Extracting prog: 5m36.801538075s
Minimizing prog: 1h19m20.709444024s
Simplifying prog options: 10m14.563868278s
Extracting C: 3m8.575518821s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
single: successfully extracted reproducer
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
syz_usb_disconnect(0xffffffffffffffff)
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, 0x0)
read$char_usb(r2, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
program crashed: INFO: task syz-executor blocked for more than NUM seconds.
a never seen crash title: INFO: task syz-executor blocked for more than NUM seconds., ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds.
a never seen crash title: INFO: task syz.NUM.NUM:LINE blocked for more than NUM seconds., ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$HIDIOCGUSAGE-read$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x40045b0a, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1})
read$char_usb(r2, 0x0, 0x0)

program crashed: INFO: task kworker/NUM:NUM:NUM blocked for more than NUM seconds.
validation run: crashed=true
reproducing took 1h50m43.651987802s
repro crashed as (corrupted=false):
INFO: task kworker/0:0:9 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0     state:D stack:24512 pid:9     tgid:9     ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:2:794 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2     state:D stack:24512 pid:794   tgid:794   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:3:980 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:3     state:D stack:24512 pid:980   tgid:980   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/0:4:5943 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:24456 pid:5943  tgid:5943  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.3.20:6082 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:26408 pid:6082  tgid:6082  ppid:5957   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion_timeout+0x2d7/0x610 kernel/sched/completion.c:172
 usb_start_wait_urb+0x17a/0x510 drivers/usb/core/message.c:64
 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
 usbtmc_read+0x526/0x13e0 drivers/usb/class/usbtmc.c:1409
 vfs_read+0x20c/0xa70 fs/read_write.c:572
 ksys_read+0x150/0x270 fs/read_write.c:717
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd0a59aeb9
RSP: 002b:00007ffe39853418 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007efd0a815fa0 RCX: 00007efd0a59aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007efd0a608c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efd0a815fac R14: 00007efd0a815fa0 R15: 00007efd0a815fa0
 </TASK>
INFO: task syz.2.19:6085 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:27072 pid:6085  tgid:6085  ppid:5955   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
 usb_open+0x156/0x1e0 drivers/usb/core/file.c:47
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f72d715b78e
RSP: 002b:00007fff17da79a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005555778d2500 RCX: 00007f72d715b78e
RDX: 0000000000000002 RSI: 00007fff17da7a80 RDI: ffffffffffffff9c
RBP: 00007f72d7208c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f72d7415fac R14: 00007f72d7415fa0 R15: 00007f72d7415fa0
 </TASK>
INFO: task syz.0.17:6088 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:27072 pid:6088  tgid:6088  ppid:5947   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4cfcf5b78e
RSP: 002b:00007ffc2a1b22a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055558510c500 RCX: 00007f4cfcf5b78e
RDX: 0000000000000002 RSI: 00007ffc2a1b2380 RDI: ffffffffffffff9c
RBP: 00007f4cfd008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4cfd215fac R14: 00007f4cfd215fa0 R15: 00007f4cfd215fa0
 </TASK>
INFO: task kworker/1:7:6089 blocked  for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:7     state:D stack:25472 pid:6089  tgid:6089  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.1.18:6090 blocked  for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:27072 pid:6090  tgid:6090  ppid:5950   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc352b5b78e
RSP: 002b:00007fff66fcafa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000555580149500 RCX: 00007fc352b5b78e
RDX: 0000000000000002 RSI: 00007fff66fcb080 RDI: ffffffffffffff9c
RBP: 00007fc352c08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc352e15fac R14: 00007fc352e15fa0 R15: 00007fc352e15fa0
 </TASK>

Showing all locks held in the system:
6 locks held by kworker/0:0/9:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff8880223c8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff8880223c8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888037684160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888037684160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/0:1/10:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888058e92198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888058e92198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88805ac05160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88805ac05160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
 #0: 
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:3/48:
3 locks held by kworker/1:1/54:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000be7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:2/794:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003347c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:3/980:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000387fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/0:2/1206:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003effc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888079d06198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888079d06198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88805b894160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88805b894160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
2 locks held by getty/5574:
 #0: ffff88803754a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:4/5943:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003f2fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888075cc6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888075cc6198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888078de2160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888078de2160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
3 locks held by kworker/0:5/6058:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900032e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/1:5/6081:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900032b7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805b838198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805b838198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88802b790160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88802b790160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.3.20/6082:
 #0: ffff888022b8f8d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x15d/0x13e0 drivers/usb/class/usbtmc.c:1395
6 locks held by kworker/0:7/6084:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000392fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88802b164198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88802b164198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059aae160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059aae160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
2 locks held by syz.2.19/6085:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 #1: ffff888022b8f8d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
1 lock held by syz.0.17/6088:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:7/6089:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003137c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.1.18/6090:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:8/6092:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88802b791198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88802b791198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059aa8160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059aa8160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
3 locks held by kworker/1:9/6093:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/0:9/6095:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030c7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.4.21/6175:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.24/6208:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.23/6210:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.22/6211:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/0:10/6213:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003e47c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.8.25/6245:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:11/6301:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000aef7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888053174198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888053174198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888033e8d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888033e8d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.9.26/6306:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.28/6313:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.27/6314:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.29/6336:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.30/6394:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.32/6410:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.31/6411:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.33/6438:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.34/6510:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.36/6524:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.35/6525:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.37/6545:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.38/6603:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.39/6623:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.40/6624:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.41/6635:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.42/6689:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.44/6743:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.43/6744:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.45/6745:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.46/6779:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.47/6838:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.48/6839:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.49/6840:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.50/6862:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz-executor/6864:
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
2 locks held by syz-executor/6875:
 #0: ffffffff8fdd9610 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
2 locks held by syz-executor/6877:
 #0: ffffffff8fdd9610 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x88/0x290 net/ipv4/nexthop.c:3971

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
 watchdog+0x103d/0x1090 kernel/hung_task.c:516
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6877 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:rtnetlink_event+0x234/0x270 net/core/rtnetlink.c:7004
Code: 8b 3f 4c 89 f6 31 d2 b9 01 00 00 00 45 31 c0 41 b9 c0 0c 00 00 e8 fc a7 39 00 eb 13 e8 f5 a2 37 f8 eb 0c e8 ee a2 37 f8 eb 05 <e8> e7 a2 37 f8 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 44
RSP: 0018:ffffc9000d72f900 EFLAGS: 00000293
RAX: 000000000000000d RBX: ffff88807b080000 RCX: 0000000000000007
RDX: ffffffff898e48f9 RSI: ffffffff8fde88a0 RDI: 0000000000000011
RBP: 00000000fffffffe R08: ffff88801f3a1e40 R09: 000000000000000d
R10: 000000000000001f R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000011 R15: 1ffffffff1fbd0bc
FS:  0000555580fe4500(0000) GS:ffff888125015000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c605e9eee0 CR3: 000000004dd38000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 register_netdevice+0x1268/0x1cf0 net/core/dev.c:11404
 register_netdev+0x40/0x60 net/core/dev.c:11525
 loopback_net_init+0x75/0x150 drivers/net/loopback.c:218
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
 setup_net+0x118/0x340 net/core/net_namespace.c:446
 copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581
 create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:226
 ksys_unshare+0x4f4/0x900 kernel/fork.c:3173
 __do_sys_unshare kernel/fork.c:3244 [inline]
 __se_sys_unshare kernel/fork.c:3242 [inline]
 __x64_sys_unshare+0x38/0x50 kernel/fork.c:3242
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdd4039c1a7
Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdbd07add8 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdd4039c1a7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007ffdbd07ae30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdbd07ae38
R13: 0000000000000002 R14: 00007ffdbd07b018 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 3f                	mov    (%rdi),%edi
   2:	4c 89 f6             	mov    %r14,%rsi
   5:	31 d2                	xor    %edx,%edx
   7:	b9 01 00 00 00       	mov    $0x1,%ecx
   c:	45 31 c0             	xor    %r8d,%r8d
   f:	41 b9 c0 0c 00 00    	mov    $0xcc0,%r9d
  15:	e8 fc a7 39 00       	call   0x39a816
  1a:	eb 13                	jmp    0x2f
  1c:	e8 f5 a2 37 f8       	call   0xf837a316
  21:	eb 0c                	jmp    0x2f
  23:	e8 ee a2 37 f8       	call   0xf837a316
  28:	eb 05                	jmp    0x2f
* 2a:	e8 e7 a2 37 f8       	call   0xf837a316 <-- trapping instruction
  2f:	31 c0                	xor    %eax,%eax
  31:	5b                   	pop    %rbx
  32:	41 5c                	pop    %r12
  34:	41 5e                	pop    %r14
  36:	41 5f                	pop    %r15
  38:	5d                   	pop    %rbp
  39:	c3                   	ret
  3a:	cc                   	int3
  3b:	cc                   	int3
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	cc                   	int3
  3f:	44                   	rex.R

final repro crashed as (corrupted=false):
INFO: task kworker/0:0:9 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0     state:D stack:24512 pid:9     tgid:9     ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:2:794 blocked  for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2     state:D stack:24512 pid:794   tgid:794   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:3:980 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:3     state:D stack:24512 pid:980   tgid:980   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/0:4:5943 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:24456 pid:5943  tgid:5943  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_write_slowpath+0x899/0x1040 kernel/locking/rwsem.c:1185
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0x1bc/0x200 kernel/locking/rwsem.c:1591
 usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
 usbtmc_probe+0xf55/0x1d00 drivers/usb/class/usbtmc.c:2473
 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:661
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
 device_add+0x7b6/0xb70 drivers/base/core.c:3689
 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.3.20:6082 blocked  for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:26408 pid:6082  tgid:6082  ppid:5957   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion_timeout+0x2d7/0x610 kernel/sched/completion.c:172
 usb_start_wait_urb+0x17a/0x510 drivers/usb/core/message.c:64
 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
 usbtmc_read+0x526/0x13e0 drivers/usb/class/usbtmc.c:1409
 vfs_read+0x20c/0xa70 fs/read_write.c:572
 ksys_read+0x150/0x270 fs/read_write.c:717
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd0a59aeb9
RSP: 002b:00007ffe39853418 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007efd0a815fa0 RCX: 00007efd0a59aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007efd0a608c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efd0a815fac R14: 00007efd0a815fa0 R15: 00007efd0a815fa0
 </TASK>
INFO: task syz.2.19:6085 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:27072 pid:6085  tgid:6085  ppid:5955   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
 usb_open+0x156/0x1e0 drivers/usb/core/file.c:47
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f72d715b78e
RSP: 002b:00007fff17da79a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005555778d2500 RCX: 00007f72d715b78e
RDX: 0000000000000002 RSI: 00007fff17da7a80 RDI: ffffffffffffff9c
RBP: 00007f72d7208c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f72d7415fac R14: 00007f72d7415fa0 R15: 00007f72d7415fa0
 </TASK>
INFO: task syz.0.17:6088 blocked  for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:27072 pid:6088  tgid:6088  ppid:5947   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4cfcf5b78e
RSP: 002b:00007ffc2a1b22a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055558510c500 RCX: 00007f4cfcf5b78e
RDX: 0000000000000002 RSI: 00007ffc2a1b2380 RDI: ffffffffffffff9c
RBP: 00007f4cfd008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4cfd215fac R14: 00007f4cfd215fa0 R15: 00007f4cfd215fa0
 </TASK>
INFO: task kworker/1:7:6089 blocked  for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:7     state:D stack:25472 pid:6089  tgid:6089  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
 request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz.1.18:6090 blocked  for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:27072 pid:6090  tgid:6090  ppid:5950   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5310 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
 usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:949
 vfs_open+0x3b/0x340 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4830
 do_file_open+0x23e/0x4a0 fs/namei.c:4859
 do_sys_openat2+0x113/0x200 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc352b5b78e
RSP: 002b:00007fff66fcafa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000555580149500 RCX: 00007fc352b5b78e
RDX: 0000000000000002 RSI: 00007fff66fcb080 RDI: ffffffffffffff9c
RBP: 00007fc352c08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc352e15fac R14: 00007fc352e15fa0 R15: 00007fc352e15fa0
 </TASK>

Showing all locks held in the system:
6 locks held by kworker/0:0/9:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff8880223c8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff8880223c8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888037684160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888037684160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
6 locks held by kworker/0:1/10:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888058e92198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888058e92198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88805ac05160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88805ac05160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
 #0: 
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
ffffffff8e960320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:3/48:
3 locks held by kworker/1:1/54:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90000be7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:2/794:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003347c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/1:3/980:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000387fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/0:2/1206:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003effc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a3bc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888079d06198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888079d06198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88805b894160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88805b894160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
2 locks held by getty/5574:
 #0: ffff88803754a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:4/5943:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003f2fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a2cd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888075cc6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888075cc6198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888078de2160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888078de2160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
3 locks held by kworker/0:5/6058:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900032e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/1:5/6081:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900032b7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88805b838198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805b838198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff88802b790160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88802b790160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.3.20/6082:
 #0: ffff888022b8f8d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x15d/0x13e0 drivers/usb/class/usbtmc.c:1395
6 locks held by kworker/0:7/6084:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000392fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4bd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88802b164198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88802b164198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059aae160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059aae160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
2 locks held by syz.2.19/6085:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
 #1: ffff888022b8f8d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x476/0x8e0 drivers/usb/class/usbtmc.c:189
1 lock held by syz.0.17/6088:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/1:7/6089:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003137c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88823bf36198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.1.18/6090:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:8/6092:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a431198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88802b791198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88802b791198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888059aa8160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888059aa8160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
3 locks held by kworker/1:9/6093:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030e7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/0:9/6095:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc900030c7c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a4f8198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.4.21/6175:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.24/6208:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.23/6210:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.22/6211:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
3 locks held by kworker/0:10/6213:
 #0: ffff88813ff47548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc90003e47c40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
 #2: ffff88802a525198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x332/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.8.25/6245:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
6 locks held by kworker/1:11/6301:
 #0: ffff8880226f6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x855/0x1650 kernel/workqueue.c:3254
 #1: ffffc9000aef7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x87c/0x1650 kernel/workqueue.c:3255
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a669198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff888053174198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888053174198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #4: ffff888033e8d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888033e8d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1008
 #5: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_register_dev+0x142/0x5f0 drivers/usb/core/file.c:134
1 lock held by syz.9.26/6306:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.28/6313:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.27/6314:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.29/6336:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.30/6394:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.32/6410:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.31/6411:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.33/6438:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.34/6510:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.36/6524:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.35/6525:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.37/6545:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.38/6603:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.39/6623:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.40/6624:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.4.41/6635:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.5.42/6689:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.7.44/6743:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.6.43/6744:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.8.45/6745:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.9.46/6779:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.3.47/6838:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.0.48/6839:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.1.49/6840:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz.2.50/6862:
 #0: ffffffff8f699a90 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 drivers/usb/core/file.c:38
1 lock held by syz-executor/6864:
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
2 locks held by syz-executor/6875:
 #0: ffffffff8fdd9610 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
2 locks held by syz-executor/6877:
 #0: ffffffff8fdd9610 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8fde84c8 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x88/0x290 net/ipv4/nexthop.c:3971

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
 watchdog+0x103d/0x1090 kernel/hung_task.c:516
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6877 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:rtnetlink_event+0x234/0x270 net/core/rtnetlink.c:7004
Code: 8b 3f 4c 89 f6 31 d2 b9 01 00 00 00 45 31 c0 41 b9 c0 0c 00 00 e8 fc a7 39 00 eb 13 e8 f5 a2 37 f8 eb 0c e8 ee a2 37 f8 eb 05 <e8> e7 a2 37 f8 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 44
RSP: 0018:ffffc9000d72f900 EFLAGS: 00000293
RAX: 000000000000000d RBX: ffff88807b080000 RCX: 0000000000000007
RDX: ffffffff898e48f9 RSI: ffffffff8fde88a0 RDI: 0000000000000011
RBP: 00000000fffffffe R08: ffff88801f3a1e40 R09: 000000000000000d
R10: 000000000000001f R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000011 R15: 1ffffffff1fbd0bc
FS:  0000555580fe4500(0000) GS:ffff888125015000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c605e9eee0 CR3: 000000004dd38000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 register_netdevice+0x1268/0x1cf0 net/core/dev.c:11404
 register_netdev+0x40/0x60 net/core/dev.c:11525
 loopback_net_init+0x75/0x150 drivers/net/loopback.c:218
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
 setup_net+0x118/0x340 net/core/net_namespace.c:446
 copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581
 create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:226
 ksys_unshare+0x4f4/0x900 kernel/fork.c:3173
 __do_sys_unshare kernel/fork.c:3244 [inline]
 __se_sys_unshare kernel/fork.c:3242 [inline]
 __x64_sys_unshare+0x38/0x50 kernel/fork.c:3242
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdd4039c1a7
Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdbd07add8 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdd4039c1a7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007ffdbd07ae30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdbd07ae38
R13: 0000000000000002 R14: 00007ffdbd07b018 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 3f                	mov    (%rdi),%edi
   2:	4c 89 f6             	mov    %r14,%rsi
   5:	31 d2                	xor    %edx,%edx
   7:	b9 01 00 00 00       	mov    $0x1,%ecx
   c:	45 31 c0             	xor    %r8d,%r8d
   f:	41 b9 c0 0c 00 00    	mov    $0xcc0,%r9d
  15:	e8 fc a7 39 00       	call   0x39a816
  1a:	eb 13                	jmp    0x2f
  1c:	e8 f5 a2 37 f8       	call   0xf837a316
  21:	eb 0c                	jmp    0x2f
  23:	e8 ee a2 37 f8       	call   0xf837a316
  28:	eb 05                	jmp    0x2f
* 2a:	e8 e7 a2 37 f8       	call   0xf837a316 <-- trapping instruction
  2f:	31 c0                	xor    %eax,%eax
  31:	5b                   	pop    %rbx
  32:	41 5c                	pop    %r12
  34:	41 5e                	pop    %r14
  36:	41 5f                	pop    %r15
  38:	5d                   	pop    %rbp
  39:	c3                   	ret
  3a:	cc                   	int3
  3b:	cc                   	int3
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	cc                   	int3
  3f:	44                   	rex.R