INFO: task kworker/u4:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:0 state:D stack:23248 pid:9 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor:4276 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21776 pid:4276 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 namespace_unlock+0x23f/0x430 fs/namespace.c:1502 do_umount fs/namespace.c:1726 [inline] path_umount+0xf19/0xf90 fs/namespace.c:1809 ksys_umount fs/namespace.c:1832 [inline] __do_sys_umount fs/namespace.c:1837 [inline] __se_sys_umount fs/namespace.c:1835 [inline] __x64_sys_umount+0x12d/0x170 fs/namespace.c:1835 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff6da99e097 RSP: 002b:00007ffef21fd8b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007ff6daa321ca RCX: 00007ff6da99e097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef21fd970 RBP: 00007ffef21fd970 R08: 00007ffef21fe970 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef21fea00 R13: 00007ff6daa321ca R14: 0000000000017ff2 R15: 00007ffef21fea40 INFO: task syz.0.37:4479 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.37 state:D stack:26224 pid:4479 ppid:4272 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 packet_release+0x98f/0xc40 net/packet/af_packet.c:3213 __sock_release net/socket.c:654 [inline] sock_close+0xd5/0x240 net/socket.c:1399 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fbb7079ce59 RSP: 002b:00007fffd3c9b188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fbb70a17da0 RCX: 00007fbb7079ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fbb70a17da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00000000003ffb7c R11: 0000000000000246 R12: 00000000000177b5 R13: 00007fbb70a1609c R14: 0000000000017501 R15: 00007fbb70a16090 INFO: task kworker/u4:9:4487 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:9 state:D stack:27792 pid:4487 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.1.42:4496 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.42 state:D stack:25656 pid:4496 ppid:4271 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __flush_work+0x952/0xae0 kernel/workqueue.c:3076 __lru_add_drain_all+0x6a0/0x800 mm/swap.c:910 invalidate_bdev+0x8f/0xb0 block/bdev.c:86 ntfs_loadlog_and_replay+0x31a/0x4a0 fs/ntfs3/fsntfs.c:305 ntfs_fill_super+0x22f7/0x3fa0 fs/ntfs3/super.c:1047 get_tree_bdev+0x3f1/0x610 fs/super.c:1366 vfs_get_tree+0x88/0x270 fs/super.c:1573 do_new_mount+0x24a/0xa40 fs/namespace.c:3078 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3606 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1468d9e0ca RSP: 002b:00007f1469c36e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f1469c36ee0 RCX: 00007f1468d9e0ca RDX: 0000200000000080 RSI: 0000200000000240 RDI: 00007f1469c36ea0 RBP: 0000200000000080 R08: 00007f1469c36ee0 R09: 0000000002000000 R10: 0000000002000000 R11: 0000000000000246 R12: 0000200000000240 R13: 00007f1469c36ea0 R14: 000000000001f76f R15: 00002000000000c0 INFO: task syz.4.48:4514 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.48 state:D stack:25424 pid:4514 ppid:4288 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 pfkey_release+0x24f/0x310 net/key/af_key.c:185 __sock_release net/socket.c:654 [inline] sock_close+0xd5/0x240 net/socket.c:1399 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f0eb7b9ce59 RSP: 002b:00007fff80856ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f0eb7e17da0 RCX: 00007f0eb7b9ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f0eb7e17da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00000000005f0a18 R11: 0000000000000246 R12: 00000000000185a8 R13: 00007f0eb7e1609c R14: 0000000000018316 R15: 00007f0eb7e16090 INFO: task syz.3.52:4534 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.52 state:D stack:27856 pid:4534 ppid:4270 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 __lru_add_drain_all+0x66/0x800 mm/swap.c:865 madvise_collapse+0x193/0xc60 mm/khugepaged.c:2673 madvise_vma_behavior mm/madvise.c:1085 [inline] madvise_walk_vmas mm/madvise.c:1259 [inline] do_madvise+0x748/0x3490 mm/madvise.c:1438 __do_sys_madvise mm/madvise.c:1451 [inline] __se_sys_madvise mm/madvise.c:1449 [inline] __x64_sys_madvise+0xa2/0xb0 mm/madvise.c:1449 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f030af9ce59 RSP: 002b:00007f030bec9028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007f030b216270 RCX: 00007f030af9ce59 RDX: 0000000000000019 RSI: 0000000000600003 RDI: 0000200000000000 RBP: 00007f030b032d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f030b216308 R14: 00007f030b216270 R15: 00007ffd1a26abc8 INFO: task syz-executor:4538 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22640 pid:4538 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 hsr_add_port+0x3b9/0x750 net/hsr/hsr_slave.c:203 hsr_dev_finalize+0x3d9/0x840 net/hsr/hsr_device.c:675 hsr_newlink+0x637/0x6f0 net/hsr/hsr_netlink.c:102 rtnl_newlink_create net/core/rtnetlink.c:3427 [inline] __rtnl_newlink net/core/rtnetlink.c:3647 [inline] rtnl_newlink+0x151e/0x20a0 net/core/rtnetlink.c:3660 rtnetlink_rcv_msg+0x87c/0xfc0 net/core/rtnetlink.c:6157 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x497/0x650 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2160 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fba1bb5d68e RSP: 002b:00007fff3d6d4068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055556c46c500 RCX: 00007fba1bb5d68e RDX: 0000000000000058 RSI: 00007fba1c944670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fff3d6d40e4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fba1c944670 R15: 0000000000000000 Showing all locks held in the system: 2 locks held by kworker/u4:0/9: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900000e7d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2e770 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2ef90 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 6 locks held by kworker/1:0/22: 1 lock held by khungtaskd/27: #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 3 locks held by kworker/u4:4/1063: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004a5fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 2 locks held by getty/4028: #0: ffff88802fb53098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 drivers/tty/n_tty.c:2198 1 lock held by syz-executor/4276: #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 3 locks held by kworker/0:3/4282: #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90003ec7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8e/0xda0 net/wireless/reg.c:2499 3 locks held by kworker/0:5/4319: #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900040d7d00 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: crda_timeout_work+0x11/0x50 net/wireless/reg.c:539 3 locks held by kworker/0:9/4358: #0: ffff88802ec88938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004167d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4672 2 locks held by syz.0.37/4479: #0: ffff888073a66e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff888073a66e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff888073a66e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962 2 locks held by kworker/u4:9/4487: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900047cfd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 2 locks held by syz.1.42/4496: #0: ffff88805467e0e0 (&type->s_umount_key#50/1){+.+.}-{3:3}, at: alloc_super+0x1fa/0x930 fs/super.c:228 #1: ffffffff8cbd4ea8 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x800 mm/swap.c:865 1 lock held by syz.4.48/4514: #0: ffff8880714c3810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff8880714c3810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff8880714c3810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 2 locks held by syz.3.52/4534: #0: ffff88807ab3cc58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline] #0: ffff88807ab3cc58 (&mm->mmap_lock){++++}-{3:3}, at: do_madvise+0x3ef/0x3490 mm/madvise.c:1434 #1: ffffffff8cbd4ea8 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x800 mm/swap.c:865 1 lock held by syz-executor/4538: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4546: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by dhcpcd/4547: #0: ffff8880744f0130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880744f0130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/4551: #0: ffff888077526130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888077526130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/4552: #0: ffff888028a2e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888028a2e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz-executor/4553: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by dhcpcd/4555: #0: ffff888077016130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888077016130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz-executor/4557: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by dhcpcd/4559: #0: ffff88802a936130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88802a936130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/4560: #0: ffff88804cd14130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88804cd14130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz-executor/4562: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4566: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4570: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4573: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4576: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4580: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4584: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4588: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4592: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4595: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/4598: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 22 Comm: kworker/1:0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:convert_chmap_v3 sound/usb/stream.c:347 [inline] RIP: 0010:snd_usb_get_audioformat_uac3 sound/usb/stream.c:1028 [inline] RIP: 0010:__snd_usb_parse_audio_interface+0x3666/0x4b00 sound/usb/stream.c:1202 Code: 00 00 00 29 84 24 d8 00 00 00 4c 8b 74 24 50 0f 8e 4f 01 00 00 39 9c 24 88 00 00 00 0f 83 42 01 00 00 83 bc 24 d8 00 00 00 03 <0f> 82 34 01 00 00 48 8b 9c 24 e8 00 00 00 48 01 c3 e8 54 c6 64 f9 RSP: 0018:ffffc900001c6b20 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000002 RDX: ffff888017753b80 RSI: 00000000000006f5 RDI: 0000000000000003 RBP: ffffc900001c6d20 R08: ffff888017753b80 R09: 0000000000000020 R10: 00000000000000bc R11: 0000000000000002 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff888059716e20 R15: 00000000000006f5 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555bd2345000 CR3: 000000000c88e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: snd_usb_parse_audio_interface+0x36/0xb0 sound/usb/stream.c:1274 snd_usb_create_stream+0x3ec/0x610 sound/usb/card.c:209 snd_usb_create_streams sound/usb/card.c:330 [inline] usb_audio_probe+0x130b/0x1d90 sound/usb/card.c:892 usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659 hub_port_connect drivers/usb/core/hub.c:5517 [inline] hub_port_connect_change drivers/usb/core/hub.c:5657 [inline] port_event drivers/usb/core/hub.c:5817 [inline] hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295