INFO: task kworker/0:6:5885 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:6 state:D stack:21304 pid:5885 ppid:2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x2cb/0x5b0 kernel/sched/completion.c:148
i2c_del_adapter+0x615/0x760 drivers/i2c/i2c-core-base.c:1811
pvr2_i2c_core_done+0x58/0xb0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:652
pvr2_hdw_disconnect+0x9f/0x500 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2711
pvr2_context_disconnect+0x42/0x210 drivers/media/usb/pvrusb2/pvrusb2-context.c:269
pvr_disconnect+0x78/0xe0 drivers/media/usb/pvrusb2/pvrusb2-main.c:79
usb_unbind_interface+0x1f2/0x870 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:569 [inline]
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x4cb/0x7a0 drivers/base/dd.c:1295
bus_remove_device+0x342/0x400 drivers/base/bus.c:576
device_del+0x522/0x910 drivers/base/core.c:3872
usb_disable_device+0x3e9/0x8a0 drivers/usb/core/message.c:1474
usb_disconnect+0x34c/0x8a0 drivers/usb/core/hub.c:2315
hub_port_connect drivers/usb/core/hub.c:5369 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5669 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x1d0f/0x49f0 drivers/usb/core/hub.c:5915
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2730
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
INFO: task syz.1.3024:20611 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.3024 state:D stack:27560 pid:20611 ppid:17627 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747
sync_bdevs+0x1af/0x330 block/bdev.c:1076
ksys_sync+0xc6/0x170 fs/sync.c:105
__ia32_sys_sync+0xe/0x20 fs/sync.c:113
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd0c7f9c819
RSP: 002b:00007fd0c8e17028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fd0c8216180 RCX: 00007fd0c7f9c819
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fd0c8216180 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd0c8216218 R14: 00007fd0c8216180 R15: 00007ffe6f0bdc28
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by getty/5530:
#0: ffff888031b520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x433/0x1390 drivers/tty/n_tty.c:2217
6 locks held by kworker/0:6/5885:
#0: ffff888147a7d938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888147a7d938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90004affd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90004affd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffff88802544a190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#2: ffff88802544a190 (&dev->mutex){....}-{3:3}, at: hub_event+0x180/0x49f0 drivers/usb/core/hub.c:5861
#3: ffff88823bd14190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#3: ffff88823bd14190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x10b/0x8a0 drivers/usb/core/hub.c:2306
#4: ffff8880501bc160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#4: ffff8880501bc160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff8880501bc160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xb6/0x7a0 drivers/base/dd.c:1292
#5: ffff88805e0e0188 (&hdw->big_lock_mutex){+.+.}-{3:3}, at: pvr2_hdw_disconnect+0x6d/0x500 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2710
2 locks held by kworker/1:11/5912:
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90004c6fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90004c6fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
1 lock held by udevd/10974:
#0: ffff88807a7884c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x121/0x600 block/bdev.c:805
1 lock held by syz-executor/16452:
#0: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#0: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by syz.1.3024/20611:
#0: ffff88807a7884c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1af/0x330 block/bdev.c:1076
1 lock held by syz.2.3186/21412:
#0: ffff88807a7884c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1af/0x330 block/bdev.c:1076
1 lock held by syz.5.3336/22155:
#0: ffffffff8d137980 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:4089
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf3d/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 22155 Comm: syz.5.3336 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:preempt_count_sub+0x5/0x160 kernel/sched/core.c:5868
Code: 6e ff ff ff 48 c7 c7 b0 4a 8b 8e e8 05 d1 82 00 89 df e9 5b ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 55 <53> 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 80 c4 2c 97 48 c1 e8 03
RSP: 0018:ffffc90004c9f188 EFLAGS: 00000282
RAX: 0000000080000002 RBX: ffff8880b8f41ec0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffea0000dc08c0 R08: ffff8880b8f41ec3 R09: 1ffff110171e83d8
R10: dffffc0000000000 R11: ffffed10171e83d9 R12: dffffc0000000000
R13: ffffc90004c9f368 R14: 0000000000000000 R15: ffffc90004c9f37c
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555951c44e8 CR3: 0000000055e01000 CR4: 00000000003506e0
Call Trace:
rmqueue_pcplist mm/page_alloc.c:2794 [inline]
rmqueue mm/page_alloc.c:2830 [inline]
get_page_from_freelist+0x6b2/0x19e0 mm/page_alloc.c:3217
__alloc_pages+0x1f0/0x460 mm/page_alloc.c:4500
__get_free_pages+0xc/0x30 mm/page_alloc.c:4547
tlb_next_batch mm/mmu_gather.c:36 [inline]
__tlb_remove_page_size+0x283/0x490 mm/mmu_gather.c:137
__tlb_remove_page include/asm-generic/tlb.h:487 [inline]
zap_pte_range mm/memory.c:1458 [inline]
zap_pmd_range mm/memory.c:1571 [inline]
zap_pud_range mm/memory.c:1600 [inline]
zap_p4d_range mm/memory.c:1621 [inline]
unmap_page_range+0x162a/0x3000 mm/memory.c:1642
unmap_vmas+0x286/0x3f0 mm/memory.c:1732
exit_mmap+0x238/0xb90 mm/mmap.c:3302
__mmput+0x118/0x3c0 kernel/fork.c:1356
exit_mm+0x1f2/0x2c0 kernel/exit.c:569
do_exit+0x8dd/0x2460 kernel/exit.c:870
do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
get_signal+0x12fc/0x13f0 kernel/signal.c:2902
arch_do_signal_or_restart+0xc2/0x800 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1f30d9c819
Code: Unable to access opcode bytes at 0x7f1f30d9c7ef.
RSP: 002b:00007f1f31bae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 00007f1f31016090 RCX: 00007f1f30d9c819
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007
RBP: 00007f1f30e32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1f31016128 R14: 00007f1f31016090 R15: 00007ffe16ebe198