syzbot

 sign-in | mailing list | source | docs
🐞 Open [920]
🐞 Fixed [143]
🐞 Invalid [1140]
⬇ Missing Backports [73]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in __lru_add_drain_all (3)

Status: upstream: reported on 2026/03/10 22:55
Reported-by: syzbot+7071e1cb807dc51207d5@syzkaller.appspotmail.com
First crash: 95d, last: 28d
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in __lru_add_drain_all (3) 1 5 22d 43d 0/3 upstream: reported on 2026/05/01 08:27
linux-6.6 INFO: task hung in __lru_add_drain_all 1 1 222d 222d 0/2 auto-obsoleted due to no activity on 2026/02/12 06:31
android-6-12 INFO: task hung in __lru_add_drain_all (2) 1 1 23d 23d 0/1 premoderation: reported on 2026/05/21 15:31
linux-6.1 INFO: task hung in __lru_add_drain_all (2) 1 1 377d 377d 0/3 auto-obsoleted due to no activity on 2025/09/09 22:30
linux-5.15 INFO: task hung in __lru_add_drain_all 1 1 1148d 1148d 0/3 auto-obsoleted due to no activity on 2023/08/21 02:18
linux-6.1 INFO: task hung in __lru_add_drain_all 1 1 757d 757d 0/3 auto-obsoleted due to no activity on 2024/08/25 20:43
upstream INFO: task hung in __lru_add_drain_all (2) mm 1 syz error 272 419d 757d 0/29 auto-obsoleted due to no activity on 2025/06/29 18:01
upstream INFO: task hung in __lru_add_drain_all net 1 C done error 71 944d 1744d 0/29 auto-obsoleted due to no activity on 2024/02/20 10:46
linux-5.15 INFO: task hung in __lru_add_drain_all (2) 1 1 688d 688d 0/3 auto-obsoleted due to no activity on 2024/11/03 03:56
android-6-12 INFO: task hung in __lru_add_drain_all 1 1 222d 222d 0/1 auto-obsoleted due to no activity on 2026/02/01 19:21

Sample crash report:
INFO: task khugepaged:34 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:khugepaged      state:D stack:27728 pid:34    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138
 __flush_work+0x952/0xae0 kernel/workqueue.c:3076
 __lru_add_drain_all+0x6a0/0x800 mm/swap.c:910
 khugepaged_do_scan mm/khugepaged.c:2453 [inline]
 khugepaged+0x183/0x19a0 mm/khugepaged.c:2522
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task udevd:4266 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:26064 pid:4266  ppid:3637   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747
 device_lock include/linux/device.h:840 [inline]
 uevent_show+0x16c/0x320 drivers/base/core.c:2669
 dev_attr_show+0x50/0xb0 drivers/base/core.c:2372
 sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59
 seq_read_iter+0x49b/0xd50 fs/seq_file.c:230
 call_read_iter include/linux/fs.h:2259 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x4a7/0xa00 fs/read_write.c:470
 ksys_read+0x14c/0x250 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd64a8a7407
RSP: 002b:00007fff906a5d10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fd64af87880 RCX: 00007fd64a8a7407
RDX: 0000000000001000 RSI: 00005621e30eda00 RDI: 0000000000000008
RBP: 00007fd64a9efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fd64a9efea0 R14: 0000000000000000 R15: 00005621e31183c0
 </TASK>
INFO: task kworker/u4:6:4336 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:6    state:D stack:25520 pid:4336  ppid:2      flags:0x00004000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747
 linkwatch_event+0xa/0x50 net/core/link_watch.c:263
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task syz.2.732:7003 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.732       state:D stack:25424 pid:7003  ppid:4275   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977
 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580
 evdev_detach_client drivers/input/evdev.c:386 [inline]
 evdev_release+0x1f3/0x800 drivers/input/evdev.c:449
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f150e79ce59
RSP: 002b:00007ffd04e21848 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffd04e21930 RCX: 00007f150e79ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000046bbc R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2ef20000 R11: 0000000000000246 R12: 00007ffd04e21970
R13: 00007f150ea15fac R14: 0000000000047513 R15: 00007f150ea15fa0
 </TASK>
INFO: task syz.1.736:7011 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.736       state:D stack:25936 pid:7011  ppid:4274   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline]
 synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962
 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580
 evdev_detach_client drivers/input/evdev.c:386 [inline]
 evdev_release+0x1f3/0x800 drivers/input/evdev.c:449
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0x982/0x2480 kernel/exit.c:881
 do_group_exit+0x217/0x2d0 kernel/exit.c:1023
 get_signal+0x1272/0x1350 kernel/signal.c:2871
 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2f7335d68e
RSP: 002b:00007ffe6fba35d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: 0000000000000000 RBX: 0000555572ef3500 RCX: 00007f2f7335d68e
RDX: 00007ffe6fba3630 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f2f73617da0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000047de2
R13: 00007f2f7361609c R14: 0000000000047229 R15: 00007ffe6fba3760
 </TASK>
INFO: task syz.0.737:7013 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.737       state:D stack:26064 pid:7013  ppid:4282   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747
 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
 synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580
 lockdep_unregister_key+0x4d2/0x550 kernel/locking/lockdep.c:6374
 __qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081
 netdev_for_each_tx_queue include/linux/netdevice.h:2465 [inline]
 dev_shutdown+0x92/0x440 net/sched/sch_generic.c:1465
 unregister_netdevice_many_notify+0xa76/0x19c0 net/core/dev.c:11014
 unregister_netdevice_many net/core/dev.c:11077 [inline]
 unregister_netdevice_queue+0x328/0x370 net/core/dev.c:10960
 unregister_netdevice include/linux/netdevice.h:3075 [inline]
 __tun_detach+0xd4a/0x1500 drivers/net/tun.c:685
 tun_detach drivers/net/tun.c:701 [inline]
 tun_chr_close+0x109/0x1b0 drivers/net/tun.c:3492
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f15ecb9ce59
RSP: 002b:00007ffde9651688 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffde9651770 RCX: 00007f15ecb9ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000046d76 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2ed20000 R11: 0000000000000246 R12: 00007ffde96517b0
R13: 00007f15ece15fac R14: 0000000000046de8 R15: 00007f15ece15fa0
 </TASK>
INFO: task syz.4.739:7020 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.739       state:D stack:26832 pid:7020  ppid:4280   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747
 ethnl_default_dumpit+0x95/0xed0 net/ethtool/netlink.c:477
 netlink_dump+0x6a3/0xd00 net/netlink/af_netlink.c:2236
 __netlink_dump_start+0x537/0x6f0 net/netlink/af_netlink.c:2338
 genl_family_rcv_msg_dumpit+0x323/0x3c0 net/netlink/genetlink.c:714
 genl_family_rcv_msg net/netlink/genetlink.c:830 [inline]
 genl_rcv_msg+0x5cb/0x790 net/netlink/genetlink.c:850
 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5be/0x970 net/socket.c:2518
 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572
 __sys_sendmsg net/socket.c:2601 [inline]
 __do_sys_sendmsg net/socket.c:2610 [inline]
 __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3d3a99ce59
RSP: 002b:00007f3d38bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f3d3ac16180 RCX: 00007f3d3a99ce59
RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000005
RBP: 00007f3d3aa32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d3ac16218 R14: 00007f3d3ac16180 R15: 00007fff848c7b48
 </TASK>
INFO: task syz.3.740:7026 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.740       state:D stack:29168 pid:7026  ppid:4285   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
 schedule+0xb9/0x180 kernel/sched/core.c:6638
 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline]
 synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962
 lru_cache_disable+0x22/0x30 mm/swap.c:953
 do_mbind mm/mempolicy.c:1297 [inline]
 kernel_mbind mm/mempolicy.c:1481 [inline]
 __do_sys_mbind mm/mempolicy.c:1558 [inline]
 __se_sys_mbind+0x483/0x810 mm/mempolicy.c:1554
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe42e79ce59
RSP: 002b:00007fe42f5bc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed
RAX: ffffffffffffffda RBX: 00007fe42ea16090 RCX: 00007fe42e79ce59
RDX: 0000000000000001 RSI: 0000000000800000 RDI: 0000200000001000
RBP: 00007fe42e832d6f R08: 0000000000000000 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe42ea16128 R14: 00007fe42ea16090 R15: 00007fff3b039ea8
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:0/7:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc900000c7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8cb2e770 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8cb2ef90 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
3 locks held by kworker/0:1/14:
 #0: ffff88802eddb538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90000137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4672
1 lock held by khungtaskd/28:
 #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513
1 lock held by khugepaged/34:
 #0: ffffffff8cbd4ea8 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x800 mm/swap.c:865
4 locks held by kworker/u5:0/48:
 #0: ffff88801d281138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90000b97d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320d4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
2 locks held by getty/4034:
 #0: ffff88814d79b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 drivers/tty/n_tty.c:2198
4 locks held by udevd/4266:
 #0: ffff88801e3dbe80 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xad/0xd50 fs/seq_file.c:182
 #1: ffff888028b99488 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x58/0x410 fs/kernfs/file.c:172
 #2: ffff88814724b008 (kn->active#5){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff88814724b008 (kn->active#5){++++}-{0:0}, at: kernfs_seq_start+0xae/0x410 fs/kernfs/file.c:173
 #3: ffff88807bacd190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:840 [inline]
 #3: ffff88807bacd190 (&dev->mutex){....}-{3:3}, at: uevent_show+0x16c/0x320 drivers/base/core.c:2669
4 locks held by kworker/u5:1/4276:
 #0: ffff88801fb94938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90003f87d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320e4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:2/4279:
 #0: ffff8880559e1938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90003fd7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320d0428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:3/4281:
 #0: ffff888052f70138 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90003fe7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320c4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
3 locks held by syz-executor/4285:
 #0: ffff88805c0f5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:526 [inline]
 #0: ffff88805c0f5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x20e/0x500 net/bluetooth/hci_core.c:2731
 #1: ffff88805c0f4428 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x45b/0xf40 net/bluetooth/hci_sync.c:5234
 #2: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1829 [inline]
 #2: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xac/0x290 net/bluetooth/hci_conn.c:2504
4 locks held by kworker/u5:5/4288:
 #0: ffff888054b1b938 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90004037d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320dc428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:6/4289:
 #0: ffff888056a37138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90004047d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320e0428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:7/4290:
 #0: ffff888072db7138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90004057d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320c8428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:8/4291:
 #0: ffff8880788e7138 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90004067d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff88801ff2c428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
3 locks held by kworker/u4:6/4336:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc90004647d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
6 locks held by kworker/1:8/4947:
1 lock held by syz.2.732/7003:
 #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
 #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962
2 locks held by syz.0.737/7013:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3492
 #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
 #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
3 locks held by syz.4.739/7020:
 #0: ffffffff8dda8b10 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
 #1: ffff88807a8e0698 (nlk_cb_mutex-GENERIC){+.+.}-{3:3}, at: __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305
 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_dumpit+0x95/0xed0 net/ethtool/netlink.c:477
1 lock held by syz-executor/7029:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7034:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7036:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7038:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7041:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by dhcpcd/7043:
 #0: ffff88807bcee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff88807bcee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by dhcpcd/7044:
 #0: ffff888079672130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff888079672130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by dhcpcd/7045:
 #0: ffff888073834130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff888073834130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by dhcpcd/7046:
 #0: ffff88805496e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff88805496e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by dhcpcd/7047:
 #0: ffff8880794d4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff8880794d4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by dhcpcd/7048:
 #0: ffff888026c7a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #0: ffff888026c7a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249
1 lock held by syz-executor/7050:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7055:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7057:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7059:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7062:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7065:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7070:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
4 locks held by kworker/u5:9/7071:
 #0: ffff88801a66b138 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc9000604fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff88808e63c428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/7073:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
1 lock held by syz-executor/7074:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154
4 locks held by kworker/u5:10/7076:
 #0: ffff8880559ef938 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc9000bf8fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880320e8428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:11/7077:
 #0: ffff88807d17c938 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #1: ffffc9000bf9fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
 #2: ffff8880779f4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline]
 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/7081:
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xeee/0xf30 kernel/hung_task.c:377
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4947 Comm: kworker/1:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:check_kcov_mode kernel/kcov.c:193 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60 kernel/kcov.c:216
Code: 84 e8 7f 7e 65 8b 15 85 e8 7f 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 1c 16 00 00 00 74 2c 8b 91 f8 15 00 00 <83> fa 02 75 21 48 8b 91 00 16 00 00 48 8b 32 48 8d 7e 01 8b 89 fc
RSP: 0018:ffffc9000cbaeb18 EFLAGS: 00000246
RAX: ffffffff881dbe1c RBX: ffff88807e74610d RCX: ffff8880274f9dc0
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000020
RBP: ffffc9000cbaed20 R08: ffff8880274f9dc0 R09: 0000000000000020
R10: 00000000000000bc R11: 0000000000000002 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000006f5
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005622bf339000 CR3: 000000000c88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 convert_chmap_v3 sound/usb/stream.c:359 [inline]
 snd_usb_get_audioformat_uac3 sound/usb/stream.c:1028 [inline]
 __snd_usb_parse_audio_interface+0x343c/0x4b00 sound/usb/stream.c:1202
 snd_usb_parse_audio_interface+0x36/0xb0 sound/usb/stream.c:1274
 snd_usb_create_stream+0x3ec/0x610 sound/usb/card.c:209
 snd_usb_create_streams sound/usb/card.c:330 [inline]
 usb_audio_probe+0x130b/0x1d90 sound/usb/card.c:892
 usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2aa/0xc70 drivers/base/dd.c:639
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3697
 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2aa/0xc70 drivers/base/dd.c:639
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3697
 usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/16 16:50 linux-6.1.y c27210688955 a15a64a6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in __lru_add_drain_all
2026/04/27 20:17 linux-6.1.y 7c87defbd336 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in __lru_add_drain_all
2026/04/26 23:22 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in __lru_add_drain_all
2026/04/13 09:20 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in __lru_add_drain_all
2026/03/10 22:54 linux-6.1.y f2ddafa93a25 4683d576 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in __lru_add_drain_all
* Struck through repros no longer work on HEAD.