INFO: task kworker/1:1:43 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:21672 pid:43 tgid:43 ppid:2 task_flags:0x4288060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:608 device_del+0x605/0x9b0 drivers/base/core.c:3896 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1418 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task kworker/1:4:5233 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:4 state:D stack:22120 pid:5233 tgid:5233 ppid:2 task_flags:0x4288060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:608 device_del+0x605/0x9b0 drivers/base/core.c:3896 device_unregister+0x1d/0xe0 drivers/base/core.c:3919 device_destroy+0x99/0xe0 drivers/base/core.c:4473 usb_deregister_dev+0x70/0x210 drivers/usb/core/file.c:184 iowarrior_disconnect+0x4c/0x350 drivers/usb/misc/iowarrior.c:915 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:571 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:563 __device_release_driver drivers/base/dd.c:1282 [inline] device_release_driver_internal+0x42e/0x600 drivers/base/dd.c:1305 bus_remove_device+0x22f/0x440 drivers/base/bus.c:616 device_del+0x376/0x9b0 drivers/base/core.c:3878 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1418 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz.4.411:6651 blocked for more than 145 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.411 state:D stack:27624 pid:6651 tgid:6650 ppid:2973 task_flags:0x40044c flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:608 device_remove+0xcb/0x180 drivers/base/dd.c:569 __device_release_driver drivers/base/dd.c:1282 [inline] device_release_driver_internal+0x42e/0x600 drivers/base/dd.c:1305 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1368 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:784 driver_unregister+0x76/0xb0 drivers/base/driver.c:277 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1751 raw_release+0x19b/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463 __fput+0x3ff/0xb40 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x829/0x2a30 kernel/exit.c:971 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x7e/0x430 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4a8/0x570 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9e2720ab4b RSP: 002b:00007f9e25c64f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007f9e2720ab4b RDX: 00007f9e25c65fe0 RSI: 0000000080085502 RDI: 0000000000000003 RBP: 00007f9e27278c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000200000000340 R13: 00002000000000c0 R14: 00007f9e27485fa0 R15: 00007ffeed8b94b8 Showing all locks held in the system: 5 locks held by kworker/0:0/9: 2 locks held by ksoftirqd/0/14: 1 lock held by khungtaskd/30: #0: ffffffff894da3a0 ( rcu_read_lock ){....}-{1:3} , at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] , at: rcu_read_lock include/linux/rcupdate.h:867 [inline] , at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 4 locks held by kworker/u8:2/36: #0: ffff888100ac4948 ( (wq_completion)netns ){+.+.}-{0:0} , at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90000267ca8 ( net_cleanup_work){+.+.}-{0:0} , at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: cleanup_net+0xab/0x900 net/core/net_namespace.c:670 #3: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline] , at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248 3 locks held by kworker/1:1/43: 5 locks held by kworker/0:2/1122: 3 locks held by kworker/u8:13/1533: #0: ffff88811259a948 ( (wq_completion)ipv6_addrconf ){+.+.}-{0:0} , at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900024dfca8 ( (work_completion)(&(&net->ipv6.addr_chk_work)->work) ){+.+.}-{0:0} , at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffffffff8a8ccfe8 (rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734 2 locks held by getty/2924: #0: ffff8881129130a0 (&tty->ldisc_sem ){++++}-{0:0} , at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452f0 ( &ldata->atomic_read_lock){+.+.}-{4:4} , at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 4 locks held by udevd/5219: #0: ffff8881260b59e0 (&p->lock){+.+.}-{4:4} , at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:182 #1: ffff88811eab8088 ( &of->mutex #2 ){+.+.}-{4:4} , at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff88811dd452d8 ( kn->active #9 ){++++}-{0:0} , at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] , at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff88813a64b198 ( &dev->mutex){....}-{4:4} , at: device_lock_interruptible include/linux/device.h:900 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 3 locks held by kworker/1:4/5233: 5 locks held by kworker/0:4/5239: 4 locks held by udevd/5394: #0: ffff88811ed90668 ( &p->lock ){+.+.}-{4:4} , at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:182 #1: ffff88811d456488 ( &of->mutex #2 ){+.+.}-{4:4} , at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff88810abe8a58 ( kn->active#9 ){++++}-{0:0} , at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] , at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff88813a64d198 ( &dev->mutex ){....}-{4:4} , at: device_lock_interruptible include/linux/device.h:900 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 1 lock held by syz.3.412/6661: 2 locks held by syz-executor/6665: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6675: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6685: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6688: #0: ffffffff8a8b49b0 (pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6697: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6715: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6723: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 (rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6732: #0: ffffffff8a8b49b0 ( pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6735: #0: ffffffff8a8b49b0 (pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 2 locks held by syz-executor/6745: #0: ffffffff8a8b49b0 (pernet_ops_rwsem ){++++}-{4:4} , at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577 #1: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2096 1 lock held by syz-executor/6765: #0: ffffffff8a8ccfe8 ( rtnl_mutex){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6769: #0: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6773: #0: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6777: #0: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6781: #0: ffffffff8a8ccfe8 ( rtnl_mutex ){+.+.}-{4:4} , at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] , at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: yealink 1-1:36.0: urb_irq_callback - urb status -71 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 14 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:io_serial_in+0x87/0xb0 drivers/tty/serial/8250/8250_port.c:401 Code: 7b 9f fe 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c c3 cc cc cc cc e8 18 6a 01 ff eb a2 e8 a1 6a RSP: 0018:ffffc900000ef1b8 EFLAGS: 00000002 RAX: dffffc0000000060 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: ffffffff8311c0c0 RDI: ffffffff93f14fc0 RBP: ffffffff93f14f80 R08: 0000000000000001 R09: 000000000000001f R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000020 R14: fffffbfff27e2a4a R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8226f3df4 CR3: 0000000114bcc000 CR4: 00000000003506f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x13a/0x210 drivers/tty/serial/8250/8250_port.c:1961 fifo_wait_for_lsr drivers/tty/serial/8250/8250_port.c:3234 [inline] serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3257 [inline] serial8250_console_write+0xdb9/0x1900 drivers/tty/serial/8250/8250_port.c:3342 console_emit_next_record kernel/printk/printk.c:3129 [inline] console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3215 console_flush_all kernel/printk/printk.c:3289 [inline] __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3359 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4914 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4925 __dev_printk+0xcb/0x100 drivers/base/core.c:4937 _dev_err+0xef/0x127 drivers/base/core.c:4980 urb_irq_callback.cold+0x41/0xfd drivers/input/misc/yealink.c:418 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1777 [inline] __hrtimer_run_queues+0x516/0x990 kernel/time/hrtimer.c:1841 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622 run_ksoftirqd kernel/softirq.c:1063 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1055 smpboot_thread_fn+0x3d3/0xaa0 kernel/smpboot.c:160 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246