INFO: task kworker/1:7:6003 blocked for more than 155 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:7 state:D stack:23784 pid:6003 tgid:6003 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: events request_firmware_work_func
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
device_lock include/linux/device.h:1102 [inline]
ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline]
ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279
request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
5 locks held by kworker/1:0/24:
3 locks held by kworker/1:1/29:
1 lock held by khungtaskd/32:
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/0:2/89:
#0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline]
#2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279
1 lock held by dhcpcd/5281:
#0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 net/ipv6/addrconf.c:5062
2 locks held by kworker/1:3/5352:
2 locks held by getty/5374:
#0: ffff888035eef0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
3 locks held by kworker/u8:4/5746:
#0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4229
5 locks held by kworker/1:6/6000:
3 locks held by kworker/1:7/6003:
#0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline]
#2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279
4 locks held by udevd/6133:
#0: ffff88804e1cbab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183
#1: ffff88807af72480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165
#2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166
#3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline]
#3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
2 locks held by kworker/1:8/6134:
6 locks held by kworker/1:9/6185:
3 locks held by kworker/u8:13/6606:
#0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
2 locks held by kworker/1:10/6988:
3 locks held by kworker/1:11/7015:
8 locks held by kworker/u8:14/7063:
#0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffffffff9001e788 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:673
#3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline]
#3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:557
#4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline]
#4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline]
#4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:557
#5: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 drivers/net/netdevsim/netdev.c:1191
#6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2847 [inline]
#6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
#6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x11d0/0x2150 net/core/dev.c:12433
#7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
2 locks held by syz-executor/7073:
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
1 lock held by syz-executor/7077:
#0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
2 locks held by syz-executor/7081:
#0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
2 locks held by syz-executor/7084:
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
2 locks held by syz-executor/7088:
#0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
2 locks held by syz-executor/7090:
#0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: events psi_avgs_work
RIP: 0010:__lock_acquire+0x271/0x2cf0 kernel/locking/lockdep.c:-1
Code: 13 6e 03 4c 8b 5c 24 18 44 8b 14 24 45 89 f9 48 8b 74 24 20 48 83 bc 24 20 01 00 00 00 0f 85 c8 fe ff ff 8b bc 24 38 01 00 00 <4c> 8b 84 24 28 01 00 00 4d 8d be a0 0b 00 00 83 fd 31 48 89 74 24
RSP: 0018:ffffc90000a08178 EFLAGS: 00000046
RAX: 00000000000000af RBX: 0000000000000000 RCX: ffffffff9415c510
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000
R13: 0000000000000002 R14: ffff88801ee81f00 R15: 0000000000000046
FS: 0000000000000000(0000) GS:ffff888125050000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdd70a21ac0 CR3: 000000004ff60000 CR4: 0000000000350ef0
Call Trace:
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:840 [inline]
class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489
_kmalloc_noprof include/linux/slab.h:988 [inline]
dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1277
usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1542
ath9k_hif_usb_rx_cb+0x11de/0x1590 drivers/net/wireless/ath/ath9k/hif_usb.c:721
__usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1657
dummy_timer+0xac3/0x4b40 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:get_recent_times kernel/sched/psi.c:275 [inline]
RIP: 0010:collect_percpu_times+0x277/0xc60 kernel/sched/psi.c:385
Code: 42 c7 44 30 08 00 00 00 00 ba 20 00 00 00 48 8d bc 24 00 01 00 00 31 f6 e8 a6 ac 93 00 48 8b 84 24 80 00 00 00 42 80 3c 30 00 <74> 08 4c 89 ff e8 bf a9 93 00 48 8b 44 24 08 83 e0 07 49 8b 1f 4c
RSP: 0018:ffffc90000a67920 EFLAGS: 00000246
RAX: 1ffff1100ed91813 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000020 RSI: 0000000000000000 RDI: ffffc90000a67a40
RBP: ffffc90000a67aa8 R08: ffffc90000a67a3f R09: ffffc90000a67a20
R10: dffffc0000000000 R11: fffff5200014cf48 R12: 0000000000000000
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888076c8c098
psi_avgs_work+0x63/0x170 kernel/sched/psi.c:592
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245