INFO: task syz-executor.0:27163 blocked for more than 143 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:24976 pid:27163 ppid: 6478 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb72/0x1460 kernel/sched/core.c:6287 schedule+0x14b/0x210 kernel/sched/core.c:6366 schedule_timeout+0xac/0x300 kernel/time/timer.c:1857 do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion_timeout+0x46/0x60 kernel/sched/completion.c:157 usb_start_wait_urb+0x160/0x530 drivers/usb/core/message.c:63 do_proc_bulk+0x970/0x1060 drivers/usb/core/devio.c:1236 proc_bulk drivers/usb/core/devio.c:1273 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2547 [inline] usbdev_ioctl+0x36b9/0x6d00 drivers/usb/core/devio.c:2713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fa3427edae9 RSP: 002b:00007fa33fd21188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fa3429010e0 RCX: 00007fa3427edae9 RDX: 0000000020000740 RSI: 00000000c0185502 RDI: 0000000000000003 RBP: 00007fa342847f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcf7b9434f R14: 00007fa33fd21300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8c91c980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 1 lock held by in:imklog/6128: #0: ffff888019def9f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:990 2 locks held by agetty/6122: #0: ffff8880163c8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc900013582e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6c5/0x1c60 drivers/tty/n_tty.c:2113 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc82/0xcd0 kernel/hung_task.c:295 kthread+0x453/0x480 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 32060 Comm: kworker/0:45 Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events nsim_dev_trap_report_work RIP: 0010:debug_lockdep_rcu_enabled+0x29/0x30 kernel/rcu/update.c:280 Code: cc 31 c0 83 3d db 23 e1 03 00 74 1e 83 3d 62 56 e1 03 00 74 15 65 48 8b 0c 25 c0 ef 01 00 31 c0 83 b9 1c 0a 00 00 00 0f 94 c0 cc cc cc cc cc cc 41 56 53 89 fb e8 96 0c 00 00 41 89 c6 83 f8 RSP: 0018:ffffc90004d6f738 EFLAGS: 00000046 RAX: 0000000000000001 RBX: 1ffff920009adee8 RCX: ffff888079339c80 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8ddc0f28 RBP: ffffc90004d6f7c8 R08: dffffc0000000000 R09: fffffbfff1bb81e6 R10: fffffbfff1bb81e6 R11: 0000000000000000 R12: 0000000000000000 R13: 1ffff920009adf0c R14: dffffc0000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faa327b1000 CR3: 000000000c68e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 00000000e0000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: rcu_read_lock_held_common kernel/rcu/update.c:104 [inline] rcu_read_lock_sched_held+0x5f/0x130 kernel/rcu/update.c:123 trace_lock_acquire+0x59/0x190 include/trace/events/lock.h:13 lock_acquire+0xa5/0x4d0 kernel/locking/lockdep.c:5596 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 _extract_crng+0xf8/0x350 drivers/char/random.c:997 extract_crng drivers/char/random.c:1016 [inline] _get_random_bytes+0x1b6/0x230 drivers/char/random.c:1538 eth_random_addr include/linux/etherdevice.h:225 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:672 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:721 [inline] nsim_dev_trap_report_work+0x359/0xb20 drivers/net/netdevsim/dev.c:762 process_one_work+0x853/0x1140 kernel/workqueue.c:2297 worker_thread+0xac1/0x1320 kernel/workqueue.c:2444 kthread+0x453/0x480 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 ---------------- Code disassembly (best guess): 0: cc int3 1: 31 c0 xor %eax,%eax 3: 83 3d db 23 e1 03 00 cmpl $0x0,0x3e123db(%rip) # 0x3e123e5 a: 74 1e je 0x2a c: 83 3d 62 56 e1 03 00 cmpl $0x0,0x3e15662(%rip) # 0x3e15675 13: 74 15 je 0x2a 15: 65 48 8b 0c 25 c0 ef mov %gs:0x1efc0,%rcx 1c: 01 00 1e: 31 c0 xor %eax,%eax 20: 83 b9 1c 0a 00 00 00 cmpl $0x0,0xa1c(%rcx) 27: 0f 94 c0 sete %al * 2a: c3 retq <-- trapping instruction 2b: cc int3 2c: cc int3 2d: cc int3 2e: cc int3 2f: cc int3 30: cc int3 31: 41 56 push %r14 33: 53 push %rbx 34: 89 fb mov %edi,%ebx 36: e8 96 0c 00 00 callq 0xcd1 3b: 41 89 c6 mov %eax,%r14d 3e: 83 .byte 0x83 3f: f8 clc