INFO: task kworker/1:2:780 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2 state:D stack:20472 pid:780 tgid:780 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5387 [inline]
__schedule+0xf89/0x4840 kernel/sched/core.c:7188
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:820
class_mutex_constructor include/linux/mutex.h:253 [inline]
usb_audio_probe+0x385/0x3b60 sound/usb/card.c:952
usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task kworker/0:7:5491 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:7 state:D stack:21144 pid:5491 tgid:5491 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:5387 [inline]
__schedule+0xf89/0x4840 kernel/sched/core.c:7188
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:820
class_mutex_constructor include/linux/mutex.h:253 [inline]
usb_audio_probe+0x385/0x3b60 sound/usb/card.c:952
usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff896de8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff896de8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff896de8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:2/780:
#0: ffff888105ea4140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc900030bfd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2: ffff88810c7511d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88810c7511d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff8881243031d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff8881243031d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#4: ffff88811f1001a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff88811f1001a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: usb_audio_probe+0x385/0x3b60 sound/usb/card.c:952
6 locks held by kworker/0:2/1128:
2 locks held by getty/2922:
#0: ffff8881167330a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211
4 locks held by udevd/5217:
#0: ffff8881362c4758 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
#1: ffff88812021d880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
#2: ffff8881247ec3c8 (kn->active#24){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff8881247ec3c8 (kn->active#24){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
#3: ffff88811ce421d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1045 [inline]
#3: ffff88811ce421d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
4 locks held by udevd/5276:
#0: ffff88811acbc878 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
#1: ffff88811f793c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
#2: ffff88813dcf34b8 (kn->active#24){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88813dcf34b8 (kn->active#24){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
#3: ffff88813a2be1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1045 [inline]
#3: ffff88813a2be1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
6 locks held by kworker/0:7/5491:
#0: ffff888105ea4140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc90004477d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2: ffff88810c7691d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88810c7691d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff8881202a51d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff8881202a51d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#4: ffff8881191b91a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff8881191b91a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: usb_audio_probe+0x385/0x3b60 sound/usb/card.c:952
4 locks held by udevd/7759:
#0: ffff88811ef2a518 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
#1: ffff88811b521080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
#2: ffff88813653b3c8 (kn->active#24){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88813653b3c8 (kn->active#24){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
#3: ffff8881202a51d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1045 [inline]
#3: ffff8881202a51d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
2 locks held by kworker/0:3/8074:
#0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc90013b4fd18 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
6 locks held by kworker/0:0/14719:
#0: ffff888105ea4140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc90004377d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2: ffff88810c3e11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88810c3e11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88813a2be1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff88813a2be1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#4: ffff88813d4141a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff88813d4141a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#5: ffffffff8aa1b8a0 (register_mutex#3){+.+.}-{4:4}, at: usb_audio_probe+0x385/0x3b60 sound/usb/card.c:952
5 locks held by kworker/1:8/15425:
#0: ffff888105ea4140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc9001543fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2: ffff88810cb011d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88810cb011d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff8881241261d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff8881241261d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336
#4: ffff88811be3e1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff88811be3e1a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
#4: ffff88811be3e1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1372
2 locks held by syz.1.3548/19876:
3 locks held by sed/19891:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 2860 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:iterate_chain_key kernel/locking/lockdep.c:453 [inline]
RIP: 0010:__lock_acquire+0x580/0x2630 kernel/locking/lockdep.c:5225
Code: f7 c1 c2 10 41 89 f8 31 c2 89 d0 29 d6 01 fa c1 c8 0d 31 c6 89 f0 41 29 f0 01 f2 c1 c0 04 89 d2 44 31 c0 48 c1 e0 20 48 09 d0 <49> 89 c7 4d 85 e4 74 46 8b 85 40 0b 00 00 4c 8d b5 48 0b 00 00 45
RSP: 0018:ffffc9000146f838 EFLAGS: 00000006
RAX: 0ac0d5affe09d4ff RBX: ffff888117330b48 RCX: 0000000000000000
RDX: 00000000fe09d4ff RSI: 0000000068c1bacb RDI: 00000000ef9d33e4
RBP: ffff888117330000 R08: 0000000086db7919 R09: 0000000000000007
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000007 R14: 0000000000020000 R15: 0000000000000005
FS: 00007fece7bfa880(0000) GS:ffff8882686a8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f58d9d52480 CR3: 0000000117f10000 CR4: 00000000003506f0
Call Trace:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6246 [inline]
kmem_cache_free+0x108/0x660 mm/slub.c:6373
security_file_free+0x65/0xa0 security/security.c:2442
file_free fs/file_table.c:97 [inline]
__fput+0x553/0xb50 fs/file_table.c:523
fput_close_sync+0x118/0x250 fs/file_table.c:615
__do_sys_close fs/open.c:1507 [inline]
__se_sys_close fs/open.c:1492 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1492
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fece7d56a67
Code: 44 00 00 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 01 31 c9 e8 ca 19 f9 ff 48 83 c4 18 c3 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 61 b3 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffd91705778 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 000055f44de81ff0 RCX: 00007fece7d56a67
RDX: 00000000000272d1 RSI: 00007fece7e32b20 RDI: 000000000000000d
RBP: 000055f44de3c070 R08: 000000000001f290 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000202 R12: 000055f44de409c0
R13: 00000000000000ff R14: 000055f439d18be0 R15: 00007ffd917059f0