INFO: task kworker/1:9:22838 blocked for more than 143 seconds.
Not tainted 5.15.0-next-20211106-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:9 state:D stack:25872 pid:22838 ppid: 2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:4984 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6265
schedule+0xd2/0x260 kernel/sched/core.c:6338
usb_kill_urb.part.0+0x19a/0x220 drivers/usb/core/urb.c:720
usb_kill_urb+0x7f/0xa0 drivers/usb/core/urb.c:715
usb_start_wait_urb+0x24a/0x4c0 drivers/usb/core/message.c:64
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153
hub_port_init+0x82e/0x2f10 drivers/usb/core/hub.c:4829
hub_port_connect drivers/usb/core/hub.c:5280 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5488 [inline]
port_event drivers/usb/core/hub.c:5634 [inline]
hub_event+0x2190/0x4330 drivers/usb/core/hub.c:5716
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8bb83a60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
1 lock held by in:imklog/6222:
3 locks held by syz-executor.4/6593:
5 locks held by kworker/1:9/22838:
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
#0: ffff8880155b2d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
#1: ffffc900049cfdb0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
#2: ffff888147f30220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff888147f30220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
#3: ffff888147f345c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3086 [inline]
#3: ffff888147f345c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5279 [inline]
#3: ffff888147f345c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5488 [inline]
#3: ffff888147f345c0 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5634 [inline]
#3: ffff888147f345c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x2178/0x4330 drivers/usb/core/hub.c:5716
#4: ffff888147e8a668 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_init+0x1b5/0x2f10 drivers/usb/core/hub.c:4703
1 lock held by syz-executor.3/26882:
#0: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
1 lock held by syz-executor.2/26919:
#0: ffff88806d4349c8 (&client->ioctl_mutex){+.+.}-{3:3}, at: snd_seq_ioctl+0x1da/0x3e0 sound/core/seq/seq_clientmgr.c:2172
2 locks held by syz-executor.0/26932:
#0: ffff88807f1979c8 (&client->ioctl_mutex){+.+.}-{3:3}, at: snd_seq_ioctl+0x1da/0x3e0 sound/core/seq/seq_clientmgr.c:2172
#1: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.0-next-20211106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:254 [inline]
watchdog+0xcb7/0xed0 kernel/hung_task.c:339
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 24821 Comm: kworker/u4:10 Not tainted 5.15.0-next-20211106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:lockdep_recursion_finish kernel/locking/lockdep.c:438 [inline]
RIP: 0010:lock_is_held_type+0xe4/0x140 kernel/locking/lockdep.c:5681
Code: f6 47 22 03 0f 95 c0 45 31 ed 44 39 f0 41 0f 94 c5 48 c7 c7 e0 0b ac 89 e8 a9 0d 00 00 b8 ff ff ff ff 65 0f c1 05 5c ef b2 76 <83> f8 01 75 29 9c 58 f6 c4 02 75 3d 48 f7 04 24 00 02 00 00 74 01
RSP: 0018:ffffc90017cef878 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000005 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffffff8bb839a0 R08: 0000000000000000 R09: ffffffff8d912bd7
R10: fffffbfff1b2257a R11: 000000000000003f R12: ffff8881625b3a80
R13: 0000000000000000 R14: 00000000ffffffff R15: ffff8881625b4588
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555783808 CR3: 000000000b88e000 CR4: 00000000003506f0
Call Trace:
lock_is_held include/linux/lockdep.h:283 [inline]
rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
trace_lock_acquire include/trace/events/lock.h:13 [inline]
lock_acquire+0x442/0x510 kernel/locking/lockdep.c:5608
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:354 [inline]
__get_locked_pte+0x2b6/0x4d0 mm/memory.c:1726
get_locked_pte include/linux/mm.h:2160 [inline]
__text_poke+0x1ae/0x8c0 arch/x86/kernel/alternative.c:1000
text_poke_bp_batch+0x2eb/0x560 arch/x86/kernel/alternative.c:1310
text_poke_flush arch/x86/kernel/alternative.c:1451 [inline]
text_poke_flush arch/x86/kernel/alternative.c:1448 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1458
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
jump_label_update+0x1d5/0x430 kernel/jump_label.c:830
static_key_disable_cpuslocked+0x152/0x1b0 kernel/jump_label.c:207
static_key_disable+0x16/0x20 kernel/jump_label.c:215
toggle_allocation_gate mm/kfence/core.c:746 [inline]
toggle_allocation_gate+0x183/0x390 mm/kfence/core.c:724
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: f6 47 22 03 testb $0x3,0x22(%rdi)
4: 0f 95 c0 setne %al
7: 45 31 ed xor %r13d,%r13d
a: 44 39 f0 cmp %r14d,%eax
d: 41 0f 94 c5 sete %r13b
11: 48 c7 c7 e0 0b ac 89 mov $0xffffffff89ac0be0,%rdi
18: e8 a9 0d 00 00 callq 0xdc6
1d: b8 ff ff ff ff mov $0xffffffff,%eax
22: 65 0f c1 05 5c ef b2 xadd %eax,%gs:0x76b2ef5c(%rip) # 0x76b2ef86
29: 76
* 2a: 83 f8 01 cmp $0x1,%eax <-- trapping instruction
2d: 75 29 jne 0x58
2f: 9c pushfq
30: 58 pop %rax
31: f6 c4 02 test $0x2,%ah
34: 75 3d jne 0x73
36: 48 f7 04 24 00 02 00 testq $0x200,(%rsp)
3d: 00
3e: 74 01 je 0x41