syzbot

INFO: task syz.2.4206:23561 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.4206      state:D stack:27976 pid:23561 tgid:23560 ppid:5817   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x1139/0x6150 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6960
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776
 nfsd_nl_threads_get_doit+0x1c6/0x7c0 fs/nfsd/nfsctl.c:1672
 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592
 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646
 __sys_sendmsg+0x16d/0x220 net/socket.c:2678
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa4aab8f749
RSP: 002b:00007fa4ab9b2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fa4aade5fa0 RCX: 00007fa4aab8f749
RDX: 0000000004008090 RSI: 0000200000000140 RDI: 0000000000000003
RBP: 00007fa4aac13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa4aade6038 R14: 00007fa4aade5fa0 R15: 00007ffefbd22da8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
7 locks held by kworker/1:1/44:
 #0: ffff888142af0948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 kernel/workqueue.c:3232
 #1: ffffc90000b47c90 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 kernel/workqueue.c:3233
 #2: ffff88802a20f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88802a20f198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x52f0 drivers/usb/core/hub.c:5899
 #3: ffff8880719a9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff8880719a9198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9e0 drivers/usb/core/hub.c:2336
 #4: ffff88807b221160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88807b221160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1104 [inline]
 #4: ffff88807b221160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x620 drivers/base/dd.c:1302
 #5: ffffffff8f960168 (input_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #5: ffffffff8f960168 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x184/0x4d0 drivers/input/input.c:2187
 #6: ffffffff8e3d4d78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 kernel/rcu/tree_exp.h:311
1 lock held by acpid/5172:
 #0: ffffffff8e3d4d78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343
2 locks held by kworker/u8:20/14545:
 #0: ffff88801e752148 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 kernel/workqueue.c:3232
 #1: ffffc90003637c90 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 kernel/workqueue.c:3233
2 locks held by syz.4.3816/22537:
 #0: ffffffff901e5210 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
 #1: ffffffff8e802048 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0xd5/0x1ae0 fs/nfsd/nfsctl.c:1880
4 locks held by udevd/22835:
 #0: ffff88807b6b5540 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12d0 fs/seq_file.c:182
 #1: ffff888085e81888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
 #2: ffff8880854f11e8 (kn->active#23){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff8880854f11e8 (kn->active#23){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
 #3: ffff8880719a9198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
 #3: ffff8880719a9198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
2 locks held by syz.2.4206/23561:
 #0: ffffffff901e5210 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
 #1: ffffffff8e802048 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_get_doit+0x1c6/0x7c0 fs/nfsd/nfsctl.c:1672
2 locks held by getty/27613:
 #0: ffff88814e4bd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9002268c2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 drivers/tty/n_tty.c:2211

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x133/0x180 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xe66/0x1180 kernel/hung_task.c:515
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:psi_flags_change+0x2e/0x1a0 kernel/sched/psi.c:896
Code: 00 00 00 fc ff df 41 55 4c 8d af 30 13 00 00 41 54 41 89 d4 4c 89 ea 55 48 c1 ea 03 48 89 fd 53 89 f3 48 83 ec 10 0f b6 04 02 <84> c0 74 08 3c 03 0f 8e 08 01 00 00 44 8b 85 30 13 00 00 45 85 e0
RSP: 0018:ffffc90000a08a48 EFLAGS: 00000086
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880b853ac80
RDX: 1ffff11005e43b96 RSI: 0000000000000000 RDI: ffff88802f21c980
RBP: ffff88802f21c980 R08: 1ffff110170a75b2 R09: 0000000000155cc0
R10: 1ffff11005e43947 R11: 0000000000000001 R12: 0000000000000004
R13: ffff88802f21dcb0 R14: 0000000000000001 R15: ffff88802f21c980
FS:  0000000000000000(0000) GS:ffff8881249fd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f90fc36f70 CR3: 0000000021681000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 psi_task_change+0xa0/0x540 kernel/sched/psi.c:917
 psi_enqueue kernel/sched/stats.h:166 [inline]
 enqueue_task+0x26d/0x550 kernel/sched/core.c:2096
 activate_task kernel/sched/core.c:2135 [inline]
 ttwu_do_activate+0x17d/0xab0 kernel/sched/core.c:3631
 ttwu_queue kernel/sched/core.c:3894 [inline]
 try_to_wake_up+0x7a1/0x1860 kernel/sched/core.c:4218
 kick_pool+0x2a0/0x7a0 kernel/workqueue.c:1279
 wq_worker_tick+0x302/0x470 kernel/workqueue.c:1502
 sched_tick+0x6bd/0x960 kernel/sched/core.c:5546
 update_process_times+0x19c/0x2d0 kernel/time/timer.c:2479
 tick_sched_handle kernel/time/tick-sched.c:298 [inline]
 tick_nohz_handler+0x506/0x720 kernel/time/tick-sched.c:319
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x64e/0xc40 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x397/0x8e0 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x10b/0x3c0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2037 [inline]
RIP: 0010:vprintk_emit+0x556/0x6b0 kernel/printk/printk.c:2425
Code: 00 4d 85 ed 0f 85 19 01 00 00 e8 15 d7 21 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 d3 d1 21 00 48 85 ed 0f 85 25 01 00 00 <e8> f5 d6 21 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00
RSP: 0018:ffffc90000b473a0 EFLAGS: 00000287
RAX: 0000000000062b27 RBX: 0000000000000054 RCX: ffffc90019ba2000
RDX: 0000000000100000 RSI: ffffffff819d0de5 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88801fee8b30 R12: 1ffff92000168e76
R13: 0000000000000200 R14: ffff88801e6b24c0 R15: ffffc90000b47468
 _printk+0xc7/0x100 kernel/printk/printk.c:2451
 dvb_usb_device_exit+0x413/0x580 drivers/media/usb/dvb-usb/dvb-usb-init.c:342
 pctv452e_usb_disconnect+0x1b4/0x230 drivers/media/usb/dvb-usb/pctv452e.c:1085
 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:571 [inline]
 device_remove+0x125/0x170 drivers/base/dd.c:563
 __device_release_driver drivers/base/dd.c:1282 [inline]
 device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1305
 bus_remove_device+0x22f/0x450 drivers/base/bus.c:616
 device_del+0x396/0x9f0 drivers/base/core.c:3878
 usb_disable_device+0x355/0x820 drivers/usb/core/message.c:1418
 usb_disconnect+0x2e1/0x9e0 drivers/usb/core/hub.c:2345
 hub_port_connect drivers/usb/core/hub.c:5407 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x1d84/0x52f0 drivers/usb/core/hub.c:5953
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>