INFO: task kworker/1:2:793 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:25464 pid:793 tgid:793 ppid:2 task_flags:0x4288060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 i2c_del_adapter+0x62d/0x820 drivers/i2c/i2c-core-base.c:1814 i2c_tiny_usb_disconnect+0x42/0x110 drivers/i2c/busses/i2c-tiny-usb.c:290 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:573 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:565 __device_release_driver drivers/base/dd.c:1284 [inline] device_release_driver_internal+0x42e/0x600 drivers/base/dd.c:1307 bus_remove_device+0x22f/0x440 drivers/base/bus.c:616 device_del+0x376/0x9b0 drivers/base/core.c:3878 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1418 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz.0.25:6735 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.25 state:D stack:25752 pid:6735 tgid:6734 ppid:6386 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3d9175b7ce RSP: 002b:00007f3d90dfdb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f3d90dfe6c0 RCX: 00007f3d9175b7ce RDX: 0000000000188301 RSI: 00007f3d90dfdc00 RDI: ffffffffffffff9c RBP: 00007f3d90dfdc00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f3d91a06038 R14: 00007f3d91a05fa0 R15: 00007ffc37027078 INFO: task syz.1.26:6740 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.26 state:D stack:26160 pid:6740 tgid:6738 ppid:6392 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd4feb5b7ce RSP: 002b:00007fd4ffafbb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fd4ffafc6c0 RCX: 00007fd4feb5b7ce RDX: 0000000000188301 RSI: 00007fd4ffafbc00 RDI: ffffffffffffff9c RBP: 00007fd4ffafbc00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fd4fee06038 R14: 00007fd4fee05fa0 R15: 00007fff5690aee8 INFO: task syz.2.27:6750 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.27 state:D stack:25560 pid:6750 tgid:6746 ppid:6393 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f411575b7ce RSP: 002b:00007f4116637b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f41166386c0 RCX: 00007f411575b7ce RDX: 0000000000188301 RSI: 00007f4116637c00 RDI: ffffffffffffff9c RBP: 00007f4116637c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f4115a06038 R14: 00007f4115a05fa0 R15: 00007ffe8d799848 INFO: task syz.4.28:6751 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.28 state:D stack:26248 pid:6751 tgid:6749 ppid:6399 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fce4eb5b7ce RSP: 002b:00007fce4f95eb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fce4f95f6c0 RCX: 00007fce4eb5b7ce RDX: 0000000000188301 RSI: 00007fce4f95ec00 RDI: ffffffffffffff9c RBP: 00007fce4f95ec00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fce4ee06038 R14: 00007fce4ee05fa0 R15: 00007ffdfc9ac468 INFO: task syz.3.29:6765 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.29 state:D stack:26160 pid:6765 tgid:6764 ppid:6396 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f456df5b7ce RSP: 002b:00007f456eda3b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f456eda46c0 RCX: 00007f456df5b7ce RDX: 0000000000188301 RSI: 00007f456eda3c00 RDI: ffffffffffffff9c RBP: 00007f456eda3c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f456e206038 R14: 00007f456e205fa0 R15: 00007ffdde5be298 Showing all locks held in the system: 3 locks held by kworker/u8:0/12: 1 lock held by khungtaskd/31: #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 4 locks held by kworker/u8:3/37: 5 locks held by kworker/1:2/793: #0: ffff88802168b148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90003337c98 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888021b59198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888021b59198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336 #4: ffff8880547f5160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff8880547f5160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1106 [inline] #4: ffff8880547f5160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xaa/0x600 drivers/base/dd.c:1304 2 locks held by getty/5580: #0: ffff88814cf9d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 7 locks held by kworker/u9:3/6402: #0: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639 #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline] #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2b6f/0x5e10 kernel/sched/core.c:6861 #2: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #2: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: hci_cmd_work+0x4b2/0x890 net/bluetooth/hci_core.c:4156 #3: ffff8880b84262d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x124/0x1d0 kernel/time/timer.c:1004 #4: ffffffff9b198a68 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x144/0x490 lib/debugobjects.c:818 #5: ffff8880b8443b00 ((local_lock_t *)&c->lock){..-.}-{3:3}, at: local_trylock_acquire include/linux/local_lock_internal.h:48 [inline] #5: ffff8880b8443b00 ((local_lock_t *)&c->lock){..-.}-{3:3}, at: put_cpu_partial+0x15d/0x310 mm/slub.c:3933 #6: ffffffff9b209bd8 (&port_lock_key){-.-.}-{3:3}, at: uart_port_lock_irqsave include/linux/serial_core.h:717 [inline] #6: ffffffff9b209bd8 (&port_lock_key){-.-.}-{3:3}, at: serial8250_console_write+0x17e/0x1900 drivers/tty/serial/8250/8250_port.c:3301 1 lock held by syz.0.25/6735: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.1.26/6740: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.2.27/6750: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.4.28/6751: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.3.29/6765: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.5.30/6961: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.7.32/6966: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.6.31/6969: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.9.34/6973: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.8.33/6976: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.1.36/7062: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.0.35/7076: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.3.38/7102: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.2.37/7104: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.5.43/7177: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.7.45/7223: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.6.46/7237: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.8.47/7244: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.9.53/7283: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.1.55/7329: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.3.58/7353: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.0.57/7355: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.2.63/7391: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.5.66/7448: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.7.67/7480: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.8.68/7482: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.6.73/7525: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.9.76/7562: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.0.79/7604: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.1.78/7606: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.3.82/7638: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.2.86/7665: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.5.88/7726: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.7.89/7731: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 1 lock held by syz.8.92/7761: #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888143fa5198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 3 locks held by syz-executor/7769: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 7774 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:kasan_byte_accessible+0x18/0x30 mm/kasan/generic.c:212 Code: 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 0f b6 07 <3c> 07 0f 96 c0 e9 4e a8 08 09 66 66 2e 0f 1f 84 00 00 00 00 00 0f RSP: 0000:ffffc9000cdb7918 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8b79a14e RDI: ffffed100c82fc87 RBP: ffff88806417e438 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8b79a14e R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 00007ff7eb90dc80(0000) GS:ffff8881245d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff7eb9fe300 CR3: 00000000a33ab000 CR4: 00000000003526f0 Call Trace: __kasan_check_byte+0x13/0x50 mm/kasan/common.c:573 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire kernel/locking/lockdep.c:5842 [inline] lock_acquire+0xf5/0x330 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:403 pte_offset_map_lock include/linux/mm.h:3365 [inline] filemap_map_pages+0x417/0x2110 mm/filemap.c:3903 do_fault_around mm/memory.c:5716 [inline] do_read_fault mm/memory.c:5749 [inline] do_fault+0x9e5/0x1990 mm/memory.c:5892 do_pte_missing mm/memory.c:4404 [inline] handle_pte_fault mm/memory.c:6276 [inline] __handle_mm_fault+0x1807/0x2b50 mm/memory.c:6414 handle_mm_fault+0x36d/0xa20 mm/memory.c:6583 do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7ff7eb9fe300 Code: Unable to access opcode bytes at 0x7ff7eb9fe2d6. RSP: 002b:00007ffe9626d9e8 EFLAGS: 00010206 RAX: 0000000000800000 RBX: 00007ffe9626d9f8 RCX: 0000000000001180 RDX: 00007ff7eba62cb0 RSI: 00007ffe9626d9f8 RDI: 0000000000000022 RBP: 00007ffe9626dce0 R08: 0000000000000040 R09: 000000000000000e R10: 00007ffe9626da10 R11: 0000000000000246 R12: fffffffffffffff8 R13: 000000b8a834a2da R14: 0000000000000000 R15: 00007ff7ebcb8310