Extracting prog: 4m51.465386328s
Minimizing prog: 1h19m15.39417046s
Simplifying prog options: 6m31.300603591s
Extracting C: 5m12.66422428s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
single: successfully extracted reproducer
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
syz_usb_disconnect(0xffffffffffffffff)
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, 0x0)
read$char_usb(r2, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds.
a never seen crash title: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds., ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds.
a never seen crash title: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds., ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
reproducing took 1h46m6.721081742s
repro crashed as (corrupted=false):
INFO: task kworker/0:2:795 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:2     state:D stack:23840 pid:795   tgid:795   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.0.17:6062 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:27336 pid:6062  tgid:6061  ppid:5945   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion_timeout+0x2d7/0x610 kernel/sched/completion.c:172
 usb_start_wait_urb+0x17a/0x510 drivers/usb/core/message.c:64
 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
 usbtmc_read+0x526/0x13e0 drivers/usb/class/usbtmc.c:1409
 vfs_read+0x20c/0xa70 fs/read_write.c:572
 ksys_read+0x150/0x270 fs/read_write.c:717
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8449b9aeb9
RSP: 002b:00007f844aa23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f8449e15fa0 RCX: 00007f8449b9aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8449c08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8449e16038 R14: 00007f8449e15fa0 R15: 00007fff5a0567d8
 </TASK>
INFO: task syz.3.20:6066 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:27008 pid:6066  tgid:6065  ppid:5954   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
 usb_open+0x156/0x1e0 drivers/usb/core/file.c:47
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faa7495b78e
RSP: 002b:00007faa7577ab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007faa7577b6c0 RCX: 00007faa7495b78e
RDX: 0000000000000002 RSI: 00007faa7577ac00 RDI: ffffffffffffff9c
RBP: 00007faa74a08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faa74c16038 R14: 00007faa74c15fa0 R15: 00007ffde66c8a48
 </TASK>
INFO: task syz.2.19:6068 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:27216 pid:6068  tgid:6067  ppid:5950   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6cfc95b78e
RSP: 002b:00007f6cfd886b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6cfd8876c0 RCX: 00007f6cfc95b78e
RDX: 0000000000000002 RSI: 00007f6cfd886c00 RDI: ffffffffffffff9c
RBP: 00007f6cfca08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6cfcc16038 R14: 00007f6cfcc15fa0 R15: 00007fffc2e1e2e8
 </TASK>
INFO: task syz.1.18:6070 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:27328 pid:6070  tgid:6069  ppid:5949   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f918575b78e
RSP: 002b:00007f91865cfb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f91865d06c0 RCX: 00007f918575b78e
RDX: 0000000000000002 RSI: 00007f91865cfc00 RDI: ffffffffffffff9c
RBP: 00007f9185808c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9185a16038 R14: 00007f9185a15fa0 R15: 00007fffd64bf9d8
 </TASK>
INFO: task kworker/1:6:6073 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:6     state:D stack:25472 pid:6073  tgid:6073  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:0/9:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/0:1/10:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888059efd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888059efd198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff8880594dc160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff8880594dc160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/1:0/24:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807adf5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807adf5198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807b504160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807b504160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/1:1/42:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000b27c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
4 locks held by kworker/u8:3/49:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000b97c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
 #3: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
 #3: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
6 locks held by kworker/0:2/795:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900031e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807b32d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807b32d198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807bfe4160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807bfe4160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/1:2/907:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900037d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805a278198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805a278198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888057071160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888057071160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by klogd/5178:
 #0: ffff8880b853ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
2 locks held by getty/5574:
 #0: ffff888037ce90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
6 locks held by kworker/1:3/5801:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003eefc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805a1ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805a1ab198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807957b160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807957b160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.0.17/6062:
 #0: ffff888035c9a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x15d/0x13e0 drivers/usb/class/usbtmc.c:1395
3 locks held by kworker/0:7/6064:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900039afc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by syz.3.20/6066:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 #1: ffff888035c9a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
1 lock held by syz.2.19/6068:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.18/6070:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:5/6072:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003eafc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:6/6073:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003e9fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.4.21/6153:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:8/6176:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900039bfc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:9/6181:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000210fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.5.22/6187:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.23/6190:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.24/6192:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:10/6194:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900044dfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888057072198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888057072198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059efb160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059efb160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.8.25/6226:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:12/6263:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900048bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807b507198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807b507198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807ab9d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807ab9d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.9.26/6296:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.27/6299:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.28/6302:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.29/6327:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.30/6401:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.31/6413:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.32/6416:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.33/6445:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.34/6506:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.35/6529:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.36/6531:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.37/6554:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.38/6585:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.40/6623:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.39/6627:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.41/6651:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.42/6683:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
5 locks held by kworker/u8:8/6748:
 #0: ffff8880b853ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
 #1: ffff8880b8524588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
 #2: ffff8880b8526118 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline]
 #2: ffff8880b8526118 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 kernel/time/timer.c:1085
 #3: ffff8880b8524588 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xd4/0x340 kernel/sched/psi.c:919
 #4: ffffffff8e804cc8 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145
1 lock held by syz.7.44/6751:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.43/6760:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.45/6774:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.46/6803:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.47/6862:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.48/6869:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.49/6872:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
2 locks held by syz-executor/6875:
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
 watchdog+0x103d/0x1090 kernel/hung_task.c:516
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6875 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:752
Code: e8 fb c5 0d 0a 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 90 17 2c 8e 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 8c d0 84 00 48 c7 c3 58 e9 41 93 49 03 1e 48 89
RSP: 0018:ffffc9000c00e618 EFLAGS: 00000246
RAX: 1ffffffff1c582f3 RBX: 0000000000000001 RCX: 0000000080000001
RDX: ffffc9000c00e701 RSI: ffffffff8c2985e0 RDI: ffffffff8c2985a0
RBP: dffffc0000000000 R08: ffffc9000c00ebf8 R09: 0000000000000000
R10: ffffc9000c00e758 R11: fffff52001801ced R12: ffffc9000c00ec08
R13: ffffc9000c008000 R14: ffffffff8e2c1798 R15: dffffc0000000000
FS:  0000555592213500(0000) GS:ffff888125115000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe467347e20 CR3: 0000000073030000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rcu_read_unlock include/linux/rcupdate.h:879 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
 unwind_next_frame+0x1a66/0x23c0 arch/x86/kernel/unwind_orc.c:695
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4456 [inline]
 slab_alloc_node mm/slub.c:4785 [inline]
 kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4792
 kmem_alloc_batch lib/debugobjects.c:371 [inline]
 fill_pool+0x10f/0x5c0 lib/debugobjects.c:403
 debug_objects_fill_pool lib/debugobjects.c:725 [inline]
 __debug_object_init+0x3f0/0x4e0 lib/debugobjects.c:737
 ipv6_mc_init_dev+0x161/0xa60 net/ipv6/mcast.c:2811
 ipv6_add_dev+0xcca/0x13c0 net/ipv6/addrconf.c:457
 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
 geneve_configure+0x611/0xa30 drivers/net/geneve.c:1884
 geneve_newlink+0x1b9/0x260 drivers/net/geneve.c:2160
 rtnl_newlink_create+0x329/0xb70 net/core/rtnetlink.c:3840
 __rtnl_newlink net/core/rtnetlink.c:3957 [inline]
 rtnl_newlink+0x1666/0x1be0 net/core/rtnetlink.c:4072
 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 __sys_sendto+0x3ff/0x590 net/socket.c:2221
 __do_sys_sendto net/socket.c:2228 [inline]
 __se_sys_sendto net/socket.c:2224 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2224
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe46655b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fff512918c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555592213500 RCX: 00007fe46655b78e
RDX: 0000000000000060 RSI: 00007fe467344670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fff51291944 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe467344670 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 fb c5 0d 0a       	call   0xa0dc600
   5:	89 c3                	mov    %eax,%ebx
   7:	83 f8 08             	cmp    $0x8,%eax
   a:	73 65                	jae    0x71
   c:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
  13:	fc ff df
  16:	4c 8d 34 dd 90 17 2c 	lea    -0x71d3e870(,%rbx,8),%r14
  1d:	8e
  1e:	4c 89 f0             	mov    %r14,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
* 2a:	74 08                	je     0x34 <-- trapping instruction
  2c:	4c 89 f7             	mov    %r14,%rdi
  2f:	e8 8c d0 84 00       	call   0x84d0c0
  34:	48 c7 c3 58 e9 41 93 	mov    $0xffffffff9341e958,%rbx
  3b:	49 03 1e             	add    (%r14),%rbx
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89

final repro crashed as (corrupted=false):
INFO: task kworker/0:2:795 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:2     state:D stack:23840 pid:795   tgid:795   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.0.17:6062 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:27336 pid:6062  tgid:6061  ppid:5945   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion_timeout+0x2d7/0x610 kernel/sched/completion.c:172
 usb_start_wait_urb+0x17a/0x510 drivers/usb/core/message.c:64
 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
 usbtmc_read+0x526/0x13e0 drivers/usb/class/usbtmc.c:1409
 vfs_read+0x20c/0xa70 fs/read_write.c:572
 ksys_read+0x150/0x270 fs/read_write.c:717
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8449b9aeb9
RSP: 002b:00007f844aa23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f8449e15fa0 RCX: 00007f8449b9aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8449c08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8449e16038 R14: 00007f8449e15fa0 R15: 00007fff5a0567d8
 </TASK>
INFO: task syz.3.20:6066 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:27008 pid:6066  tgid:6065  ppid:5954   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
 usb_open+0x156/0x1e0 drivers/usb/core/file.c:47
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faa7495b78e
RSP: 002b:00007faa7577ab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007faa7577b6c0 RCX: 00007faa7495b78e
RDX: 0000000000000002 RSI: 00007faa7577ac00 RDI: ffffffffffffff9c
RBP: 00007faa74a08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faa74c16038 R14: 00007faa74c15fa0 R15: 00007ffde66c8a48
 </TASK>
INFO: task syz.2.19:6068 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:27216 pid:6068  tgid:6067  ppid:5950   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6cfc95b78e
RSP: 002b:00007f6cfd886b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6cfd8876c0 RCX: 00007f6cfc95b78e
RDX: 0000000000000002 RSI: 00007f6cfd886c00 RDI: ffffffffffffff9c
RBP: 00007f6cfca08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6cfcc16038 R14: 00007f6cfcc15fa0 R15: 00007fffc2e1e2e8
 </TASK>
INFO: task syz.1.18:6070 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:27328 pid:6070  tgid:6069  ppid:5949   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f918575b78e
RSP: 002b:00007f91865cfb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f91865d06c0 RCX: 00007f918575b78e
RDX: 0000000000000002 RSI: 00007f91865cfc00 RDI: ffffffffffffff9c
RBP: 00007f9185808c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9185a16038 R14: 00007f9185a15fa0 R15: 00007fffd64bf9d8
 </TASK>
INFO: task kworker/1:6:6073 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:6     state:D stack:25472 pid:6073  tgid:6073  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:0/9:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/0:1/10:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888059efd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888059efd198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff8880594dc160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff8880594dc160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/1:0/24:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac2f198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807adf5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807adf5198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807b504160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807b504160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/1:1/42:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000b27c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
4 locks held by kworker/u8:3/49:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000b97c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
 #3: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
 #3: ffffffff8e9665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
6 locks held by kworker/0:2/795:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900031e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807b32d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807b32d198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807bfe4160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807bfe4160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/1:2/907:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900037d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805a278198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805a278198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888057071160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888057071160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by klogd/5178:
 #0: ffff8880b853ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
2 locks held by getty/5574:
 #0: ffff888037ce90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
6 locks held by kworker/1:3/5801:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003eefc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a60b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805a1ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805a1ab198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807957b160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807957b160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.0.17/6062:
 #0: ffff888035c9a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x15d/0x13e0 drivers/usb/class/usbtmc.c:1395
3 locks held by kworker/0:7/6064:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900039afc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by syz.3.20/6066:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 #1: ffff888035c9a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
1 lock held by syz.2.19/6068:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.18/6070:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:5/6072:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003eafc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:6/6073:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003e9fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4f7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.4.21/6153:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:8/6176:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900039bfc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a73b198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:9/6181:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000210fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a7e7198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.5.22/6187:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.23/6190:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.24/6192:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:10/6194:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900044dfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a7ab198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888057072198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888057072198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059efb160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059efb160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.8.25/6226:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:12/6263:
 #0: ffff888021edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900048bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802ac4b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88807b507198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88807b507198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88807ab9d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807ab9d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.9.26/6296:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.27/6299:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.28/6302:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.29/6327:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.30/6401:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.31/6413:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.32/6416:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.33/6445:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.34/6506:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.35/6529:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.36/6531:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.37/6554:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.38/6585:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.40/6623:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.39/6627:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.41/6651:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.42/6683:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
5 locks held by kworker/u8:8/6748:
 #0: ffff8880b853ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
 #1: ffff8880b8524588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
 #2: ffff8880b8526118 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline]
 #2: ffff8880b8526118 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 kernel/time/timer.c:1085
 #3: ffff8880b8524588 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xd4/0x340 kernel/sched/psi.c:919
 #4: ffffffff8e804cc8 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145
1 lock held by syz.7.44/6751:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.43/6760:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.45/6774:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.46/6803:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.47/6862:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.48/6869:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.49/6872:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
2 locks held by syz-executor/6875:
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8f523b68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
 watchdog+0x103d/0x1090 kernel/hung_task.c:516
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6875 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:752
Code: e8 fb c5 0d 0a 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 90 17 2c 8e 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 8c d0 84 00 48 c7 c3 58 e9 41 93 49 03 1e 48 89
RSP: 0018:ffffc9000c00e618 EFLAGS: 00000246
RAX: 1ffffffff1c582f3 RBX: 0000000000000001 RCX: 0000000080000001
RDX: ffffc9000c00e701 RSI: ffffffff8c2985e0 RDI: ffffffff8c2985a0
RBP: dffffc0000000000 R08: ffffc9000c00ebf8 R09: 0000000000000000
R10: ffffc9000c00e758 R11: fffff52001801ced R12: ffffc9000c00ec08
R13: ffffc9000c008000 R14: ffffffff8e2c1798 R15: dffffc0000000000
FS:  0000555592213500(0000) GS:ffff888125115000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe467347e20 CR3: 0000000073030000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rcu_read_unlock include/linux/rcupdate.h:879 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
 unwind_next_frame+0x1a66/0x23c0 arch/x86/kernel/unwind_orc.c:695
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4456 [inline]
 slab_alloc_node mm/slub.c:4785 [inline]
 kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4792
 kmem_alloc_batch lib/debugobjects.c:371 [inline]
 fill_pool+0x10f/0x5c0 lib/debugobjects.c:403
 debug_objects_fill_pool lib/debugobjects.c:725 [inline]
 __debug_object_init+0x3f0/0x4e0 lib/debugobjects.c:737
 ipv6_mc_init_dev+0x161/0xa60 net/ipv6/mcast.c:2811
 ipv6_add_dev+0xcca/0x13c0 net/ipv6/addrconf.c:457
 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
 geneve_configure+0x611/0xa30 drivers/net/geneve.c:1884
 geneve_newlink+0x1b9/0x260 drivers/net/geneve.c:2160
 rtnl_newlink_create+0x329/0xb70 net/core/rtnetlink.c:3840
 __rtnl_newlink net/core/rtnetlink.c:3957 [inline]
 rtnl_newlink+0x1666/0x1be0 net/core/rtnetlink.c:4072
 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 __sys_sendto+0x3ff/0x590 net/socket.c:2221
 __do_sys_sendto net/socket.c:2228 [inline]
 __se_sys_sendto net/socket.c:2224 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2224
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe46655b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fff512918c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555592213500 RCX: 00007fe46655b78e
RDX: 0000000000000060 RSI: 00007fe467344670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fff51291944 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe467344670 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 fb c5 0d 0a       	call   0xa0dc600
   5:	89 c3                	mov    %eax,%ebx
   7:	83 f8 08             	cmp    $0x8,%eax
   a:	73 65                	jae    0x71
   c:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
  13:	fc ff df
  16:	4c 8d 34 dd 90 17 2c 	lea    -0x71d3e870(,%rbx,8),%r14
  1d:	8e
  1e:	4c 89 f0             	mov    %r14,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
* 2a:	74 08                	je     0x34 <-- trapping instruction
  2c:	4c 89 f7             	mov    %r14,%rdi
  2f:	e8 8c d0 84 00       	call   0x84d0c0
  34:	48 c7 c3 58 e9 41 93 	mov    $0xffffffff9341e958,%rbx
  3b:	49 03 1e             	add    (%r14),%rbx
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89