* [syzbot] INFO: task hung in hub_event (3)
@ 2023-01-14 20:19 syzbot
2026-08-06 8:36 ` [syzbot] [usb?] " syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2023-01-14 20:19 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, m.grzeschik, mathias.nyman,
raychi, stern, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 97ec4d559d93 Merge tag 'block-6.2-2023-01-13' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c11516480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2b6ecad960fc703e
dashboard link: https://syzkaller.appspot.com/bug?extid=a7edecbf389d11a369d4
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9e9ef163c5e9/disk-97ec4d55.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3dc9c1e25304/vmlinux-97ec4d55.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7d859b6029ba/bzImage-97ec4d55.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a7edecbf389d11a369d4@syzkaller.appspotmail.com
INFO: task kworker/0:5:17966 blocked for more than 143 seconds.
Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:5 state:D stack:24608 pid:17966 ppid:2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5293 [inline]
__schedule+0xb8a/0x5450 kernel/sched/core.c:6606
schedule+0xde/0x1b0 kernel/sched/core.c:6682
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6741
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747
hub_port_connect drivers/usb/core/hub.c:5302 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
port_event drivers/usb/core/hub.c:5709 [inline]
hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x669/0x1090 kernel/workqueue.c:2436
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
INFO: task kworker/1:2:12207 blocked for more than 144 seconds.
Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2 state:D stack:27256 pid:12207 ppid:2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5293 [inline]
__schedule+0xb8a/0x5450 kernel/sched/core.c:6606
schedule+0xde/0x1b0 kernel/sched/core.c:6682
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6741
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747
hub_port_connect drivers/usb/core/hub.c:5302 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
port_event drivers/usb/core/hub.c:5709 [inline]
hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x669/0x1090 kernel/workqueue.c:2436
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8c790fb0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8c790cb0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507
1 lock held by khungtaskd/28:
#0: ffffffff8c791b00 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x57/0x264 kernel/locking/lockdep.c:6494
1 lock held by kworker/0:1H/52:
#0: ffff8880b983b598 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:545 [inline]
#0: ffff8880b983b598 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x90/0x120 kernel/sched/core.c:530
2 locks held by getty/4748:
#0: ffff88802bd3b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 drivers/tty/tty_ldisc.c:244
#1: ffffc900015a02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 drivers/tty/n_tty.c:2177
1 lock held by syz-executor.1/5113:
5 locks held by kworker/0:5/17966:
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260
#1: ffffc9000210fda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264
#2: ffff88814725d190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:831 [inline]
#2: ffff88814725d190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c0/0x4810 drivers/usb/core/hub.c:5737
#3: ffff8881472a04f8 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3145 [inline]
#3: ffff8881472a04f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5301 [inline]
#3: ffff8881472a04f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#3: ffff8881472a04f8 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#3: ffff8881472a04f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x277c/0x4810 drivers/usb/core/hub.c:5791
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5302 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
5 locks held by kworker/0:9/19328:
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260
#1: ffffc9000471fda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264
#2: ffff888021fff190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:831 [inline]
#2: ffff888021fff190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c0/0x4810 drivers/usb/core/hub.c:5737
#3: ffff8881473b24f8 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3145 [inline]
#3: ffff8881473b24f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5301 [inline]
#3: ffff8881473b24f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#3: ffff8881473b24f8 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#3: ffff8881473b24f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x277c/0x4810 drivers/usb/core/hub.c:5791
#4: ffff88801c847a68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5302 [inline]
#4: ffff88801c847a68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#4: ffff88801c847a68 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#4: ffff88801c847a68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
5 locks held by kworker/0:0/25428:
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260
#1: ffffc900047efda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264
#2: ffff888147237190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:831 [inline]
#2: ffff888147237190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c0/0x4810 drivers/usb/core/hub.c:5737
#3: ffff88814724a4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3145 [inline]
#3: ffff88814724a4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5301 [inline]
#3: ffff88814724a4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#3: ffff88814724a4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#3: ffff88814724a4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x277c/0x4810 drivers/usb/core/hub.c:5791
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5302 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
5 locks held by kworker/1:23/26875:
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260
#1: ffffc9000ba3fda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264
#2: ffff8881472ab190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:831 [inline]
#2: ffff8881472ab190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c0/0x4810 drivers/usb/core/hub.c:5737
#3: ffff8881472ae4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3145 [inline]
#3: ffff8881472ae4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5301 [inline]
#3: ffff8881472ae4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#3: ffff8881472ae4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#3: ffff8881472ae4f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x277c/0x4810 drivers/usb/core/hub.c:5791
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5302 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#4: ffff88814697d468 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
2 locks held by kworker/u4:1/8522:
5 locks held by kworker/1:2/12207:
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
#0: ffff888017ef0938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260
#1: ffffc9000319fda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264
#2: ffff888147221190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:831 [inline]
#2: ffff888147221190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c0/0x4810 drivers/usb/core/hub.c:5737
#3: ffff8881472244f8 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3145 [inline]
#3: ffff8881472244f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5301 [inline]
#3: ffff8881472244f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#3: ffff8881472244f8 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#3: ffff8881472244f8 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x277c/0x4810 drivers/usb/core/hub.c:5791
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5302 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5549 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5709 [inline]
#4: ffff888147205368 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x27b1/0x4810 drivers/usb/core/hub.c:5791
1 lock held by syz-executor.2/16250:
#0: ffff8880b983b598 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:545 [inline]
#0: ffff8880b983b598 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x90/0x120 kernel/sched/core.c:530
2 locks held by sed/16260:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x24/0x18a lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x333/0x3c0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xc75/0xfc0 kernel/hung_task.c:377
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_idle_do_entry+0x1fd/0x2a0 drivers/acpi/processor_idle.c:570
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in hub_event (3)
2023-01-14 20:19 [syzbot] INFO: task hung in hub_event (3) syzbot
@ 2026-08-06 8:36 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2026-08-06 8:36 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, m.grzeschik, mathias.nyman,
raychi, stern, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 0d8395707651 Merge tag 'soc-fixes-7.2-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12b3bcc6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=66aad665ba86f060
dashboard link: https://syzkaller.appspot.com/bug?extid=a7edecbf389d11a369d4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d477b9580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a7edecbf389d11a369d4@syzkaller.appspotmail.com
INFO: task kworker/1:2:30 blocked for more than 15 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:2 state:D stack:25208 pid:30 tgid:30 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17e7/0x5630 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
hub_port_connect drivers/usb/core/hub.c:5465 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x20c9/0x4d30 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Showing all locks held in the system:
5 locks held by kworker/1:2/30:
#0: ffff88801fa98140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801fa98140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc90000a67c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc90000a67c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffff88802ab031d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#2: ffff88802ab031d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
#3: ffff88802ab00568 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3252 [inline]
#3: ffff88802ab00568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5464 [inline]
#3: ffff88802ab00568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#3: ffff88802ab00568 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#3: ffff88802ab00568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 drivers/usb/core/hub.c:5953
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5465 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 drivers/usb/core/hub.c:5953
1 lock held by khungtaskd/32:
#0: ffffffff8e959c20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e959c20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e959c20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
1 lock held by klogd/4964:
2 locks held by getty/5365:
#0: ffff888035fc90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
5 locks held by kworker/1:3/5730:
#0: ffff88801fa98140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88801fa98140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#1: ffffc9000362fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000362fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffff88802aaa91d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#2: ffff88802aaa91d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
#3: ffff88802aaaf568 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3252 [inline]
#3: ffff88802aaaf568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5464 [inline]
#3: ffff88802aaaf568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#3: ffff88802aaaf568 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#3: ffff88802aaaf568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 drivers/usb/core/hub.c:5953
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5465 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5871 [inline]
#4: ffff88802a929260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 drivers/usb/core/hub.c:5953
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: fc 7c 02 e9 fe df 5c f5 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 0e 16 00 fb f4 <e9> d7 df 5c f5 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8e607de0 EFLAGS: 00000242
RAX: 00000000000b648f RBX: ffffffff819a152c RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8e03ecd2 RDI: ffffffff8c2c1c80
RBP: ffffffff8e607eb8 R08: ffff8880b86338db R09: 1ffff110170c671b
R10: dffffc0000000000 R11: ffffed10170c671c R12: 0000000000000000
R13: 1ffffffff1cd1de8 R14: 1ffffffff1cc0fc4 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125182000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e85c1d0b11 CR3: 000000000e746000 CR4: 0000000000350ef0
Call Trace:
<TASK>
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x1cc/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
rest_init+0x2de/0x300 init/main.c:717
start_kernel+0x392/0x3e0 init/main.c:1175
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x157
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-06 8:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-14 20:19 [syzbot] INFO: task hung in hub_event (3) syzbot
2026-08-06 8:36 ` [syzbot] [usb?] " syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox