Extracting prog: 36m28.42490698s Minimizing prog: 1h4m30.068044923s Simplifying prog options: 21m51.902512154s Extracting C: 5m38.099517124s Simplifying C: 0s extracting reproducer from 51 programs testing a last program of every proc single: executing 11 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_io_uring_setup-socket$nl_route-syz_usb_connect-syz_usb_connect-openat$vhost_vsock-socketpair$unix-socket$inet6_tcp-socket$inet6_tcp-socket$nl_route-socket$inet_tcp-socket-socket$nl_rdma-socket$nl_generic-socket$nl_audit-socket$inet_tcp-syz_genetlink_get_family_id$mptcp-ioctl$ifreq_SIOCGIFINDEX_team-getpeername$packet-sendmsg$MPTCP_PM_CMD_GET_ADDR-syz_open_procfs-socket$nl_generic-socket$unix-socket$nl_route-bpf$BPF_PROG_DETACH detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f00000000000000000000000010"], 0x48) syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x10, 0x3, 0x200003ca}, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_audit(0x10, 0x3, 0x9) socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r2) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) getpeername$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000200)=0x14) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xd8, r3, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x46}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x80000000}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xd}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x10}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x10008004}, 0x8004) syz_open_procfs(0x0, &(0x7f0000000180)='maps\x00') socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES64, @ANYRES8=r6], 0x20) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vicodec0-unshare-socket$packet-socketpair$unix-fcntl$setown-ioctl$VIDIOC_DQBUF detailed listing: executing program 0: r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000ec0), 0x2, 0x0) unshare(0x22020600) r1 = socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x5, 0x0, 0x0) fcntl$setown(r1, 0x8, 0x0) ioctl$VIDIOC_DQBUF(r0, 0xc04c5611, &(0x7f0000000000)=@overlay={0x1, 0x8, 0x4, 0x10, 0x9, {}, {0x3, 0xc, 0x6, 0x6, 0x4, 0x1}, 0x7, 0x3, {}, 0x6}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-syz_open_procfs-socketpair$unix-openat$kvm-bpf$PROG_LOAD-ioctl$KVM_SET_MSRS-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_RUN-socket-sendmsg$nl_route detailed listing: executing program 0: socket$netlink(0x10, 0x3, 0x0) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/fib_trie\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x8000, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f00000001c0)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x2, 0x9, 0xfffffffffffffffd, 0x73, 0x2, 0x2, 0x4002804c4, 0x9, 0x8000000000000000, 0xc595, 0x0, 0x4, 0xefffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2002d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x5c, 0x10, 0x439, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xb881}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @mcast1}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00'}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24008006}, 0x4040844) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SCHED_CORE-sched_setattr-sendfile-sched_setattr-gettid-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_ublk_setup_queues-getsockopt$sock_cred-read$FUSE-ioctl$DRM_IOCTL_GET_CLIENT-read$FUSE-openat$binderfs-openat$binderfs-dup3-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-sendmsg$unix-io_uring_setup-syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-mmap detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000002) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001880)={0x0, 0x0}, &(0x7f00000018c0)=0xc) read$FUSE(0xffffffffffffffff, &(0x7f0000001900)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000003940)={0xfffffffa, 0x1, {r1}, {0xffffffffffffffff}, 0xd7b, 0x400}) read$FUSE(0xffffffffffffffff, &(0x7f0000003980)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000059c0)='./binderfs/binder0\x00', 0x0, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000005a40)='./binderfs/binder0\x00', 0x800, 0x0) r8 = dup3(r7, r6, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000005b00)={0x8, 0x0, &(0x7f0000005b40)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000005b80)={0x4c, 0x0, &(0x7f0000005bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000005c40)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}, @ptr={0x70742a85, 0x80000, 0x0, 0x0, 0x1, 0x11}, @ptr={0x70742a85, 0x5, 0x0, 0x0, 0x1, 0x3a}}, &(0x7f0000005cc0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000005e00)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001640)=[{&(0x7f0000000200)="618d52bba250721a446f976964f40e956b25c5b153e1b535789b531bd63cb58506f4a9f6ee48ea9fb4f0ab335ddebfbfe6aabdc53a", 0x35}, {&(0x7f00000002c0)="b084505b12e8accd64d3f1960de24d5b4bd00ea1bfbaf1e6854a272a744f3dd43d892da40b08654b6f17cef507567592bbd1075ebb91fc61bd4d00c960078c4ef757b73f75f59c962057c949a1330ba38437376a98af1998c2ca65b85376308fc5617be2cbb687e4773c404a580a6d082f02a0a638a258342e5e860afd", 0x7d}, {&(0x7f0000000340)="5c387981fb9b8ba3a6a7e4692bc6e2f2b29c2336823e9e7517cfef219bf3423f0150e3e80702c532b12f4367447cd732431501bfae41891099e5d3eda2646a8678ae00c67ec7777a3f888fe9efc704eac826e48b9d5a821b19580591de736e0a82355c8ba71163e6f4329a2b0722df4a325af26be7515d598429fab4d98749a8a7293ba254d6a2d40551848588a0218621a443a58691e725ac490eff835302563a018eee5a55777445a34081f8ee1fbfd8489cd388bf66533c6b822a40e9827ec64a5be890fc5d93ec1a8305c8985de052fe336e0868f2e8fdc58f7ae162f5816f96c07687f839e1db79a9fbb6d02006300076450b54a3295a69f0ad24e0ab8c29ce6e64919cb0118007558553fc83d132ccbd12707260d2038f05c8eddf06b338812c34191bffdf91ad8de712219471587d8576cc23da6b80225007c5f66a4454d9d0ae4b1d54287552c05060c17351a4564e9a788286fce9bafd9b3123ca18b29124876d35c512fd3a0a6da2af522129a1cce76a47ca0d1666cbd99c3e8beda4dadc1625ef14a5f9ce17543bb84f0d29807acae404dbc6c0c58b8ac4bc234c515f79ed3672c748b2ff05b050f56d46c6d26af3e369ebe29a0a559363ae23975a2c6373103d456c48e56171722b88376e717db8c74fbb433da9dfbdca87160e65a25a4656b53656bbee5c9c5c2ebe40517d38803179dfbe2b03a41e4af4a55d905da4814e71a01241295ef8039a73675e302d29f58efd6e5f81d1b58ddf4a7b28ea0c33070d088029cdd8a7fbf8828aea6febc5e332b3c2aaf666e15e43b059d2d360502c530851a7c16da91233ff9a47f47f0950a4528387fc5cbe0a3f76d08a1ed7493503252ca3ce23286214157db5d5c8a7c60babdce2ec5ca561e5ef54720d89d3ea30797b3d59cd0f567370cf02a6998b57afffae8accbbbab9a63fc8bc2946f9925b7f1b4f4faf7b52c8a7eb7336ea1648b88ee0a1b891e324be00f07b235d1105474fdf1534355db642f956f14d984ac46d97ca9642993af8bcd43060aa13d28f6924c194c12f675eeb0d37b3a948e0d83ddae3a0c9eedfef5f85f941e06c92d6a8ee24626c859d0d6ab37da52c302d41b4c5dc7dc4539fe2851839b1b918bd255321ea88e286994deac09c795c58149cf9f50646b847ba0af07af221abe673be1c148f3b54f21cb27e49e05a48196ba5cf7d63bb986e918abdc02868b55911a501b5d28bdc82b0ba8e10a99c473047bc95d528bba896100868c74efee209e1c2c6eb3d8a6fd46fc7f65647d1f78356f7c59bfa9e8e619306c0b8c4a8d354e5a9acd775004b1c1c7b2cf8e41e0ac3bf7b185768d54ceae09f1ce1597d97be574c0dcb8b1bab25339377e02991480bc759cf556646e00dd19c412f9d31ce63bd39d9129098ae97d5f348cafdb0db74f8d66b2fe486204cf32481385f962c977f539f858de2a57a3ed55da54bcbacd450fbc18b882eb8ffe84b30020daa08a0416b86210dc1df35c6ca6abc87ab2f72e00de0965f9367a0502164f8263fd4a2afc9d250b1f5a255a4e9c831cc70592b18ec9ddb3f93df723c1057dbda3effca67dd45e2bf8c1a91712cfe251e5895df4f9fa36f15535c910f9004093993a87b3855c416fff6945091098bf3b2beeaa7ed1476889534f15032b27750291b3248afa9ff1743bb0b3773c7055bffb927dca589fb305f725d09275bf2fc8203f554f9c2a045fb36f9754cf4b49a962f453e8463f7eaad787751871882cb52361a1cf5f7d24a92bf14ef63450d103243cb5abb6c39889d5c5468507b32118626f7d5065355867e33359c9fbbcb6dab968142df38e27f274573899ffdd54d216e28bed9974ba1a0bd6415b52a4487f45a425265ae0251b74f5b192d829e9b1d31bf01024932a22b21c2cffe3c2f9babcf87b57aeca4b5f07be38245036ec173addcec01c1dbc23eac187c80a6c3d580066f2d0b1ca2226083e0b973f74437d7d8715304a2c08df7f8daf6dff951a18395ecbd17324acb5cb83d4e5a82847e155da45d650a2806c4e9260d02b0fc58aa71349eed7f2762d2db299dc231882ec4b5133982a63fcebb3bf40ec3b56b9b99ca343d108e98c900a4cc0a7eb5bc0298783926014b4e34751d4ce6187d6fca9d4aba7013bb93cce82121a8f624fdd2b80698b0036844af89e87870e47d74172f90eab6501fabbd5ccb1e163cbc9d25ea4354d98eec036e9bd26ba61c16ddfedf6979ef17a8ecb1e780ca35b2f75ae2b8c2beff8c3ec193e966e6300c764c9b4bf8a6b7d76d7916284c6db6f380758f32d76607091972329795f62257a3a9b98c1f822ce7c24c63f0f6ab00c8b0a8d17f88a7b098923dafe43fb8a684deb3cce3064b5160e5381f215f982a1743f177e157379b87e982fcc0ff0ee23723b450ee6e89bd4a03e56899a45c621d5a8bd697aa3c9c7b3362e7efed6c9ac9c057a6865a9462d92615542218cc039ec8bfa42f42456c92d5a598bf94f45e1309a86ec08220263b77d3e468666d7f9890ce98e5cf926a1a13d2d688f4589470fc80fd8be0e33e39fe98a321e6f2a0cbd679f61a24e5e379f164a6f456406b0af05633553082d93c86d7b1e61224f3bf9ee23035f9856fe7eaf37f71fc702e7bbf078c26831c796cc6c65eef3ecf37ac3f87d2c243cdad0b2df4f84a5ee80c72bfee2125b419453feb9999780a1e95202cf0ca28b5dd5bc43363ec20540b612b0c389d2cc1db0c5e9be3f5fe3f59e6282279d1fda3084d9b92876440e42e976747df9d46690db1872c9f7277a48153e5a6e427feca5b8a7e25c52314b220dc09e12f0cdd06d748b81d56c26acfa7e0920df82e7ff8ad990499b40d4cfc0eacfdef6a423a1bff5d9edda00151fde34ee19887bdcc65e08631637d98ce8f73702f94e8780a196d80e94275a5b1b1911bc5f82a44b29f1a65e478cd54de15f5b655377213c04e62f67212ba654ac060bf20c6f3eeac8e5783248abb4cce33f93c712e697f7af06a992a7ab7dca092a466537991c093be3320e1b0754f4768aeb3b42056b763acf91eccb7eb50c3697425c80fe4d8647a8da8324259346ce4b13bacfd2bcf34a2a5f504b1e44b6ceb8abe5985eff15feac1684a202ecd5ce570665d75bec5caa45be0bb14a9b0b0ae9a2218dcd61274ac7016cbfa5f36086dc6d8f68e5f714680f7434dca89b61ac0b2e98db2b2af9584b76fdaf6cc3a0123752bbe46dadb35ca490e7f3db9d56de52726efef664c9a71b6874620d961015fdf1b7195e9762c56222a8917cb173c2af191cbbb6b802346b5e9b44c2965921e4c5adb1d9fb09e4701f38cfacdef6dab19937f14dca15506baf4cb18aa7afa3f1f74c8c835b471ccb592fbf86f24b33cb291cc3fc64e4e0d5a85acfd513fd0f9271462d3761da176fd6d1f7a54973639087a8a2e1671dc4990720f315edfa604d47f161f433909e753c92f09f3404790d771da8e2d61c9ba118cdff8305647dc1a067d601215747c642e2e117e1e0b2b1c1ca5e54881089851660daf0df40f99bb0ce106fdfbc68ef2af016494d7412703e604e759882724dcbb76b1b7a90b2621def6c64fde707090160bbdeccb7a5b0a9e4e3717d77f3e18e5a007a1faba9c7d8e6dcf8cadb5a7233eb3e592510582b2c5c156bce74088e1a1504f3bdfc95c07fb72fac74887fa8e6e060a0e943439fede68d34c1ea94be1058c40081aec7b581683e95716bc556358d16c1afb77dd8d000c5086021a5252e6f578903db327ade226b5b8d167bc8d44c822a202f16214ed0c8c1829bcbbdce1e6eccf33ad2bf05eb1fc41d7bf3e3f0385ca96a9a007c3f446090defc7606a7754ea56c27340cd489f430da85134533c0796d5d1e8eb436d7f0e21a5d4a89c46dea461c586badfd13dfc9cac2e01b61e1df900d05d83be841cc6df6275533725f25a9901bcf262b0e42fb78d2acc1ae16d5afd249596e47b63e5b7afc832d8db36398b48b1ebc168140dfce17cda1ed3fa4ab852a955be956b43e1015a25beee38121c9bbfcb5aa95421c8036838cb2e6bd905559f7c4695ad24a95ccc3e6a6964d34510b8aa65bd2442af81e9f3596043461675ff14a24805ea36f28772dcaa79abcd1b5a57f8ff96f5c6b3593d7cdcfec08fcc68a5b8789d9235db171da54290f28735213dbcf00aac3db671bdae68dcb3dc3cdfc6bf6f738d9e97de7a320a1b2f4491e8c07b8cbd7cbe7fbc7df26570c30f0afe26d29a8866915cb5abba003a58d6a6cb0f00a541f62bc21cd116bbc0333c98ff8f3469ff546e78f5be74c64f7cd9a7d53202d4a35fffe849c91c662ee69be09193633c3e129181473c58f9d99eb04401af9c61dc76fa2b2b2d6007edb4579673cd08664d5c8e0579cd402c82073ec7eb6562a09c683fa7904cd5bf53ccea5dc2c2b25f90ada9ef2844f441e02383117bc15a3c5bfd031acd5d547527519fc06bc349b3f53c1a2ec001d8fa68e441d0117da30f179197eb9aabb08f900cfcd29d0d1cb95653dc073b3adecd2b399f582970a02b7264dabcd6a68bac4c9f86bc6f201c25c356cae60252c33ba9e5cec9b837dc4259caa45aec41d30477352bbc6e76c187dc447ed9d10f64e7de0000c231ab08f84f4037f91843f08222dd5bc708e0fc0d325920e87df8b3fca89066e9c4efede666402c2eb634c2fa90e62579ae992648deb14fc748b441705185a80e205fdc037f4cbae2b59b786090ae6f9930441d1c6ffd1bcfd4c8733fac4f7ade50539f4563e908bc0730eb5e2583d89c4aa9e97e667bcbb5fac772c71aeccda6502473968f473bd3bb4225619bdd4718a75f3cbd2112accc4da6398baeb29a50ab2c2b5dc0f11d9608ded5d2452036ea26d0120e53f893f111589ae9a2ada7bb9ef8b670db1e56453f06694aa7318f3fd46f054e501cc0a7fb400ff08091af3f66d5dd416872d8b4d95cb20682bf5acddd5a7fe22c8fbd2bcdc9ec4daf445186136775577da3f8d7174eeb62a86dcc6968e923a58b851b4f16be858074aa127d05c5d007b96f0f91a52c6190b084cc45af835e617405d80aa8e83fdd29d5780d3a2925e4c59d300b453a19b134608fa635f2f9646a11a8708e709bb3b967553ba930ea5e139bc038a1ea843373e8e77a6d84bd9e9ad161fd7b7bf63bdafe2aadce4d7e8cde6564147e172ea1adb5cc5f3ab461b2a920c88210143cffff4c2248c844c118331c3ed8f9aead263f06480e1eb49379ba4ef79764490a58d984e7224f8870af7792a0233ee617edb68c0b697e5158461e840e7e893447496d2a430a002eab614b53378e0450b636421f521b02b088d37d82a198b6b1571bebc3906c4a80699674c47a57d77e597d59ab17ee943021ccaa5aab3312f51b179c47c6f5d90915960a6542f1f6a26bd21ffb66829d22ea935d845611e369670b757e4d847c8cc6b72c185fc44c7cedb6135592e683fbb102294377021ba922f8b13523c0523deb49a5a20ac1b47ef3bd90142f5d1ba53d1cb833843e3154e72cc4d9d1ac695b6b24dfc6ff18323d758722ff78d946f5965c3e2d2dacc8bf87802655c4edbe16b8e0fe64037e1e8975cdae6fe6528de56131164fec13a06cee5a75bae49961bdfaf762c30bfec74fa730dbb12132cb3907d62b42479aebb0ae32da84335b8ef1e8e78e5958c9c1af95e326b443ea6a3deccd74f82084343edb65e8dc70fe472e0d49c59b19a9768b849c3b21aeb73d5d8fbd8f07b68caf7168fb2a0166b6e74aa1fceb019fea3a7b3fc3492b879b65de5765b3cb0c3d32", 0x1000}, {&(0x7f0000001340)="64cf3acd577b6353063538306d966fe9cacf4c2bdffc6ef347e9442d8d39c99cfb64dca64ef9532ea6211b8e50070bca667e9e8baa76e376cec0f121803afe6767a3913422ebacf68cc7c52a6a92e498b0901f812fc8bcdf29b7d1a801711b9f5d9a0db2036cda5bfa6e3972e7e271bce1b6fcf9dfb87b22f2a7d491efb93c2e3403aa8f83774474cdd6888dfd24a061425d34521e1e5b94c8c4c08679be8b822e065ff0804ac6e53c8f56c5b11a515be7a7e46d10efa3910857dc68defdae953048fd0c2f2c5620e9b3d01932e1641b6b31ea8eb2dba7c898bc327df281e35e212343fe3fad0d064f2f2a", 0xeb}, {&(0x7f0000001440)="5e1e88356be5073f91bf80f980281e82c4aded8c3588ca103fa3b9ea59118ee83cd50bb6ea3d7de04ee1d5a7ceefe2c4b15aad5b3c97ab4992e3b8c2411bace6b62247125370d66fc5fe8851552e836c1fa7122c747794bf0ceedb11b2e7c3eb0c1e63ce252f570d7f0a7ae3d9a993d29d5917fe159c0ef680e8f7897c1d24ee272ff5ef8190aeb46e039f7170551b0ada23f104774e37cb0120c4fc69890fe277cc426360c635c194fca85115b9e1e551643b14099eae89423b5bc8dcf3c3ef46ad82a6dfa6e6", 0xc7}, {&(0x7f0000001540)="13693c1f", 0x4}, {&(0x7f0000001580)="78b1ac94a383c9d0a2f50bd6faf153cb5d04169b8af1905d6c70d5c67185203bdad550ca4b4cacd20a8ba3bafacd9ab1bf0f42550f374784384997ca15a521fa39a2bb91f9d6ef272019d9c341d8b466eb623177a0c5b6ddb49bd96f8d4f694e24b17bb4326c8b29137cef51457a6661ed7c5b127af53b0622ea6e4ef18c14e2e023aec93bbb786bb0ff283c8fa9c32f68d299c8d955ec25bfb9", 0x9a}], 0x7, &(0x7f0000001680)=[@cred={{0x18, 0x1, 0x2, {0x0, 0xffffffffffffffff, 0xee01}}}, @rights={{0x24, 0x1, 0x1, [r0, 0xffffffffffffffff, r0, r0, r0, r0]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r6, r6, r7, 0xffffffffffffffff, r7, r0, r7]}}, @cred={{0x18, 0x1, 0x2, {r1, r2, r3}}}, @cred={{0x18, 0x1, 0x2, {r1, r4, r5}}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r0, r0, r8, r0]}}, @rights={{0x14, 0x1, 0x1, [r0, r0]}}], 0xec}, 0x48080) io_uring_setup(0x8, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x17b}) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902"], 0x0) syz_usb_control_io$printer(r9, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r9, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r9, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SCHED_CORE-sched_setattr-sendfile-sched_setattr-gettid-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_ublk_setup_queues-getsockopt$sock_cred-read$FUSE-ioctl$DRM_IOCTL_GET_CLIENT-read$FUSE-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-dup3-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-sendmsg$unix-io_uring_setup-syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-mmap detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000002) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001880)={0x0, 0x0}, &(0x7f00000018c0)=0xc) read$FUSE(0xffffffffffffffff, &(0x7f0000001900)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000003940)={0xfffffffa, 0x1, {r1}, {0xffffffffffffffff}, 0xd7b, 0x400}) read$FUSE(0xffffffffffffffff, &(0x7f0000003980)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000005a00)={0x73622a85, 0x0, 0x8000000000002}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000005a40)='./binderfs/binder0\x00', 0x800, 0x0) r7 = dup3(r6, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000005b00)={0x8, 0x0, &(0x7f0000005b40)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000005b80)={0x4c, 0x0, &(0x7f0000005bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000005c40)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}, @ptr={0x70742a85, 0x80000, 0x0, 0x0, 0x1, 0x11}, @ptr={0x70742a85, 0x5, 0x0, 0x0, 0x1, 0x3a}}, &(0x7f0000005cc0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000005e00)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001640)=[{&(0x7f0000000200)="618d52bba250721a446f976964f40e956b25c5b153e1b535789b531bd63cb58506f4a9f6ee48ea9fb4f0ab335ddebfbfe6aabdc53a", 0x35}, {&(0x7f00000002c0)="b084505b12e8accd64d3f1960de24d5b4bd00ea1bfbaf1e6854a272a744f3dd43d892da40b08654b6f17cef507567592bbd1075ebb91fc61bd4d00c960078c4ef757b73f75f59c962057c949a1330ba38437376a98af1998c2ca65b85376308fc5617be2cbb687e4773c404a580a6d082f02a0a638a258342e5e860afd", 0x7d}, {&(0x7f0000000340)="5c387981fb9b8ba3a6a7e4692bc6e2f2b29c2336823e9e7517cfef219bf3423f0150e3e80702c532b12f4367447cd732431501bfae41891099e5d3eda2646a8678ae00c67ec7777a3f888fe9efc704eac826e48b9d5a821b19580591de736e0a82355c8ba71163e6f4329a2b0722df4a325af26be7515d598429fab4d98749a8a7293ba254d6a2d40551848588a0218621a443a58691e725ac490eff835302563a018eee5a55777445a34081f8ee1fbfd8489cd388bf66533c6b822a40e9827ec64a5be890fc5d93ec1a8305c8985de052fe336e0868f2e8fdc58f7ae162f5816f96c07687f839e1db79a9fbb6d02006300076450b54a3295a69f0ad24e0ab8c29ce6e64919cb0118007558553fc83d132ccbd12707260d2038f05c8eddf06b338812c34191bffdf91ad8de712219471587d8576cc23da6b80225007c5f66a4454d9d0ae4b1d54287552c05060c17351a4564e9a788286fce9bafd9b3123ca18b29124876d35c512fd3a0a6da2af522129a1cce76a47ca0d1666cbd99c3e8beda4dadc1625ef14a5f9ce17543bb84f0d29807acae404dbc6c0c58b8ac4bc234c515f79ed3672c748b2ff05b050f56d46c6d26af3e369ebe29a0a559363ae23975a2c6373103d456c48e56171722b88376e717db8c74fbb433da9dfbdca87160e65a25a4656b53656bbee5c9c5c2ebe40517d38803179dfbe2b03a41e4af4a55d905da4814e71a01241295ef8039a73675e302d29f58efd6e5f81d1b58ddf4a7b28ea0c33070d088029cdd8a7fbf8828aea6febc5e332b3c2aaf666e15e43b059d2d360502c530851a7c16da91233ff9a47f47f0950a4528387fc5cbe0a3f76d08a1ed7493503252ca3ce23286214157db5d5c8a7c60babdce2ec5ca561e5ef54720d89d3ea30797b3d59cd0f567370cf02a6998b57afffae8accbbbab9a63fc8bc2946f9925b7f1b4f4faf7b52c8a7eb7336ea1648b88ee0a1b891e324be00f07b235d1105474fdf1534355db642f956f14d984ac46d97ca9642993af8bcd43060aa13d28f6924c194c12f675eeb0d37b3a948e0d83ddae3a0c9eedfef5f85f941e06c92d6a8ee24626c859d0d6ab37da52c302d41b4c5dc7dc4539fe2851839b1b918bd255321ea88e286994deac09c795c58149cf9f50646b847ba0af07af221abe673be1c148f3b54f21cb27e49e05a48196ba5cf7d63bb986e918abdc02868b55911a501b5d28bdc82b0ba8e10a99c473047bc95d528bba896100868c74efee209e1c2c6eb3d8a6fd46fc7f65647d1f78356f7c59bfa9e8e619306c0b8c4a8d354e5a9acd775004b1c1c7b2cf8e41e0ac3bf7b185768d54ceae09f1ce1597d97be574c0dcb8b1bab25339377e02991480bc759cf556646e00dd19c412f9d31ce63bd39d9129098ae97d5f348cafdb0db74f8d66b2fe486204cf32481385f962c977f539f858de2a57a3ed55da54bcbacd450fbc18b882eb8ffe84b30020daa08a0416b86210dc1df35c6ca6abc87ab2f72e00de0965f9367a0502164f8263fd4a2afc9d250b1f5a255a4e9c831cc70592b18ec9ddb3f93df723c1057dbda3effca67dd45e2bf8c1a91712cfe251e5895df4f9fa36f15535c910f9004093993a87b3855c416fff6945091098bf3b2beeaa7ed1476889534f15032b27750291b3248afa9ff1743bb0b3773c7055bffb927dca589fb305f725d09275bf2fc8203f554f9c2a045fb36f9754cf4b49a962f453e8463f7eaad787751871882cb52361a1cf5f7d24a92bf14ef63450d103243cb5abb6c39889d5c5468507b32118626f7d5065355867e33359c9fbbcb6dab968142df38e27f274573899ffdd54d216e28bed9974ba1a0bd6415b52a4487f45a425265ae0251b74f5b192d829e9b1d31bf01024932a22b21c2cffe3c2f9babcf87b57aeca4b5f07be38245036ec173addcec01c1dbc23eac187c80a6c3d580066f2d0b1ca2226083e0b973f74437d7d8715304a2c08df7f8daf6dff951a18395ecbd17324acb5cb83d4e5a82847e155da45d650a2806c4e9260d02b0fc58aa71349eed7f2762d2db299dc231882ec4b5133982a63fcebb3bf40ec3b56b9b99ca343d108e98c900a4cc0a7eb5bc0298783926014b4e34751d4ce6187d6fca9d4aba7013bb93cce82121a8f624fdd2b80698b0036844af89e87870e47d74172f90eab6501fabbd5ccb1e163cbc9d25ea4354d98eec036e9bd26ba61c16ddfedf6979ef17a8ecb1e780ca35b2f75ae2b8c2beff8c3ec193e966e6300c764c9b4bf8a6b7d76d7916284c6db6f380758f32d76607091972329795f62257a3a9b98c1f822ce7c24c63f0f6ab00c8b0a8d17f88a7b098923dafe43fb8a684deb3cce3064b5160e5381f215f982a1743f177e157379b87e982fcc0ff0ee23723b450ee6e89bd4a03e56899a45c621d5a8bd697aa3c9c7b3362e7efed6c9ac9c057a6865a9462d92615542218cc039ec8bfa42f42456c92d5a598bf94f45e1309a86ec08220263b77d3e468666d7f9890ce98e5cf926a1a13d2d688f4589470fc80fd8be0e33e39fe98a321e6f2a0cbd679f61a24e5e379f164a6f456406b0af05633553082d93c86d7b1e61224f3bf9ee23035f9856fe7eaf37f71fc702e7bbf078c26831c796cc6c65eef3ecf37ac3f87d2c243cdad0b2df4f84a5ee80c72bfee2125b419453feb9999780a1e95202cf0ca28b5dd5bc43363ec20540b612b0c389d2cc1db0c5e9be3f5fe3f59e6282279d1fda3084d9b92876440e42e976747df9d46690db1872c9f7277a48153e5a6e427feca5b8a7e25c52314b220dc09e12f0cdd06d748b81d56c26acfa7e0920df82e7ff8ad990499b40d4cfc0eacfdef6a423a1bff5d9edda00151fde34ee19887bdcc65e08631637d98ce8f73702f94e8780a196d80e94275a5b1b1911bc5f82a44b29f1a65e478cd54de15f5b655377213c04e62f67212ba654ac060bf20c6f3eeac8e5783248abb4cce33f93c712e697f7af06a992a7ab7dca092a466537991c093be3320e1b0754f4768aeb3b42056b763acf91eccb7eb50c3697425c80fe4d8647a8da8324259346ce4b13bacfd2bcf34a2a5f504b1e44b6ceb8abe5985eff15feac1684a202ecd5ce570665d75bec5caa45be0bb14a9b0b0ae9a2218dcd61274ac7016cbfa5f36086dc6d8f68e5f714680f7434dca89b61ac0b2e98db2b2af9584b76fdaf6cc3a0123752bbe46dadb35ca490e7f3db9d56de52726efef664c9a71b6874620d961015fdf1b7195e9762c56222a8917cb173c2af191cbbb6b802346b5e9b44c2965921e4c5adb1d9fb09e4701f38cfacdef6dab19937f14dca15506baf4cb18aa7afa3f1f74c8c835b471ccb592fbf86f24b33cb291cc3fc64e4e0d5a85acfd513fd0f9271462d3761da176fd6d1f7a54973639087a8a2e1671dc4990720f315edfa604d47f161f433909e753c92f09f3404790d771da8e2d61c9ba118cdff8305647dc1a067d601215747c642e2e117e1e0b2b1c1ca5e54881089851660daf0df40f99bb0ce106fdfbc68ef2af016494d7412703e604e759882724dcbb76b1b7a90b2621def6c64fde707090160bbdeccb7a5b0a9e4e3717d77f3e18e5a007a1faba9c7d8e6dcf8cadb5a7233eb3e592510582b2c5c156bce74088e1a1504f3bdfc95c07fb72fac74887fa8e6e060a0e943439fede68d34c1ea94be1058c40081aec7b581683e95716bc556358d16c1afb77dd8d000c5086021a5252e6f578903db327ade226b5b8d167bc8d44c822a202f16214ed0c8c1829bcbbdce1e6eccf33ad2bf05eb1fc41d7bf3e3f0385ca96a9a007c3f446090defc7606a7754ea56c27340cd489f430da85134533c0796d5d1e8eb436d7f0e21a5d4a89c46dea461c586badfd13dfc9cac2e01b61e1df900d05d83be841cc6df6275533725f25a9901bcf262b0e42fb78d2acc1ae16d5afd249596e47b63e5b7afc832d8db36398b48b1ebc168140dfce17cda1ed3fa4ab852a955be956b43e1015a25beee38121c9bbfcb5aa95421c8036838cb2e6bd905559f7c4695ad24a95ccc3e6a6964d34510b8aa65bd2442af81e9f3596043461675ff14a24805ea36f28772dcaa79abcd1b5a57f8ff96f5c6b3593d7cdcfec08fcc68a5b8789d9235db171da54290f28735213dbcf00aac3db671bdae68dcb3dc3cdfc6bf6f738d9e97de7a320a1b2f4491e8c07b8cbd7cbe7fbc7df26570c30f0afe26d29a8866915cb5abba003a58d6a6cb0f00a541f62bc21cd116bbc0333c98ff8f3469ff546e78f5be74c64f7cd9a7d53202d4a35fffe849c91c662ee69be09193633c3e129181473c58f9d99eb04401af9c61dc76fa2b2b2d6007edb4579673cd08664d5c8e0579cd402c82073ec7eb6562a09c683fa7904cd5bf53ccea5dc2c2b25f90ada9ef2844f441e02383117bc15a3c5bfd031acd5d547527519fc06bc349b3f53c1a2ec001d8fa68e441d0117da30f179197eb9aabb08f900cfcd29d0d1cb95653dc073b3adecd2b399f582970a02b7264dabcd6a68bac4c9f86bc6f201c25c356cae60252c33ba9e5cec9b837dc4259caa45aec41d30477352bbc6e76c187dc447ed9d10f64e7de0000c231ab08f84f4037f91843f08222dd5bc708e0fc0d325920e87df8b3fca89066e9c4efede666402c2eb634c2fa90e62579ae992648deb14fc748b441705185a80e205fdc037f4cbae2b59b786090ae6f9930441d1c6ffd1bcfd4c8733fac4f7ade50539f4563e908bc0730eb5e2583d89c4aa9e97e667bcbb5fac772c71aeccda6502473968f473bd3bb4225619bdd4718a75f3cbd2112accc4da6398baeb29a50ab2c2b5dc0f11d9608ded5d2452036ea26d0120e53f893f111589ae9a2ada7bb9ef8b670db1e56453f06694aa7318f3fd46f054e501cc0a7fb400ff08091af3f66d5dd416872d8b4d95cb20682bf5acddd5a7fe22c8fbd2bcdc9ec4daf445186136775577da3f8d7174eeb62a86dcc6968e923a58b851b4f16be858074aa127d05c5d007b96f0f91a52c6190b084cc45af835e617405d80aa8e83fdd29d5780d3a2925e4c59d300b453a19b134608fa635f2f9646a11a8708e709bb3b967553ba930ea5e139bc038a1ea843373e8e77a6d84bd9e9ad161fd7b7bf63bdafe2aadce4d7e8cde6564147e172ea1adb5cc5f3ab461b2a920c88210143cffff4c2248c844c118331c3ed8f9aead263f06480e1eb49379ba4ef79764490a58d984e7224f8870af7792a0233ee617edb68c0b697e5158461e840e7e893447496d2a430a002eab614b53378e0450b636421f521b02b088d37d82a198b6b1571bebc3906c4a80699674c47a57d77e597d59ab17ee943021ccaa5aab3312f51b179c47c6f5d90915960a6542f1f6a26bd21ffb66829d22ea935d845611e369670b757e4d847c8cc6b72c185fc44c7cedb6135592e683fbb102294377021ba922f8b13523c0523deb49a5a20ac1b47ef3bd90142f5d1ba53d1cb833843e3154e72cc4d9d1ac695b6b24dfc6ff18323d758722ff78d946f5965c3e2d2dacc8bf87802655c4edbe16b8e0fe64037e1e8975cdae6fe6528de56131164fec13a06cee5a75bae49961bdfaf762c30bfec74fa730dbb12132cb3907d62b42479aebb0ae32da84335b8ef1e8e78e5958c9c1af95e326b443ea6a3deccd74f82084343edb65e8dc70fe472e0d49c59b19a9768b849c3b21aeb73d5d8fbd8f07b68caf7168fb2a0166b6e74aa1fceb019fea3a7b3fc3492b879b65de5765b3cb0c3d32", 0x1000}, {&(0x7f0000001340)="64cf3acd577b6353063538306d966fe9cacf4c2bdffc6ef347e9442d8d39c99cfb64dca64ef9532ea6211b8e50070bca667e9e8baa76e376cec0f121803afe6767a3913422ebacf68cc7c52a6a92e498b0901f812fc8bcdf29b7d1a801711b9f5d9a0db2036cda5bfa6e3972e7e271bce1b6fcf9dfb87b22f2a7d491efb93c2e3403aa8f83774474cdd6888dfd24a061425d34521e1e5b94c8c4c08679be8b822e065ff0804ac6e53c8f56c5b11a515be7a7e46d10efa3910857dc68defdae953048fd0c2f2c5620e9b3d01932e1641b6b31ea8eb2dba7c898bc327df281e35e212343fe3fad0d064f2f2a", 0xeb}, {&(0x7f0000001440)="5e1e88356be5073f91bf80f980281e82c4aded8c3588ca103fa3b9ea59118ee83cd50bb6ea3d7de04ee1d5a7ceefe2c4b15aad5b3c97ab4992e3b8c2411bace6b62247125370d66fc5fe8851552e836c1fa7122c747794bf0ceedb11b2e7c3eb0c1e63ce252f570d7f0a7ae3d9a993d29d5917fe159c0ef680e8f7897c1d24ee272ff5ef8190aeb46e039f7170551b0ada23f104774e37cb0120c4fc69890fe277cc426360c635c194fca85115b9e1e551643b14099eae89423b5bc8dcf3c3ef46ad82a6dfa6e6", 0xc7}, {&(0x7f0000001540)="13693c1f", 0x4}, {&(0x7f0000001580)="78b1ac94a383c9d0a2f50bd6faf153cb5d04169b8af1905d6c70d5c67185203bdad550ca4b4cacd20a8ba3bafacd9ab1bf0f42550f374784384997ca15a521fa39a2bb91f9d6ef272019d9c341d8b466eb623177a0c5b6ddb49bd96f8d4f694e24b17bb4326c8b29137cef51457a6661ed7c5b127af53b0622ea6e4ef18c14e2e023aec93bbb786bb0ff283c8fa9c32f68d299c8d955ec25bfb9", 0x9a}], 0x7, &(0x7f0000001680)=[@cred={{0x18, 0x1, 0x2, {0x0, 0xffffffffffffffff, 0xee01}}}, @rights={{0x24, 0x1, 0x1, [r0, 0xffffffffffffffff, r0, r0, r0, r0]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, r6, r0, r6]}}, @cred={{0x18, 0x1, 0x2, {r1, r2, r3}}}, @cred={{0x18, 0x1, 0x2, {r1, r4, r5}}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r0, r0, r7, r0]}}, @rights={{0x14, 0x1, 0x1, [r0, r0]}}], 0xec}, 0x48080) io_uring_setup(0x8, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x17b}) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902"], 0x0) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r8, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r8, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-write$6lowpan_control-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000240)={0x2, 0xa, 0x6, 0x101, 0xfffffe0e, 0x6, 0x0}) program crashed: INFO: task hung in pn533_usb_send_frame single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-write$6lowpan_control-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-write$6lowpan_control-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-write$6lowpan_control-syz_usb_ep_read-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-write$6lowpan_control-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$6lowpan_control-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, 0x0, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(0x0, 0x74, 0x105b01) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$usbfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x74, 0x105b01) program crashed: INFO: task hung in pn533_usb_send_frame validation run: crashed=true reproducing took 2h17m42.162740717s repro crashed as (corrupted=false): INFO: task kworker/0:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:23360 pid:9 tgid:9 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:1:10 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:23688 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:2:1234 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:24232 pid:1234 tgid:1234 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:3:5349 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:22960 pid:5349 tgid:5349 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.3.20:5891 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:26568 pid:5891 tgid:5891 ppid:5760 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71e762b RSP: 002b:00000000f75df58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f75df650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task kworker/0:5:5892 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:5 state:D stack:24296 pid:5892 tgid:5892 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5893 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27384 pid:5893 tgid:5893 ppid:5753 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf715762b RSP: 002b:00000000f754f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f754f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.1.18:5894 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:26880 pid:5894 tgid:5894 ppid:5763 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf70f762b RSP: 002b:00000000f74ef58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f74ef650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.5.21:5895 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:27288 pid:5895 tgid:5895 ppid:5759 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf717762b RSP: 002b:00000000f756f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f756f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.2.19:5898 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27352 pid:5898 tgid:5898 ppid:5761 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71a762b RSP: 002b:00000000f759f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f759f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: locks held by kworker/0:0/9: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b4c31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b4c31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888076f191d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888076f191d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888076cf81a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888076cf81a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805d7fc430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/0:1/10: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807dabc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807dabc1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888035d751a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888035d751a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805cc8b430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/u8:0/12: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888059dc6258 (&devlink->lock_key#27){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:1/13: 3, on CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by pr/ttyS0/16: 2, last CPU#1: #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9bd4be38 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bd4be38 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by kworker/1:0/25: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5021d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5021d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888078d5b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888078d5b1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805c32c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805c32c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802a06a430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 2, last CPU#0: #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:2/1234: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b1391d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b1391d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888079e5f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888079e5f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805d0d71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805d0d71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807f7bb430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/u8:10/3346: 3, on CPU#0: #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4230 locks held by kworker/0:3/5349: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805d7fd1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805d7fd1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807dabd1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807dabd1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888078e15430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by getty/5375: 2, on CPU#0: #0: ffff8880376410a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000323b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/1:4/5828: 2, last CPU#1: #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:5/5845: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b7021d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b7021d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888026e8d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888026e8d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b75d1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b75d1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805b321430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/1:7/5857: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6b31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6b31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880276e01d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880276e01d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b75f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b75f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805b323430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.3.20/5891: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:5/5892: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3af1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3af1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807e3401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807e3401d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807dabf1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807dabf1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888033f02430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.0.17/5893: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5894: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.21/5895: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:7/5897: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6051d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6051d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805c6c81d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805c6c81d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880276e71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880276e71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff8880223c8430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.2.19/5898: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:11/5986: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5c61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5c61d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802d7d31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802d7d31d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ca1a1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ca1a1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805c436430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.6.22/5988: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.26/5989: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.23/5990: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.24/5991: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.25/5992: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.27/6065: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.28/6085: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.29/6086: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.31/6087: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.30/6088: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.32/6160: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.33/6173: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.34/6174: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.36/6175: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.35/6176: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.37/6260: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.38/6267: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.39/6268: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.41/6269: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.40/6270: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.42/6345: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.44/6360: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.43/6362: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.45/6363: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.46/6364: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6384: 1, on CPU#0: #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 locks held by syz.3.47/6387: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6389: 3, on CPU#0: #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2864 [inline] #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: do_setlink+0x3d4/0x4670 net/core/rtnetlink.c:3181 #2: ffffffff8fd62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8fd62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:966 locks held by syz-executor/6403: 4, on CPU#1: #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline] #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888041778880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acd060 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/6410: 7, last CPU#0: #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline] #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804177a880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acd060 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline] #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369 #5: ffff8880485e0258 (&devlink->lock_key#25){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1724 #6: ffff88804de3f160 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #6: ffff88804de3f160 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 fs/libfs.c:619 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409 Code: e8 3e 6d 53 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5f 4d c4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff37a9700 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8574a2e0 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9bd4be60 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7f13500 CR3: 0000000073720000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x679/0x880 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/0:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:23360 pid:9 tgid:9 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:1:10 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:23688 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:2:1234 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:24232 pid:1234 tgid:1234 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:3:5349 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:22960 pid:5349 tgid:5349 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.3.20:5891 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:26568 pid:5891 tgid:5891 ppid:5760 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71e762b RSP: 002b:00000000f75df58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f75df650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task kworker/0:5:5892 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:5 state:D stack:24296 pid:5892 tgid:5892 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_usb_send_frame+0x31d/0x5e0 drivers/nfc/pn533/usb.c:187 pn533_send_cmd_frame drivers/nfc/pn533/pn533.c:444 [inline] __pn533_send_async+0x4d2/0x730 drivers/nfc/pn533/pn533.c:473 pn533_send_cmd_async drivers/nfc/pn533/pn533.c:512 [inline] pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:633 [inline] pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2537 [inline] pn533_finalize_setup+0x28b/0xf80 drivers/nfc/pn533/pn533.c:2734 pn533_usb_probe+0xd37/0x10e0 drivers/nfc/pn533/usb.c:572 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713 hub_port_connect drivers/usb/core/hub.c:5585 [inline] hub_port_connect_change drivers/usb/core/hub.c:5725 [inline] port_event drivers/usb/core/hub.c:5889 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5893 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27384 pid:5893 tgid:5893 ppid:5753 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf715762b RSP: 002b:00000000f754f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f754f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.1.18:5894 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:26880 pid:5894 tgid:5894 ppid:5763 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf70f762b RSP: 002b:00000000f74ef58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f74ef650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.5.21:5895 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:27288 pid:5895 tgid:5895 ppid:5759 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf717762b RSP: 002b:00000000f756f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f756f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 INFO: task syz.2.19:5898 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27352 pid:5898 tgid:5898 ppid:5761 task_flags:0x400040 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5029 do_file_open+0x23e/0x4a0 fs/namei.c:5058 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71a762b RSP: 002b:00000000f759f58c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f759f650 RDX: 0000000000105b01 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: locks held by kworker/0:0/9: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b4c31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b4c31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888076f191d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888076f191d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888076cf81a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888076cf81a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805d7fc430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/0:1/10: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807dabc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807dabc1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888035d751a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888035d751a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805cc8b430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/u8:0/12: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888059dc6258 (&devlink->lock_key#27){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:1/13: 3, on CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by pr/ttyS0/16: 2, last CPU#1: #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8fc36518 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9bd4be38 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bd4be38 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by kworker/1:0/25: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5021d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5021d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888078d5b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888078d5b1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805c32c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805c32c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802a06a430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 2, last CPU#0: #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888033a1a940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:2/1234: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000558fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b1391d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b1391d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888079e5f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888079e5f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805d0d71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805d0d71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807f7bb430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/u8:10/3346: 3, on CPU#0: #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888033b11140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000e76fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4230 locks held by kworker/0:3/5349: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003587c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805d7fd1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805d7fd1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807dabd1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807dabd1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888078e15430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by getty/5375: 2, on CPU#0: #0: ffff8880376410a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000323b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/1:4/5828: 2, last CPU#1: #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900040d7c40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:5/5845: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900038a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b7021d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b7021d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888026e8d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888026e8d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b75d1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b75d1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805b321430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by kworker/1:7/5857: 6, on CPU#1: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900037a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6b31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6b31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880276e01d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880276e01d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b75f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b75f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805b323430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.3.20/5891: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:5/5892: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003757c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3af1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3af1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807e3401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807e3401d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807dabf1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807dabf1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888033f02430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.0.17/5893: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5894: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.21/5895: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:7/5897: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003727c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6051d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6051d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805c6c81d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805c6c81d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880276e71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880276e71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff8880223c8430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.2.19/5898: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:11/5986: 6, on CPU#0: #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888021eb4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002f47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5c61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5c61d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802d7d31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802d7d31d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ca1a1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ca1a1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88805c436430 (&priv->cmd_lock){+.+.}-{4:4}, at: __pn533_send_async+0x279/0x730 drivers/nfc/pn533/pn533.c:470 locks held by syz.6.22/5988: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.26/5989: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.23/5990: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.24/5991: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.25/5992: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.27/6065: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.28/6085: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.29/6086: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.31/6087: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.30/6088: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.32/6160: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.33/6173: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.34/6174: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.36/6175: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.35/6176: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.37/6260: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.38/6267: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.39/6268: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.41/6269: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.40/6270: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.42/6345: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.44/6360: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.43/6362: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.45/6363: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.46/6364: 1, on CPU#1: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6384: 1, on CPU#0: #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 locks held by syz.3.47/6387: 1, on CPU#0: #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5801d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6389: 3, on CPU#0: #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91255c80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2864 [inline] #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff888043100e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: do_setlink+0x3d4/0x4670 net/core/rtnetlink.c:3181 #2: ffffffff8fd62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8fd62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:966 locks held by syz-executor/6403: 4, on CPU#1: #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline] #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888041778880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acd060 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/6410: 7, last CPU#0: #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline] #0: ffff888037f74460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804177a880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a82be18 (kn->active#57){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acd060 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline] #4: ffff8880485e1128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369 #5: ffff8880485e0258 (&devlink->lock_key#25){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1724 #6: ffff88804de3f160 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #6: ffff88804de3f160 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 fs/libfs.c:619 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409 Code: e8 3e 6d 53 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5f 4d c4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff37a9700 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8574a2e0 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9bd4be60 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7f13500 CR3: 0000000073720000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x679/0x880 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245