RBP: 00007f29d4232d60 R08: 0000000000000000 R09: 000000000000000f R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 R13: 00007ffd8bbff94f R14: 00007f29d4233300 R15: 0000000000022000 INFO: task syz-executor.5:10716 blocked for more than 144 seconds. Not tainted 5.16.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:28176 pid:10716 ppid: 7115 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4972 [inline] __schedule+0x90d/0x26c0 kernel/sched/core.c:6253 schedule+0xd2/0x260 kernel/sched/core.c:6326 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385 __mutex_lock_common kernel/locking/mutex.c:680 [inline] __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740 sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 usb_open+0x1d5/0x2a0 drivers/usb/core/file.c:48 chrdev_open+0x20f/0x650 fs/char_dev.c:414 do_dentry_open+0x429/0x1040 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x9ea/0x2250 fs/namei.c:3559 do_filp_open+0x199/0x3d0 fs/namei.c:3586 do_sys_openat2+0x11e/0x400 fs/open.c:1212 do_sys_open fs/open.c:1228 [inline] __do_sys_openat fs/open.c:1244 [inline] __se_sys_openat fs/open.c:1239 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4196e4 RSP: 002b:00007fe26894dcc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004196e4 RDX: 0000000000000002 RSI: 00007fe26894dd60 RDI: 00000000ffffff9c RBP: 00007fe26894dd60 R08: 0000000000000000 R09: 000000000000000f R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 R13: 00007fff7bc435cf R14: 00007fe26894e300 R15: 0000000000022000 INFO: task syz-executor.3:10726 blocked for more than 144 seconds. Not tainted 5.16.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:28176 pid:10726 ppid: 7116 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4972 [inline] __schedule+0x90d/0x26c0 kernel/sched/core.c:6253 schedule+0xd2/0x260 kernel/sched/core.c:6326 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385 __mutex_lock_common kernel/locking/mutex.c:680 [inline] __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740 sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 usb_open+0x1d5/0x2a0 drivers/usb/core/file.c:48 chrdev_open+0x20f/0x650 fs/char_dev.c:414 do_dentry_open+0x429/0x1040 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x9ea/0x2250 fs/namei.c:3559 do_filp_open+0x199/0x3d0 fs/namei.c:3586 do_sys_openat2+0x11e/0x400 fs/open.c:1212 do_sys_open fs/open.c:1228 [inline] __do_sys_openat fs/open.c:1244 [inline] __se_sys_openat fs/open.c:1239 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4196e4 RSP: 002b:00007f573082ecc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004196e4 RDX: 0000000000000002 RSI: 00007f573082ed60 RDI: 00000000ffffff9c RBP: 00007f573082ed60 R08: 0000000000000000 R09: 000000000000000f R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 R13: 00007fff2a834aaf R14: 00007f573082f300 R15: 0000000000022000 Showing all locks held in the system: 6 locks held by kworker/1:1/25: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc90000dffdb8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff888147c6c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147c6c220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff888018ace220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff888018ace220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88801e4a01a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88801e4a01a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 1 lock held by khungtaskd/27: #0: ffffffff8ad78740 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458 6 locks held by kworker/0:2/921: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc90004967db8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff888147bf4220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147bf4220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff8881415d9220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff8881415d9220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88807a8eb1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88807a8eb1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 6 locks held by kworker/0:3/3012: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc90001b2fdb8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff88801c0d4220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff88801c0d4220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff88801ae2c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88801ae2c220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88805f8381a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88805f8381a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 1 lock held by in:imklog/6289: #0: ffff888071dff270 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x9c/0xb0 fs/file.c:990 6 locks held by kworker/0:4/6944: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc90002fbfdb8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff888147c2c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147c2c220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff8880704bc220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff8880704bc220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88801b9ba1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88801b9ba1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 6 locks held by kworker/1:5/9041: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc9000c437db8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff888147c44220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147c44220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff888076b21220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff888076b21220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88801cfe71a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88801cfe71a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 6 locks held by kworker/0:6/9052: #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010fb4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a4/0x1450 kernel/workqueue.c:2269 #1: ffffc9000c477db8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d1/0x1450 kernel/workqueue.c:2273 #2: ffff888147c5c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147c5c220 (&dev->mutex){....}-{3:3}, at: hub_event+0x127/0x36c0 drivers/usb/core/hub.c:5662 #3: ffff888077c2b220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff888077c2b220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #4: ffff88805d1141a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88805d1141a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x74/0x410 drivers/base/dd.c:944 #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline] #5: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x12e/0x700 drivers/usb/core/file.c:156 2 locks held by syz-executor.0/10690: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 #1: ffff88805ff860d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 2 locks held by syz-executor.4/10699: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 #1: ffff88805ff860d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 2 locks held by syz-executor.1/10708: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 #1: ffff88805ff860d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 2 locks held by syz-executor.5/10716: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 #1: ffff88805ff860d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 2 locks held by syz-executor.3/10726: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 #1: ffff88805ff860d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xa0/0x3e0 drivers/usb/misc/sisusbvga/sisusb.c:2396 1 lock held by syz-executor.2/11158: #0: ffffffff8bbdbdf0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x1f/0x2a0 drivers/usb/core/file.c:39 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x11a/0x160 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0x88c/0xbf0 kernel/hung_task.c:295 kthread+0x3ab/0x480 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 2993 Comm: systemd-journal Not tainted 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline] RIP: 0010:rcu_read_lock_sched_notrace include/linux/rcupdate.h:788 [inline] RIP: 0010:trace_lock_release include/trace/events/lock.h:58 [inline] RIP: 0010:lock_release+0x50f/0x720 kernel/locking/lockdep.c:5648 Code: e9 03 83 c0 03 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 da 01 00 00 44 8b 05 77 43 4e 0b 45 85 c0 0f 85 a5 fe ff ff e9 4b ea f2 06 <65> ff 05 1a ad ae 7e 48 8b 05 f3 df 39 0b e8 0e 01 05 00 85 c0 74 RSP: 0018:ffffc900023ffdb0 EFLAGS: 00000047 RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff8153be71 RDX: fffffbfff1943a43 RSI: 0000000000000008 RDI: ffffffff8ca1d210 RBP: 1ffff9200047ffb8 R08: 0000000000000000 R09: ffffffff8ca1d217 R10: fffffbfff1943a42 R11: 0000000000000001 R12: ffffffff8ad78740 R13: 0000000000000002 R14: ffff88807e19f3f8 R15: 0000000000000000 FS: 00007f0fb2f488c0(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0fb040d000 CR3: 000000001ce0f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: cgroup_account_cputime_field include/linux/cgroup.h:807 [inline] task_group_account_field+0x3e/0x290 kernel/sched/cputime.c:110 account_system_index_time+0xec/0x120 kernel/sched/cputime.c:173 vtime_account_system+0x63/0xb0 kernel/sched/cputime.c:668 vtime_user_enter+0xaa/0x170 kernel/sched/cputime.c:710 __context_tracking_enter+0x93/0xa0 kernel/context_tracking.c:82 user_enter_irqoff include/linux/context_tracking.h:41 [inline] __exit_to_user_mode kernel/entry/common.c:130 [inline] syscall_exit_to_user_mode+0x48/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0fb22039c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007fffef10f838 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: 0000000000000000 RBX: 00007fffef112750 RCX: 00007f0fb22039c7 RDX: 00007f0fb2c74a00 RSI: 0000000000000000 RDI: 000055e3d6c279a3 RBP: 00007fffef10f870 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fffef112750 R15: 00007fffef10fd60 ---------------- Code disassembly (best guess): 0: e9 03 83 c0 03 jmpq 0x3c08308 5: 0f b6 14 11 movzbl (%rcx,%rdx,1),%edx 9: 38 d0 cmp %dl,%al b: 7c 08 jl 0x15 d: 84 d2 test %dl,%dl f: 0f 85 da 01 00 00 jne 0x1ef 15: 44 8b 05 77 43 4e 0b mov 0xb4e4377(%rip),%r8d # 0xb4e4393 1c: 45 85 c0 test %r8d,%r8d 1f: 0f 85 a5 fe ff ff jne 0xfffffeca 25: e9 4b ea f2 06 jmpq 0x6f2ea75 * 2a: 65 ff 05 1a ad ae 7e incl %gs:0x7eaead1a(%rip) # 0x7eaead4b <-- trapping instruction 31: 48 8b 05 f3 df 39 0b mov 0xb39dff3(%rip),%rax # 0xb39e02b 38: e8 0e 01 05 00 callq 0x5014b 3d: 85 c0 test %eax,%eax 3f: 74 .byte 0x74