INFO: task kworker/0:6:5399 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:6 state:D stack:20360 pid:5399 tgid:5399 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x1325/0x47e0 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7362
lbs_wait_for_firmware_load+0x11e/0x1e0 drivers/net/wireless/marvell/libertas/firmware.c:117
lbs_remove_card+0x84/0x390 drivers/net/wireless/marvell/libertas/main.c:913
if_usb_disconnect+0xc5/0x270 drivers/net/wireless/marvell/libertas/if_usb.c:317
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:618 [inline]
device_remove+0x12a/0x18 drivers/base/dd.c:610
device_remove drivers/base/dd.c:618 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:610
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
usb_driver_release_interface drivers/usb/core/driver.c:643 [inline]
usb_forced_unbind_intf+0x1a4/0x240 drivers/usb/core/driver.c:1137
usb_reset_device+0x411/0xaa0 drivers/usb/core/hub.c:6417
if_usb_reset_device.isra.0+0x21e/0x290 drivers/net/wireless/marvell/libertas/if_usb.c:400
if_usb_prog_firmware+0x626/0xef0 drivers/net/wireless/marvell/libertas/if_usb.c:889
lbs_fw_loaded drivers/net/wireless/marvell/libertas/firmware.c:23 [inline]
helper_firmware_cb drivers/net/wireless/marvell/libertas/firmware.c:80 [inline]
helper_firmware_cb+0x1f7/0x2d0 drivers/net/wireless/marvell/libertas/firmware.c:64
request_firmware_work_func+0x13f/0x440 drivers/base/firmware_loader/main.c:1164
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task kworker/0:4:10425 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4 state:D stack:27936 pid:10425 tgid:10425 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x1325/0x47e0 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7362
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xcbf/0x1bc0 kernel/locking/mutex.c:821
device_lock include/linux/device.h:1104 [inline]
device_del+0xa0/0x9b0 drivers/base/core.c:3927
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2350
hub_port_connect drivers/usb/core/hub.c:5420 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event+0x1d46/0x4510 drivers/usb/core/hub.c:5966
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
locks held by pr/ttyS0/15: 1, last CPU#0:
#0: ffffffff898d0c78 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
#0: ffffffff898d0c78 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline]
#0: ffffffff898d0c78 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291
locks held by khungtaskd/31: 1, last CPU#0:
#0: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6793
locks held by kworker/1:2/2383: 6, on CPU#1:
#0: ffff888102ac8d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc9000543fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffff888107bf51d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff888107bf51d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912
#3: ffff88813d0b41d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff88813d0b41d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
#4: ffff88811aaca1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff88811aaca1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
#5: ffff888122a29010 (&d->i2c_mutex){+.+.}-{4:4}, at: technisat_usb2_set_led.isra.0+0x109/0x4a0 drivers/media/usb/dvb-usb/technisat-usb2.c:262
locks held by getty/2926: 2, on CPU#0:
#0: ffff8881012d90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by kworker/1:3/5233: 5, on CPU#1:
#0: ffff888102ac8d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc9000267fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffff888109bf51d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff888109bf51d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912
#3: ffff88810cbd51d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff88810cbd51d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
#4: ffff88813c9551a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff88813c9551a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
locks held by kworker/1:4/5236: 6, on CPU#1:
#0: ffff888102ac8d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc9000269fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffff888109bd51d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff888109bd51d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912
#3: ffff88810a363560 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3265 [inline]
#3: ffff88810a363560 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5477 [inline]
#3: ffff88810a363560 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
#3: ffff88810a363560 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5884 [inline]
#3: ffff88810a363560 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2c08/0x4510 drivers/usb/core/hub.c:5966
#4: ffff888109b95860 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5478 [inline]
#4: ffff888109b95860 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
#4: ffff888109b95860 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5884 [inline]
#4: ffff888109b95860 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2c31/0x4510 drivers/usb/core/hub.c:5966
#5: ffffffff8a543688 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1d20 drivers/usb/core/hub.c:3080
locks held by udevd/5330: 4, on CPU#1:
#0: ffff8881258fe998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
#1: ffff88811ad03c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:165
#2: ffff888112245d28 (kn->active#9){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff888112245d28 (kn->active#9){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:166
#3: ffff88813d0b41d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline]
#3: ffff88813d0b41d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
locks held by kworker/0:6/5399: 3, on CPU#0:
#0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc9000264fd18 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffff88811c03b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff88811c03b1a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#2: ffff88811c03b1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369
locks held by kworker/0:4/10425: 5, on CPU#0:
#0: ffff888102ac8d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc90012f37d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffff88810a7261d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff88810a7261d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912
#3: ffff8881087241d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff8881087241d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2341
#4: ffff88811c03b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff88811c03b1a0 (&dev->mutex){....}-{4:4}, at: device_del+0xa0/0x9b0 drivers/base/core.c:3927
locks held by syz.3.1603/11218: 2, last CPU#1:
#0: ffff88811c4d03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline]
#0: ffff88811c4d03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299
#1: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff898e49a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 11218 Comm: syz.3.1603 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4884 [inline]
RIP: 0010:__lock_acquire+0x269/0x1ec0 kernel/locking/lockdep.c:5203
Code: 84 ef 01 00 00 0f b6 7b 21 40 84 ff 0f 88 b8 05 00 00 0f b6 80 c5 00 00 00 45 8b 8c 24 58 0b 00 00 84 c0 44 0f 45 f8 44 89 c8 <83> e8 01 0f 88 7f 0f 00 00 48 63 d0 48 8d 14 92 49 8d 94 d4 60 0b
RSP: 0018:ffffc90015aa7348 EFLAGS: 00000002
RAX: 0000000000000003 RBX: ffff88811c2be698 RCX: 0000000000000000
RDX: 000000000000001e RSI: ffff88811c2be670 RDI: 0000000000000000
RBP: 000000000000001e R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000001 R12: ffff88811c2bdac0
R13: 0000000000020000 R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8882684eb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558d6594e8 CR3: 0000000117072000 CR4: 00000000003506f0
Call Trace:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:947 [inline]
pfn_valid+0xd8/0x4b0 include/linux/mmzone.h:2266
page_table_check_clear+0x21/0x540 mm/page_table_check.c:70
__page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155
page_table_check_pte_clear include/linux/page_table_check.h:55 [inline]
ptep_get_and_clear arch/x86/include/asm/pgtable.h:1243 [inline]
ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1261 [inline]
clear_full_ptes include/linux/pgtable.h:939 [inline]
zap_present_folio_ptes mm/memory.c:1730 [inline]
zap_present_ptes mm/memory.c:1799 [inline]
do_zap_pte_range mm/memory.c:1901 [inline]
zap_pte_range mm/memory.c:2003 [inline]
zap_pmd_range mm/memory.c:2089 [inline]
zap_pud_range mm/memory.c:2117 [inline]
zap_p4d_range mm/memory.c:2138 [inline]
__zap_vma_range+0x2187/0x4000 mm/memory.c:2178
unmap_vmas+0x299/0x5f0 mm/memory.c:2247
exit_mmap+0x1ef/0xa00 mm/mmap.c:1315
__mmput kernel/fork.c:1193 [inline]
mmput+0xe0/0x430 kernel/fork.c:1216
exit_mm kernel/exit.c:614 [inline]
do_exit+0x833/0x2a50 kernel/exit.c:996
do_group_exit+0xd5/0x2a0 kernel/exit.c:1151
get_signal+0x1ec7/0x21e0 kernel/signal.c:3039
arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd00984ddeb
Code: Unable to access opcode bytes at 0x7fd00984ddc1.
RSP: 002b:00007fd0082a4f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007fd00984ddeb
RDX: 00007fd0082a5fd0 RSI: 0000000080085502 RDI: 0000000000000003
RBP: 00007fd0082a5fd0 R08: 0000000000000008 R09: 00007fd0082a4fc8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502
R13: 0000000800000000 R14: 0000000000000008 R15: 00007fd0099038e2