INFO: task kworker/1:2:48 blocked for more than 143 seconds.
Not tainted 6.10.0-syzkaller-g3c3ff7be9729 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2 state:D
stack:22192 pid:48 tgid:48 ppid:2 flags:0x00004000
Workqueue: events fqdir_free_fn
Call Trace:
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0xcda/0x2f80 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6621
schedule_timeout+0x258/0x2a0 kernel/time/timer.c:2557
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3de/0x5f0 kernel/sched/completion.c:116
rcu_barrier+0x323/0x6c0 kernel/rcu/tree.c:4554
fqdir_free_fn+0x32/0x160 net/ipv4/inet_fragment.c:167
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
INFO: task udevd:18998 blocked for more than 143 seconds.
Not tainted 6.10.0-syzkaller-g3c3ff7be9729 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D
stack:24720 pid:18998 tgid:18998 ppid:2404 flags:0x00000002
Call Trace:
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0xcda/0x2f80 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6621
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
device_lock include/linux/device.h:1009 [inline]
uevent_show+0x188/0x3b0 drivers/base/core.c:2743
dev_attr_show+0x53/0xe0 drivers/base/core.c:2437
sysfs_kf_seq_show+0x23e/0x410 fs/sysfs/file.c:59
seq_read_iter+0x4fa/0x12c0 fs/seq_file.c:230
kernfs_fop_read_iter+0x41a/0x590 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x869/0xbd0 fs/read_write.c:476
ksys_read+0x12f/0x260 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4f44c8cb6a
RSP: 002b:00007ffe78098048 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055c2aa497fe0 RCX: 00007f4f44c8cb6a
RDX: 0000000000001000 RSI: 000055c2aa492960 RDI: 0000000000000008
RBP: 000055c2aa497fe0 R08: 0000000000000008 R09: 0000000000000000
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000003fff R14: 00007ffe78098528 R15: 000000000000000a
INFO: task syz.4.846:23076 blocked for more than 144 seconds.
Not tainted 6.10.0-syzkaller-g3c3ff7be9729 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.846 state:R
running task
stack:28544 pid:23076 tgid:23074 ppid:21559 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0xcda/0x2f80 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6621
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678
rwsem_down_write_slowpath+0x539/0x12a0 kernel/locking/rwsem.c:1178
__down_write_common kernel/locking/rwsem.c:1306 [inline]
__down_write kernel/locking/rwsem.c:1315 [inline]
down_write+0x1d8/0x200 kernel/locking/rwsem.c:1580
kernfs_add_one+0xb1/0x520 fs/kernfs/dir.c:778
kernfs_create_dir_ns+0xf4/0x150 fs/kernfs/dir.c:1071
sysfs_create_dir_ns+0x13b/0x2b0 fs/sysfs/dir.c:59
create_dir lib/kobject.c:73 [inline]
kobject_add_internal+0x2c8/0x990 lib/kobject.c:240
kobject_add_varg lib/kobject.c:374 [inline]
kobject_init_and_add+0x11c/0x190 lib/kobject.c:457
bus_add_driver+0x186/0x690 drivers/base/bus.c:666
driver_register+0x15c/0x4b0 drivers/base/driver.c:246
usb_gadget_register_driver_owner+0xfd/0x2f0 drivers/usb/gadget/udc/core.c:1701
raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:595 [inline]
raw_ioctl+0x1737/0x2b90 drivers/usb/gadget/legacy/raw_gadget.c:1306
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3efe56575b
RSP: 002b:00007f3efd7c3f20 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f3efe56575b
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006
RBP: 00007f3efd7c4ff0 R08: 0000000000000010 R09: 00342e6364755f79
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3efd7c3fc0 R14: 00000000200000c0 R15: 00007f3efe820320
Showing all locks held in the system:
3 locks held by kworker/0:1/9:
#0:
ffff888100080948
((wq_completion)events
){+.+.}-{0:0}
, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000009fd80
((work_completion)(&fw_work->work)
){+.+.}-{0:0}
, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff8881097ed190
(
&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:1009 [inline]
, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1163 [inline]
, at: ath9k_hif_usb_firmware_cb+0x3b1/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1296
1 lock held by khungtaskd/30:
#0:
ffffffff886b61e0
(
rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:839 [inline]
, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6620
7 locks held by kworker/0:2/732:
1 lock held by udevd/2404:
2 locks held by getty/2462:
#0:
ffff888113f290a0
(
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000432f0
(&ldata->atomic_read_lock
){+.+.}-{3:3}
, at: n_tty_read+0xfc8/0x1490 drivers/tty/n_tty.c:2211
7 locks held by kworker/0:3/4783:
#0:
ffff8881052f4548
((wq_completion)usb_hub_wq
){+.+.}-{0:0}
, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1:
ffffc900021afd80
(
(work_completion)(&hub->events)
){+.+.}-{0:0}
, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2:
ffff888109b57190
(&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:1009 [inline]
, at: hub_event+0x1be/0x4f50 drivers/usb/core/hub.c:5849
#3:
ffff888132130190
(
&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:1009 [inline]
, at: __device_attach+0x7f/0x4b0 drivers/base/dd.c:1003
#4:
ffff8881390f8160
(&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:1009 [inline]
, at: __device_attach+0x7f/0x4b0 drivers/base/dd.c:1003
#5: ffffffff89302168
(input_mutex
){+.+.}-{3:3}
, at: input_register_device+0x997/0x1140 drivers/input/input.c:2466
#6: ffff888100aae948
(
&root->kernfs_rwsem
){++++}-{3:3}
, at: kernfs_add_one+0xb1/0x520 fs/kernfs/dir.c:778
5 locks held by kworker/1:3/4788:
6 locks held by kworker/0:4/4789:
1 lock held by syz-executor/18126:
4 locks held by udevd/18998:
#0:
ffff888120bdd0a0
(&p->lock
){+.+.}-{3:3}
, at: seq_read_iter+0xde/0x12c0 fs/seq_file.c:182
#1: ffff888113af4088
(
&of->mutex
#2
){+.+.}-{3:3}
, at: kernfs_seq_start+0x4d/0x240 fs/kernfs/file.c:154
#2:
ffff88812bbf73c8
(kn->active
#4
){++++}-{0:0}
, at: kernfs_seq_start+0x71/0x240 fs/kernfs/file.c:155
#3:
ffff888132130190
(&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:1009 [inline]
, at: uevent_show+0x188/0x3b0 drivers/base/core.c:2743
1 lock held by syz-executor/21559:
1 lock held by syz.0.839/23065:
#0:
ffffffff886c1978
(
rcu_state.exp_mutex
){+.+.}-{3:3}
, at: exp_funnel_lock+0x282/0x3b0 kernel/rcu/tree_exp.h:296
1 lock held by syz-executor/23068:
1 lock held by syz.2.844/23070:
1 lock held by syz.1.845/23073:
1 lock held by syz.4.846/23076:
1 lock held by syz-executor/23078:
1 lock held by syz-executor/23079:
1 lock held by syz-executor/23080:
#0:
ffff888100aae948
(
&root->kernfs_rwsem
){++++}-{3:3}
, at: kernfs_dop_revalidate+0xf0/0x5a0 fs/kernfs/dir.c:1159
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.10.0-syzkaller-g3c3ff7be9729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xf86/0x1240 kernel/hung_task.c:379
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Sending NMI from CPU 1 to CPUs 0:
yealink 5-1:36.0: unexpected response 0
yealink 5-1:36.0: urb_ctl_callback - urb status -71
NMI backtrace for cpu 0
CPU: 0 PID: 18126 Comm: syz-executor Not tainted 6.10.0-syzkaller-g3c3ff7be9729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:413
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d c3 cc cc cc cc e8 f1 b0 0a ff eb a0 e8 7a b1 0a
RSP: 0018:ffffc900000075c0 EFLAGS: 00000002
RAX: 0000000000000031 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff829d8d45 RDI: ffffffff8d769e60
RBP: ffffffff8d769e20 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000031 R14: ffffffff829d8ce0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000021000000 CR3: 0000000138d9c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
serial_out drivers/tty/serial/8250/8250.h:142 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3322 [inline]
serial8250_console_write+0xce7/0x1090 drivers/tty/serial/8250/8250_port.c:3393
console_emit_next_record kernel/printk/printk.c:2983 [inline]
console_flush_all+0x53c/0xd70 kernel/printk/printk.c:3049
console_unlock+0xae/0x290 kernel/printk/printk.c:3118
vprintk_emit kernel/printk/printk.c:2348 [inline]
vprintk_emit+0x11a/0x5a0 kernel/printk/printk.c:2303
dev_vprintk_emit drivers/base/core.c:4909 [inline]
dev_printk_emit+0xfb/0x140 drivers/base/core.c:4920
__dev_printk+0xf5/0x270 drivers/base/core.c:4932
_dev_err+0xe5/0x120 drivers/base/core.c:4975
urb_ctl_callback+0x1eb/0x2f0 drivers/input/misc/yealink.c:456
__usb_hcd_giveback_urb+0x466/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x17c3/0x38d0 drivers/usb/gadget/udc/dummy_hcd.c:1987
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x20c/0xcc0 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1815
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x8b/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_release+0x35/0x6f0 kernel/locking/lockdep.c:5767
Code: fc ff df 41 57 41 56 41 55 41 54 49 89 fc 55 53 48 81 ec 90 00 00 00 48 8d 5c 24 10 48 89 74 24 08 48 c7 44 24 10 b3 8a b5 41 <48> c1 eb 03 48 c7 44 24 18 10 89 fb 87 48 01 d8 48 c7 44 24 20 80
RSP: 0018:ffffc9000e6d7568 EFLAGS: 00000282
RAX: dffffc0000000000 RBX: ffffc9000e6d7578 RCX: ffffffff81aca8ee
RDX: ffff88811b478000 RSI: ffffffff81aca714 RDI: ffffffff886b6120
RBP: 000000000011bc55 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff886b6120
R13: 0000000000000008 R14: 0000000000000001 R15: ffffea00046f1540
rcu_lock_release include/linux/rcupdate.h:337 [inline]
rcu_read_unlock_sched include/linux/rcupdate.h:952 [inline]
pfn_valid include/linux/mmzone.h:2032 [inline]
page_table_check_clear mm/page_table_check.c:70 [inline]
__page_table_check_pte_clear+0x2d9/0x580 mm/page_table_check.c:169
page_table_check_pte_clear include/linux/page_table_check.h:49 [inline]
ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1284 [inline]
get_and_clear_full_ptes include/linux/pgtable.h:678 [inline]
zap_present_folio_ptes mm/memory.c:1481 [inline]
zap_present_ptes mm/memory.c:1564 [inline]
zap_pte_range mm/memory.c:1606 [inline]
zap_pmd_range mm/memory.c:1724 [inline]
zap_pud_range mm/memory.c:1753 [inline]
zap_p4d_range mm/memory.c:1774 [inline]
unmap_page_range+0x1cec/0x3370 mm/memory.c:1795
unmap_single_vma+0x194/0x2b0 mm/memory.c:1841
unmap_vmas+0x22f/0x490 mm/memory.c:1885
exit_mmap+0x1b8/0xb20 mm/mmap.c:3341
__mmput kernel/fork.c:1343 [inline]
mmput+0xdb/0x3e0 kernel/fork.c:1365
exit_mm kernel/exit.c:566 [inline]
do_exit+0x9bf/0x2b30 kernel/exit.c:864
do_group_exit+0xd3/0x2a0 kernel/exit.c:1026
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x147/0x260 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3a51a15451
Code: Unable to access opcode bytes at 0x7f3a51a15427.
RSP: 002b:00007ffd252403f0 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
RAX: fffffffffffffffe RBX: 0000000000000073 RCX: 00007f3a51a15451
RDX: 0000000000090800 RSI: 00007f3a51a83a0a RDI: 00000000ffffff9c
RBP: 00007ffd252404ac R08: 000000000003a2b6 R09: 00007f3a51b7a080
R10: 0000000000000000 R11: 0000000000000287 R12: 00007ffd25240520
R13: 0000000000000000 R14: 000000000012b52b R15: 000000000012ac26