From: syzbot <syzbot+d0688023306aea3aefdc@syzkaller.appspotmail.com>
To: anna-maria@linutronix.de, frederic@kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tglx@kernel.org
Subject: [syzbot] [kernel?] INFO: task hung in mmc_stop_host
Date: Mon, 24 Aug 2026 17:03:34 -0700 [thread overview]
Message-ID: <6a8cdbd6.dbb3a75c.7844.0012.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 388b607d107c Merge tag 'efi-next-for-v7.3' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1519c625580000
kernel config: https://syzkaller.appspot.com/x/.config?x=335632b21d0ce540
dashboard link: https://syzkaller.appspot.com/bug?extid=d0688023306aea3aefdc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/20c420e92df0/disk-388b607d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/82f836a86dcc/vmlinux-388b607d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c3b00ac47be8/bzImage-388b607d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d0688023306aea3aefdc@syzkaller.appspotmail.com
INFO: task kworker/0:4:1939 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4 state:D stack:21280 pid:1939 tgid:1939 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x17d4/0x5820 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7362
schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153
__flush_work+0xa63/0xca0 kernel/workqueue.c:4439
__cancel_work_sync+0xbf/0x110 kernel/workqueue.c:4559
__mmc_stop_host drivers/mmc/core/core.c:2368 [inline]
mmc_stop_host+0xd9/0x460 drivers/mmc/core/core.c:2373
mmc_remove_host+0x15/0x60 drivers/mmc/core/host.c:681
vub300_disconnect+0x154/0x2f0 drivers/mmc/host/vub300.c:2387
usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:618 [inline]
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372
bus_remove_device+0x444/0x560 drivers/base/bus.c:664
device_del+0x524/0x8f0 drivers/base/core.c:3965
usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478
usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5415 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
port_event drivers/usb/core/hub.c:5879 [inline]
hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5961
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task kworker/0:8:1944 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:8 state:D stack:21512 pid:1944 tgid:1944 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: events_freezable mmc_rescan
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x17d4/0x5820 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7362
schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153
mmc_wait_for_req_done+0x37/0x490 drivers/mmc/core/core.c:408
mmc_wait_for_cmd+0x183/0x2a0 drivers/mmc/core/core.c:645
mmc_io_rw_direct_host drivers/mmc/core/sdio_ops.c:83 [inline]
sdio_reset+0xf4/0x3a0 drivers/mmc/core/sdio_ops.c:209
mmc_rescan_try_freq drivers/mmc/core/core.c:2121 [inline]
mmc_rescan+0x6eb/0x1040 drivers/mmc/core/core.c:2316
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Showing all locks held in the system:
locks held by khungtaskd/31: 1, last CPU#1:
#0: ffffffff8ed5a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ed5a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ed5a420 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6793
locks held by getty/5366: 2, on CPU#1:
#0: ffff8880364560a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/0:4/1939: 5, on CPU#0:
#0: ffff88801eaa2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801eaa2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801eaa2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#0: ffff88801eaa2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#1: ffffc90003e7fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc90003e7fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc90003e7fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#1: ffffc90003e7fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#2: ffff8880265631d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff8880265631d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907
#3: ffff8880677ae1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff8880677ae1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336
#4: ffff888053cc71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff888053cc71a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#4: ffff888053cc71a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
locks held by kworker/0:8/1944: 2, on CPU#0:
#0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#1: ffffc90003b4fc40 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc90003b4fc40 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc90003b4fc40 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#1: ffffc90003b4fc40 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 1002 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:mark_usage kernel/locking/lockdep.c:4636 [inline]
RIP: 0010:__lock_acquire+0x5d5/0x2cf0 kernel/locking/lockdep.c:5207
Code: fe e8 4f 88 76 03 e9 69 ff ff ff 44 89 e0 38 44 24 10 76 16 e8 5c 86 35 03 85 c0 74 0d 83 3d 95 3d d7 0e 00 0f 84 93 07 00 00 <85> ed 0f 84 96 00 00 00 41 8b 45 20 66 85 c0 78 7e 65 8b 0d af 51
RSP: 0018:ffffc900051575b8 EFLAGS: 00000046
RAX: 0000000000000004 RBX: ffff888028192ba8 RCX: 0000000000000004
RDX: 0000000000000004 RSI: 0000000000000005 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff816ac8cf R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8ebfd3a0 R12: 0000000000000004
R13: ffff888028192b88 R14: ffff888028191f40 R15: 0000000000000004
FS: 0000000000000000(0000) GS:ffff888124df4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c359880 CR3: 000000000eb46000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
arch_jump_label_transform_queue+0x5f/0x110 arch/x86/kernel/jump_label.c:136
__jump_label_update+0x189/0x370 kernel/jump_label.c:513
static_key_disable_cpuslocked+0xc5/0x1a0 kernel/jump_label.c:240
static_key_disable+0x1a/0x20 kernel/jump_label.c:248
toggle_allocation_gate+0x1fe/0x290 mm/kfence/core.c:918
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-08-25 0:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a8cdbd6.dbb3a75c.7844.0012.GAE@google.com \
--to=syzbot+d0688023306aea3aefdc@syzkaller.appspotmail.com \
--cc=anna-maria@linutronix.de \
--cc=frederic@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.