INFO: task udevd:4670 blocked for more than 143 seconds. Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:21632 pid:4670 tgid:4670 ppid:1 flags:0x00000002 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x17ae/0x4a10 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608 kobject_synth_uevent+0x4ef/0xae0 lib/kobject_uevent.c:207 uevent_store+0x24/0x60 drivers/base/core.c:2763 kernfs_fop_write_iter+0x3a1/0x500 fs/kernfs/file.c:334 new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff202d16bf2 RSP: 002b:00007ffef6367088 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00005613df8af730 RCX: 00007ff202d16bf2 RDX: 0000000000000007 RSI: 00005613df8cc930 RDI: 000000000000000c RBP: 0000000000000007 R08: 00005613df8cc930 R09: 0000000000010000 R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000007 R13: 00005613df8cc930 R14: 00007ffef6367468 R15: 0000000000000000 INFO: task udevd:5231 blocked for more than 144 seconds. Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:20464 pid:5231 tgid:5231 ppid:4670 flags:0x00000002 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x17ae/0x4a10 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 device_lock include/linux/device.h:1009 [inline] uevent_show+0x17d/0x340 drivers/base/core.c:2743 dev_attr_show+0x55/0xc0 drivers/base/core.c:2437 sysfs_kf_seq_show+0x331/0x4c0 fs/sysfs/file.c:59 seq_read_iter+0x445/0xd60 fs/seq_file.c:230 new_sync_read fs/read_write.c:395 [inline] vfs_read+0x9bd/0xbc0 fs/read_write.c:476 ksys_read+0x1a0/0x2c0 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff202d16b6a RSP: 002b:00007ffef635e598 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00005613df8af730 RCX: 00007ff202d16b6a RDX: 0000000000001000 RSI: 00005613df8cc930 RDI: 0000000000000008 RBP: 00005613df8af730 R08: 0000000000000008 R09: 0000000000000020 R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000003fff R14: 00007ffef635ea78 R15: 000000000000000a INFO: task syz.0.935:8477 blocked for more than 145 seconds. Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.935 state:D stack:24736 pid:8477 tgid:8475 ppid:5980 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x17ae/0x4a10 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608 driver_register+0x2d6/0x320 drivers/base/driver.c:254 usb_gadget_register_driver_owner+0xdd/0x230 drivers/usb/gadget/udc/core.c:1701 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:595 [inline] raw_ioctl+0x13a5/0x3cd0 drivers/usb/gadget/legacy/raw_gadget.c:1306 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feb6b7775fb RSP: 002b:00007feb6c538f20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007feb6b7775fb RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 RBP: 00007feb6c539ff0 R08: 0000000000000010 R09: 00302e6364755f79 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007feb6c538fc0 R14: 0000000020000380 R15: 00007feb6ba30b88 INFO: task syz.4.950:8528 blocked for more than 145 seconds. Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.950 state:D stack:25632 pid:8528 tgid:8527 ppid:5222 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x17ae/0x4a10 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608 gadget_bind_driver+0x5ce/0x9f0 drivers/usb/gadget/udc/core.c:1630 really_probe+0x2b8/0xad0 drivers/base/dd.c:657 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:799 driver_probe_device+0x50/0x430 drivers/base/dd.c:829 __driver_attach+0x45f/0x710 drivers/base/dd.c:1215 bus_for_each_dev+0x239/0x2b0 drivers/base/bus.c:368 bus_add_driver+0x346/0x670 drivers/base/bus.c:673 driver_register+0x23a/0x320 drivers/base/driver.c:246 usb_gadget_register_driver_owner+0xdd/0x230 drivers/usb/gadget/udc/core.c:1701 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:595 [inline] raw_ioctl+0x13a5/0x3cd0 drivers/usb/gadget/legacy/raw_gadget.c:1306 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f35b27775fb RSP: 002b:00007f35b34b1f20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f35b27775fb RDX: 0000000000000000 RSI: 0000000000005501 RDI: 000000000000000b RBP: 00007f35b34b2ff0 R08: 0000000000000010 R09: 00342e6364755f79 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f35b34b1fc0 R14: 0000000020000680 R15: 00007f35b2a30320 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e7382a0 ( rcu_read_lock ){....}-{1:2} , at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] , at: rcu_read_lock include/linux/rcupdate.h:838 [inline] , at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6620 5 locks held by kworker/u8:9/2975: 4 locks held by udevd/4670: #0: ffff888030782420 ( sb_writers #8 ){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2876 [inline] ){.+.+}-{0:0}, at: vfs_write+0x227/0xc90 fs/read_write.c:586 #1: ffff888066997888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1eb/0x500 fs/kernfs/file.c:325 #2: ffff88801a355b48 (kn->active#5){++++}-{0:0}, at: kernfs_fop_write_iter+0x20f/0x500 fs/kernfs/file.c:326 #3: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #3: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by getty/4968: #0: ffff88802b5ed0a0 ( &tty->ldisc_sem ){++++}-{0:0} , at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900031232f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/5216: #0: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 5 locks held by kworker/u9:5/5227: #0: ffff888060ac6148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888060ac6148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900037dfd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900037dfd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888028e00d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327 #3: ffff888028e00078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5512 #4: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #4: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 4 locks held by udevd/5231: #0: ffff888079ce18b8 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb7/0xd60 fs/seq_file.c:182 #1: ffff888079fd8488 (&of->mutex#2){+.+.}-{3:3} , at: kernfs_seq_start+0x53/0x3b0 fs/kernfs/file.c:154 #2: ffff88802e9a8698 ( kn->active #5 ){++++}-{0:0}, at: kernfs_seq_start+0x72/0x3b0 fs/kernfs/file.c:155 #3: ffff888029020190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] (&dev->mutex){....}-{3:3}, at: uevent_show+0x17d/0x340 drivers/base/core.c:2743 6 locks held by kworker/1:3/5267: 6 locks held by kworker/1:5/5271: 1 lock held by syz.0.935/8477: #0: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz.2.941/8500: #0: ffff888024348d78 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 6 locks held by syz.1.944/8512: 2 locks held by syz.4.950/8528: #0: ffff888024350d78 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] (&dev->mutex){....}-{3:3}, at: __driver_attach+0x454/0x710 drivers/base/dd.c:1214 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz.3.962/8559: #0: ffff88802c869868 ( &ep->mtx ){+.+.}-{3:3} , at: epoll_mutex_lock fs/eventpoll.c:2249 [inline] , at: do_epoll_ctl+0x43e/0xf70 fs/eventpoll.c:2329 #1: ffffffff8fdd3e08 ( uevent_sock_mutex ){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8563: #0: ffff88805361b918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8565: #0: ffff88807d297118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8567: #0: ffff888021a75918 ( &data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 ( uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8569: #0: ffff88806c345118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8571: #0: ffff88804ca66118 (&data->open_mutex){+.+.}-{3:3} , at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 ( uevent_sock_mutex ){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8573: #0: ffff88802e5bc118 ( &data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8576: #0: ffff888061121918 ( &data->open_mutex ){+.+.}-{3:3} , at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8580: #0: ffff88807e21d918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8583: #0: ffff88802ecdb118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8585: #0: ffff88801f8ed918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8589: #0: ffff8880298e5118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8591: #0: ffff888011ae3118 ( &data->open_mutex ){+.+.}-{3:3} , at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 ( uevent_sock_mutex ){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8593: #0: ffff88806938d118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8595: #0: ffff88806be4e118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor/8597: #0: ffff888023f24918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:471 #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8fdd3e08 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 8512 Comm: syz.1.944 Not tainted 6.11.0-rc2-syzkaller-00004-gb446a2dae984 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:406 Code: c0 92 5d fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 41 a6 c1 fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c RSP: 0018:ffffc90000a18238 EFLAGS: 00000006 RAX: 1ffffffff2a02705 RBX: ffffffff95013d00 RCX: 0000000000000000 RDX: 00000000000003f9 RSI: 0000000000000000 RDI: 0000000000000020 RBP: 0000000000000000 R08: ffffffff8535e386 R09: fffff52000143028 R10: dffffc0000000000 R11: ffffffff8535e340 R12: dffffc0000000000 R13: ffffffff8ef1ef00 R14: 00000000000003f9 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2c51bff8 CR3: 000000000e534000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: serial_port_in include/linux/serial_core.h:674 [inline] serial8250_console_write+0x2c2/0x1770 drivers/tty/serial/8250/8250_port.c:3357 console_emit_next_record kernel/printk/printk.c:2983 [inline] console_flush_all+0x865/0xfd0 kernel/printk/printk.c:3049 console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3118 vprintk_emit+0x5a6/0x770 kernel/printk/printk.c:2348 _printk+0xd5/0x120 kernel/printk/printk.c:2373 int_irq+0x1bd/0x250 drivers/media/usb/gspca/gspca.c:104 __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650 dummy_timer+0x830/0x45a0 drivers/usb/gadget/udc/dummy_hcd.c:1987 __run_hrtimer kernel/time/hrtimer.c:1689 [inline] __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1753 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1815 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 0010:write_comp_data kernel/kcov.c:236 [inline] RIP: 0010:__sanitizer_cov_trace_switch+0xa4/0x120 kernel/kcov.c:341 Code: 8b 00 00 00 4c 8b 4c 24 20 65 4c 8b 1c 25 00 d7 03 00 31 d2 eb 08 48 ff c2 49 39 d2 74 71 4c 8b 74 d6 10 65 8b 05 94 5a 70 7e 00 01 ff 00 74 11 a9 00 01 00 00 74 de 41 83 bb 1c 16 00 00 00 RSP: 0018:ffffc900095ff3d8 EFLAGS: 00000206 RAX: 0000000080000001 RBX: 0000000000000000 RCX: ffff8880280e8000 RDX: 0000000000000002 RSI: ffffffff8e5a3d60 RDI: 0000000000000004 RBP: 0000000000000004 R08: 0000000000000005 R09: ffffffff81411f0e R10: 0000000000000008 R11: ffff8880280e8000 R12: ffffffff90062984 R13: dffffc0000000000 R14: 0000000000000004 R15: 1ffff920012bfea8 unwind_next_frame+0x7be/0x2a00 arch/x86/kernel/unwind_orc.c:515 __unwind_start+0x641/0x7c0 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0x103/0x1b0 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 save_stack+0xfb/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x75/0x3f0 mm/page_owner.c:297 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0xd19/0xea0 mm/page_alloc.c:2612 vfree+0x186/0x2e0 mm/vmalloc.c:3364 kcov_put kernel/kcov.c:429 [inline] kcov_close+0x2b/0x50 kernel/kcov.c:525 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 get_signal+0x1695/0x1730 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efdc0f77ab7 Code: Unable to access opcode bytes at 0x7efdc0f77a8d. RSP: 002b:00007ffdf9e3ded8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: 0000000000000000 RBX: 00007efdc1c696c0 RCX: 00007efdc0f77ab7 RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007efdc1c4a000 RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000 R10: 0000000000021000 R11: 0000000000000206 R12: 00007ffdf9e3e030 R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting gspca_pac7302 1-1:0.0: URB error -71, resubmitting