INFO: task kworker/0:0:9 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0 state:D stack:24872 pid:9 tgid:9 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
i2c_del_adapter+0x62d/0x820 drivers/i2c/i2c-core-base.c:1814
i2c_tiny_usb_disconnect+0x42/0x110 drivers/i2c/busses/i2c-tiny-usb.c:290
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:633 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:625
__device_release_driver drivers/base/dd.c:1344 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1367
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:657
device_del+0x376/0x9b0 drivers/base/core.c:3879
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1476
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
process_scheduled_works kernel/workqueue.c:3359 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz.1.18:6560 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18 state:D stack:27192 pid:6560 tgid:6559 ppid:6320 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
device_lock include/linux/device.h:949 [inline]
usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:411
do_dentry_open+0x6d8/0x1660 fs/open.c:949
vfs_open+0x82/0x3f0 fs/open.c:1081
do_open fs/namei.c:4677 [inline]
path_openat+0x208c/0x31a0 fs/namei.c:4836
do_file_open+0x20e/0x430 fs/namei.c:4865
do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fed0435b7ce
RSP: 002b:00007fed05332b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fed053336c0 RCX: 00007fed0435b7ce
RDX: 0000000000188301 RSI: 00007fed05332c00 RDI: ffffffffffffff9c
RBP: 00007fed05332c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fed04606038 R14: 00007fed04605fa0 R15: 00007ffe9b25c518
INFO: task syz.0.22:6562 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.22 state:D stack:27352 pid:6562 tgid:6561 ppid:6318 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
device_lock include/linux/device.h:949 [inline]
usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:411
do_dentry_open+0x6d8/0x1660 fs/open.c:949
vfs_open+0x82/0x3f0 fs/open.c:1081
do_open fs/namei.c:4677 [inline]
path_openat+0x208c/0x31a0 fs/namei.c:4836
do_file_open+0x20e/0x430 fs/namei.c:4865
do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6c7c55b7ce
RSP: 002b:00007f6c7d404b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6c7d4056c0 RCX: 00007f6c7c55b7ce
RDX: 0000000000188301 RSI: 00007f6c7d404c00 RDI: ffffffffffffff9c
RBP: 00007f6c7d404c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f6c7c806038 R14: 00007f6c7c805fa0 R15: 00007ffc799978b8
INFO: task syz.3.20:6579 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20 state:D stack:27352 pid:6579 tgid:6577 ppid:6328 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
device_lock include/linux/device.h:949 [inline]
usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:411
do_dentry_open+0x6d8/0x1660 fs/open.c:949
vfs_open+0x82/0x3f0 fs/open.c:1081
do_open fs/namei.c:4677 [inline]
path_openat+0x208c/0x31a0 fs/namei.c:4836
do_file_open+0x20e/0x430 fs/namei.c:4865
do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1eb995b7ce
RSP: 002b:00007f1eba786b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f1eba7876c0 RCX: 00007f1eb995b7ce
RDX: 0000000000188301 RSI: 00007f1eba786c00 RDI: ffffffffffffff9c
RBP: 00007f1eba786c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f1eb9c06038 R14: 00007f1eb9c05fa0 R15: 00007ffe98bb8f78
INFO: task syz.2.19:6588 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19 state:D stack:27352 pid:6588 tgid:6587 ppid:6324 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
device_lock include/linux/device.h:949 [inline]
usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:411
do_dentry_open+0x6d8/0x1660 fs/open.c:949
vfs_open+0x82/0x3f0 fs/open.c:1081
do_open fs/namei.c:4677 [inline]
path_openat+0x208c/0x31a0 fs/namei.c:4836
do_file_open+0x20e/0x430 fs/namei.c:4865
do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fef2cd5b7ce
RSP: 002b:00007fef2dcfdb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fef2dcfe6c0 RCX: 00007fef2cd5b7ce
RDX: 0000000000188301 RSI: 00007fef2dcfdc00 RDI: ffffffffffffff9c
RBP: 00007fef2dcfdc00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fef2d006038 R14: 00007fef2d005fa0 R15: 00007ffe640dff58
Showing all locks held in the system:
5 locks held by kworker/0:0/9:
#0: ffff88802329d548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251
#1: ffffc900000e7d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252
#2: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#2: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888030e181e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#3: ffff888030e181e0 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336
#4: ffff888035b671a8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#4: ffff888035b671a8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1166 [inline]
#4: ffff888035b671a8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1364
1 lock held by khungtaskd/30:
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:9/1319:
#0: ffff8880b843b220 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:647
#1: ffff8880b8424648 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline]
#1: ffff8880b8424648 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2c11/0x6120 kernel/sched/core.c:6905
#2: ffff8880354d8788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6441 [inline]
#2: ffff8880354d8788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x5c0 net/wireless/core.c:426
#3: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#3: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#3: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: ieee80211_sta_active_ibss+0xdc/0x420 net/mac80211/ibss.c:635
2 locks held by getty/5561:
#0: ffff888038be90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by syz.1.18/6560:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.0.22/6562:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.3.20/6579:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.2.19/6588:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.7.30/6954:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.5.28/6956:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.6.29/6958:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.8.31/6960:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
5 locks held by kworker/u9:5/6992:
#0: ffff888077593948 ((wq_completion)hci10){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251
#1: ffffc90004687d08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252
#2: ffff888053e34ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331
#3: ffff888053e340c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5744
#4: ffffffff908adb08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff908adb08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x119/0x360 net/bluetooth/hci_conn.c:1342
1 lock held by syz.1.41/7074:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.3.42/7079:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.0.40/7080:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.9.39/7086:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.2.49/7158:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.5.51/7208:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.6.52/7215:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.8.53/7221:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.7.60/7285:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.1.61/7323:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.0.63/7336:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.9.62/7338:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.3.70/7372:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.2.71/7423:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.5.73/7453:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.6.74/7457:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.8.79/7497:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.7.81/7529:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
7 locks held by kworker/u9:9/7563:
#0: ffff88805ec98948 ((wq_completion)hci11){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251
#1: ffffc900062c7d08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252
#2: ffff888020f80ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331
#3: ffff888020f800c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5744
#4: ffffffff908adb08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff908adb08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x119/0x360 net/bluetooth/hci_conn.c:1342
#5: ffff88802d1ac300 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x95/0x710 net/bluetooth/l2cap_core.c:1777
#6: ffffffff8e7f3478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.1.83/7579:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.9.84/7582:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.0.89/7623:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.3.91/7648:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.2.93/7698:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.5.94/7702:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.6.99/7737:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.8.101/7768:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.1.104/7820:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
1 lock held by syz.7.103/7826:
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#0: ffff88802a7c51e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xd25/0x1050 kernel/hung_task.c:515
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:chacha_permute+0x4c0/0x6e0 lib/crypto/chacha-block-generic.c:50
Code: 41 89 d1 8b 54 24 04 45 01 c8 01 f2 31 de 45 31 c5 c1 c6 10 31 d0 41 c1 c5 10 c1 c0 07 41 01 f2 89 44 24 08 01 c7 8b 44 24 0c <44> 31 d1 41 31 fc c1 c1 0c 41 01 c3 41 c1 c4 10 8b 44 24 08 44 31
RSP: 0018:ffffc90000ab77a8 EFLAGS: 00000007
RAX: 00000000e56f05f1 RBX: 0000000013a0d77f RCX: 00000000f069fbd0
RDX: 000000005dbd1224 RSI: 00000000afa23be5 RDI: 0000000026e6245c
RBP: 000000003cad347f R08: 000000004439ff7c R09: 0000000092b61076
R10: 00000000007a0a89 R11: 000000004b975a88 R12: 0000000035c27f06
R13: 0000000097b98220 R14: 00000000b16f7791 R15: 0000000013ff09d5
FS: 0000000000000000(0000) GS:ffff888124438000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555889da28 CR3: 0000000053494000 CR4: 00000000003526f0
Call Trace:
chacha_block_generic+0x132/0x360 lib/crypto/chacha-block-generic.c:83
chacha20_block include/crypto/chacha.h:45 [inline]
crng_fast_key_erasure+0x1a5/0x260 drivers/char/random.c:319
crng_make_state+0x1c2/0x6c0 drivers/char/random.c:385
_get_random_bytes+0x11c/0x220 drivers/char/random.c:399
eth_random_addr include/linux/etherdevice.h:239 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:826 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline]
nsim_dev_trap_report_work+0x370/0xd10 drivers/net/netdevsim/dev.c:922
process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
process_scheduled_works kernel/workqueue.c:3359 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245