INFO: task hung in usb_register_dev

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 768a0741 usb: dwc2: gadget: Remove assigned but never used..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=14bc067b100000
kernel config: https://syzkaller.appspot.com/x/.config?x=999be4eb2478ffa5
dashboard link: https://syzkaller.appspot.com/bug?extid=e761775e8f4a28711f19
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e76177...@syzkaller.appspotmail.com

INFO: task kworker/0:6:3156 blocked for more than 143 seconds.
Not tainted 5.8.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:6 D23384 3156 2 0x80004000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:3453 [inline]
__schedule+0x88a/0x1cb0 kernel/sched/core.c:4178
schedule+0xcd/0x2b0 kernel/sched/core.c:4253
rwsem_down_write_slowpath+0x603/0xc60 kernel/locking/rwsem.c:1235
__down_write kernel/locking/rwsem.c:1389 [inline]
down_write+0x13c/0x150 kernel/locking/rwsem.c:1532
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x740 drivers/usb/core/file.c:156
adu_probe+0x6a3/0x830 drivers/usb/misc/adutux.c:733
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:374
really_probe+0x291/0xc90 drivers/base/dd.c:525
driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:701
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:807
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
__device_attach+0x28d/0x430 drivers/base/dd.c:873
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
device_add+0xb09/0x1b40 drivers/base/core.c:2680
usb_set_configuration+0xf05/0x18a0 drivers/usb/core/message.c:2032
usb_generic_driver_probe+0xba/0xf2 drivers/usb/core/generic.c:241
usb_probe_device+0xd9/0x250 drivers/usb/core/driver.c:272
really_probe+0x291/0xc90 drivers/base/dd.c:525
driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:701
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:807
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
__device_attach+0x28d/0x430 drivers/base/dd.c:873
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
device_add+0xb09/0x1b40 drivers/base/core.c:2680
usb_new_device.cold+0x71d/0xfd4 drivers/usb/core/hub.c:2554
hub_port_connect drivers/usb/core/hub.c:5208 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
port_event drivers/usb/core/hub.c:5494 [inline]
hub_event+0x2361/0x4390 drivers/usb/core/hub.c:5576
process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
kthread+0x392/0x470 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
INFO: task kworker/0:0:15224 blocked for more than 143 seconds.
Not tainted 5.8.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:0 D23480 15224 2 0x80004000
Workqueue: usb_hub_wq hub_event
Call Trace:
context_switch kernel/sched/core.c:3453 [inline]
__schedule+0x88a/0x1cb0 kernel/sched/core.c:4178
schedule+0xcd/0x2b0 kernel/sched/core.c:4253
rwsem_down_write_slowpath+0x603/0xc60 kernel/locking/rwsem.c:1235
__down_write kernel/locking/rwsem.c:1389 [inline]
down_write+0x13c/0x150 kernel/locking/rwsem.c:1532
usb_deregister_dev+0xaa/0x300 drivers/usb/core/file.c:239
wdm_disconnect+0x21/0x450 drivers/usb/class/cdc-wdm.c:979
usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:436
__device_release_driver+0x3b7/0x6e0 drivers/base/dd.c:1113
device_release_driver_internal drivers/base/dd.c:1144 [inline]
device_release_driver+0x26/0x40 drivers/base/dd.c:1167
bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:533
device_del+0x47c/0xd20 drivers/base/core.c:2857
usb_disable_device+0x387/0x930 drivers/usb/core/message.c:1245
usb_disconnect.cold+0x27d/0x780 drivers/usb/core/hub.c:2217
hub_port_connect drivers/usb/core/hub.c:5059 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
port_event drivers/usb/core/hub.c:5494 [inline]
hub_event+0x1c93/0x4390 drivers/usb/core/hub.c:5576
process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
kthread+0x392/0x470 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
INFO: task syz-executor.1:3812 blocked for more than 144 seconds.
Not tainted 5.8.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D29352 3812 346 0x00000004
Call Trace:
context_switch kernel/sched/core.c:3453 [inline]
__schedule+0x88a/0x1cb0 kernel/sched/core.c:4178
schedule+0xcd/0x2b0 kernel/sched/core.c:4253
rwsem_down_read_slowpath+0x2f7/0xc90 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1f0/0x420 kernel/locking/rwsem.c:1494
usb_open+0x23/0x270 drivers/usb/core/file.c:39
chrdev_open+0x266/0x770 fs/char_dev.c:414
do_dentry_open+0x4ff/0x1170 fs/open.c:828
do_open fs/namei.c:3243 [inline]
path_openat+0x192c/0x26b0 fs/namei.c:3360
do_filp_open+0x17e/0x3c0 fs/namei.c:3387
do_sys_openat2+0x16f/0x3b0 fs/open.c:1179
do_sys_open fs/open.c:1195 [inline]
ksys_open include/linux/syscalls.h:1388 [inline]
__do_sys_open fs/open.c:1201 [inline]
__se_sys_open fs/open.c:1199 [inline]
__x64_sys_open+0x119/0x1c0 fs/open.c:1199
do_syscall_64+0x50/0x90 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x416921
Code: Bad RIP value.
RSP: 002b:00007f3dc9c297a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 000000000050a8c0 RCX: 0000000000416921
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007f3dc9c297d0
RBP: 000000000078bf00 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000064 R11: 0000000000000293 R12: 00000000ffffffff
R13: 0000000000000c46 R14: 00000000004ce9a6 R15: 00007f3dc9c2a6d4
INFO: task syz-executor.4:3919 blocked for more than 144 seconds.
Not tainted 5.8.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D29160 3919 343 0x00000004
Call Trace:
context_switch kernel/sched/core.c:3453 [inline]
__schedule+0x88a/0x1cb0 kernel/sched/core.c:4178
schedule+0xcd/0x2b0 kernel/sched/core.c:4253
rwsem_down_read_slowpath+0x2f7/0xc90 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1f0/0x420 kernel/locking/rwsem.c:1494
usb_open+0x23/0x270 drivers/usb/core/file.c:39
chrdev_open+0x266/0x770 fs/char_dev.c:414
do_dentry_open+0x4ff/0x1170 fs/open.c:828
do_open fs/namei.c:3243 [inline]
path_openat+0x192c/0x26b0 fs/namei.c:3360
do_filp_open+0x17e/0x3c0 fs/namei.c:3387
do_sys_openat2+0x16f/0x3b0 fs/open.c:1179
do_sys_open fs/open.c:1195 [inline]
ksys_open include/linux/syscalls.h:1388 [inline]
__do_sys_open fs/open.c:1201 [inline]
__se_sys_open fs/open.c:1199 [inline]
__x64_sys_open+0x119/0x1c0 fs/open.c:1199
do_syscall_64+0x50/0x90 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x416921
Code: Bad RIP value.
RSP: 002b:00007f33da2f47a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 000000000050a8c0 RCX: 0000000000416921
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007f33da2f47d0
RBP: 000000000078bf00 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000064 R11: 0000000000000293 R12: 00000000ffffffff
R13: 0000000000000c46 R14: 00000000004ce9a6 R15: 00007f33da2f56d4

Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: ffffffff873124a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x264 kernel/locking/lockdep.c:5779
1 lock held by in:imklog/237:
#0: ffff8881c717aaf0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:826
2 locks held by agetty/240:
#0: ffff8881d1b94098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267
#1: ffffc90000a022e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x223/0x1a30 drivers/tty/n_tty.c:2156
6 locks held by kworker/0:4/3138:
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x82b/0x15f0 kernel/workqueue.c:2240
#1: ffff8881cfd1fda8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x85f/0x15f0 kernel/workqueue.c:2244
#2: ffff8881d453d218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#2: ffff8881d453d218 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c5/0x4390 drivers/usb/core/hub.c:5522
#3: ffff8881d21b6218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#3: ffff8881d21b6218 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x430 drivers/base/dd.c:850
#4: ffff8881cb5fd1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#4: ffff8881cb5fd1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x430 drivers/base/dd.c:850
#5: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x19d/0x740 drivers/usb/core/file.c:156
6 locks held by kworker/0:6/3156:
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x82b/0x15f0 kernel/workqueue.c:2240
#1: ffff8881ccc37da8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x85f/0x15f0 kernel/workqueue.c:2244
#2: ffff8881d4465218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#2: ffff8881d4465218 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c5/0x4390 drivers/usb/core/hub.c:5522
#3: ffff8881cabba218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#3: ffff8881cabba218 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x430 drivers/base/dd.c:850
#4: ffff8881ce3491a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#4: ffff8881ce3491a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x430 drivers/base/dd.c:850
#5: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x19d/0x740 drivers/usb/core/file.c:156
6 locks held by kworker/0:0/15224:
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
#0: ffff8881d880ed38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x82b/0x15f0 kernel/workqueue.c:2240
#1: ffff8881cc307da8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x85f/0x15f0 kernel/workqueue.c:2244
#2: ffff8881d441d218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#2: ffff8881d441d218 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c5/0x4390 drivers/usb/core/hub.c:5522
#3: ffff8881d2745218 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#3: ffff8881d2745218 (&dev->mutex){....}-{3:3}, at: usb_disconnect.cold+0x43/0x780 drivers/usb/core/hub.c:2208
#4: ffff8881c809d1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:768 [inline]
#4: ffff8881c809d1a8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:936 [inline]
#4: ffff8881c809d1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal drivers/base/dd.c:1141 [inline]
#4: ffff8881c809d1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver+0x1c/0x40 drivers/base/dd.c:1167
#5: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_deregister_dev+0xaa/0x300 drivers/usb/core/file.c:239
2 locks held by agetty/18569:
#0: ffff8881c8d0d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267
#1: ffffc9000f9c42e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x223/0x1a30 drivers/tty/n_tty.c:2156
2 locks held by agetty/3409:
#0: ffff8881ce34b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267
#1: ffffc9000fd982e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x223/0x1a30 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.0/3840:
#0: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x23/0x270 drivers/usb/core/file.c:39
#1: ffff8881c954b0d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
1 lock held by syz-executor.1/3812:
#0: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x23/0x270 drivers/usb/core/file.c:39
1 lock held by syz-executor.4/3919:
#0: ffffffff878ac990 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x23/0x270 drivers/usb/core/file.c:39

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 23 Comm: khungtaskd Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xf6/0x16e lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x74/0xb6 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1da/0x1f4 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
watchdog+0xd6a/0xfd0 kernel/hung_task.c:295
kthread+0x392/0x470 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt+0x72/0x90 drivers/acpi/processor_idle.c:111


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8e6cb5d27e82 usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vb..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing

console output: https://syzkaller.appspot.com/x/log.txt?x=147c6fea300000
kernel config: https://syzkaller.appspot.com/x/.config?x=db8b503c237253ee
dashboard link: https://syzkaller.appspot.com/bug?extid=e761775e8f4a28711f19
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=144874dc300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13f8aa92300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e76177...@syzkaller.appspotmail.com

INFO: task kworker/0:1:7 blocked for more than 143 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:1 state:D stack:25496 pid: 7 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task kworker/0:2:2618 blocked for more than 143 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:2 state:D stack:25496 pid: 2618 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task kworker/0:0:4391 blocked for more than 144 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:0 state:D stack:24504 pid: 4391 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task kworker/0:3:4397 blocked for more than 144 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:3 state:D stack:25128 pid: 4397 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task kworker/0:4:4401 blocked for more than 145 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:4 state:D stack:24368 pid: 4401 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task kworker/0:5:4403 blocked for more than 145 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:5 state:D stack:25416 pid: 4403 ppid: 2 flags:0x00004000

Workqueue: usb_hub_wq hub_event
Call Trace:

context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
rwsem_down_write_slowpath+0x8e3/0x1190 kernel/locking/rwsem.c:1106
__down_write_common kernel/locking/rwsem.c:1261 [inline]
__down_write_common kernel/locking/rwsem.c:1258 [inline]
__down_write kernel/locking/rwsem.c:1270 [inline]
down_write+0x137/0x150 kernel/locking/rwsem.c:1407
usb_register_dev drivers/usb/core/file.c:187 [inline]
usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
sisusb_probe+0x21c/0xbe3 drivers/usb/misc/sisusbvga/sisusb.c:3038
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:517 [inline]
really_probe+0x23c/0xcd0 drivers/base/dd.c:595
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x228/0x4a0 drivers/base/dd.c:965
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc2f/0x2180 drivers/base/core.c:3352
usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2559
hub_port_connect drivers/usb/core/hub.c:5300 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5668
process_one_work+0x98d/0x15b0 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task syz-executor259:4947 blocked for more than 146 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz-executor259 state:D stack:28160 pid: 4947 ppid: 4378 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
schedule_preempt_disabled+0xc/0x20 kernel/sched/core.c:6078
__mutex_lock_common kernel/locking/mutex.c:1036 [inline]
__mutex_lock+0x786/0x1060 kernel/locking/mutex.c:1104
sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
usb_open+0x204/0x2e0 drivers/usb/core/file.c:48
chrdev_open+0x266/0x770 fs/char_dev.c:414
do_dentry_open+0x4c3/0x1110 fs/open.c:826
do_open fs/namei.c:3374 [inline]
path_openat+0x1c23/0x27f0 fs/namei.c:3507
do_filp_open+0x1aa/0x400 fs/namei.c:3534
do_sys_openat2+0x16d/0x420 fs/open.c:1204
do_sys_open fs/open.c:1220 [inline]
__do_sys_openat fs/open.c:1236 [inline]
__se_sys_openat fs/open.c:1231 [inline]
__x64_sys_openat+0x13f/0x1f0 fs/open.c:1231
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x403ce7
RSP: 002b:00007fffe48c13f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 0000000000403ce7
RDX: 0000000000000002 RSI: 00007fffe48c1470 RDI: 00000000ffffff9c
RBP: 00007fffe48c1470 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fffe48c150c R14: 00007fffe48c1520 R15: 00007fffe48c1510
INFO: task syz-executor259:4950 blocked for more than 146 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz-executor259 state:D stack:27640 pid: 4950 ppid: 4382 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
schedule_preempt_disabled+0xc/0x20 kernel/sched/core.c:6078
__mutex_lock_common kernel/locking/mutex.c:1036 [inline]
__mutex_lock+0x786/0x1060 kernel/locking/mutex.c:1104
sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
usb_open+0x204/0x2e0 drivers/usb/core/file.c:48
chrdev_open+0x266/0x770 fs/char_dev.c:414
do_dentry_open+0x4c3/0x1110 fs/open.c:826
do_open fs/namei.c:3374 [inline]
path_openat+0x1c23/0x27f0 fs/namei.c:3507
do_filp_open+0x1aa/0x400 fs/namei.c:3534
do_sys_openat2+0x16d/0x420 fs/open.c:1204
do_sys_open fs/open.c:1220 [inline]
__do_sys_openat fs/open.c:1236 [inline]
__se_sys_openat fs/open.c:1231 [inline]
__x64_sys_openat+0x13f/0x1f0 fs/open.c:1231
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x403ce7
RSP: 002b:00007fffe48c13f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 0000000000403ce7
RDX: 0000000000000002 RSI: 00007fffe48c1470 RDI: 00000000ffffff9c
RBP: 00007fffe48c1470 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fffe48c150c R14: 00007fffe48c1520 R15: 00007fffe48c1510
INFO: task syz-executor259:4952 blocked for more than 146 seconds.
Not tainted 5.14.0-rc1-syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz-executor259 state:D stack:28848 pid: 4952 ppid: 4383 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x941/0x22b0 kernel/sched/core.c:5940
schedule+0xcf/0x270 kernel/sched/core.c:6019
schedule_preempt_disabled+0xc/0x20 kernel/sched/core.c:6078
__mutex_lock_common kernel/locking/mutex.c:1036 [inline]
__mutex_lock+0x786/0x1060 kernel/locking/mutex.c:1104
sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
usb_open+0x204/0x2e0 drivers/usb/core/file.c:48
chrdev_open+0x266/0x770 fs/char_dev.c:414
do_dentry_open+0x4c3/0x1110 fs/open.c:826
do_open fs/namei.c:3374 [inline]
path_openat+0x1c23/0x27f0 fs/namei.c:3507
do_filp_open+0x1aa/0x400 fs/namei.c:3534
do_sys_openat2+0x16d/0x420 fs/open.c:1204
do_sys_open fs/open.c:1220 [inline]
__do_sys_openat fs/open.c:1236 [inline]
__se_sys_openat fs/open.c:1231 [inline]
__x64_sys_openat+0x13f/0x1f0 fs/open.c:1231
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x403ce7
RSP: 002b:00007fffe48c13f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 0000000000403ce7
RDX: 0000000000000002 RSI: 00007fffe48c1470 RDI: 00000000ffffff9c
RBP: 00007fffe48c1470 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fffe48c150c R14: 00007fffe48c1520 R15: 00007fffe48c1510

Showing all locks held in the system:

6 locks held by kworker/0:1/7:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc9000007fdb0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f832220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f832220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b06e220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b06e220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff8881156461a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff8881156461a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
1 lock held by khungtaskd/1275:
#0: ffffffff8767e500 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x269 kernel/locking/lockdep.c:6446
6 locks held by kworker/0:2/2618:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc90007877db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f8f7220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f8f7220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b06f220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b06f220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff888119e851a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff888119e851a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
2 locks held by in:imklog/4301:
6 locks held by kworker/0:0/4391:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc900002c7db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f897220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f897220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b178220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b178220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff888114a4d1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff888114a4d1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
6 locks held by kworker/0:3/4397:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc900002b7db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f96f220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f96f220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b179220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b179220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff888119e501a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff888119e501a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
6 locks held by kworker/0:4/4401:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc90000347db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f907220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f907220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b17a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b17a220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff8881148fc1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff8881148fc1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
6 locks held by kworker/0:5/4403:
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:620 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: ffff88810a489538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x871/0x15b0 kernel/workqueue.c:2247
#1: ffffc90000337db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15b0 kernel/workqueue.c:2251
#2: ffff88810f91f220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#2: ffff88810f91f220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5614
#3: ffff88811b17b220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#3: ffff88811b17b220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#4: ffff888119e821a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:754 [inline]
#4: ffff888119e821a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:940
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev drivers/usb/core/file.c:187 [inline]
#5: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_register_dev+0x19d/0x7e0 drivers/usb/core/file.c:156
2 locks held by syz-executor259/4944:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39
#1: ffff88811b1cf8d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
2 locks held by syz-executor259/4947:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39
#1: ffff88811b1cf8d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
2 locks held by syz-executor259/4950:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39
#1: ffff88811b1cf8d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
2 locks held by syz-executor259/4952:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39
#1: ffff88811b1cf8d0 (&(sisusb->lock)){+.+.}-{3:3}, at: sisusb_open+0xb2/0x4d0 drivers/usb/misc/sisusbvga/sisusb.c:2396
1 lock held by syz-executor259/4971:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39
1 lock held by syz-executor259/4972:
#0: ffffffff87f79730 (minor_rwsem){++++}-{3:3}, at: usb_open+0x24/0x2e0 drivers/usb/core/file.c:39

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1275 Comm: khungtaskd Not tainted 5.14.0-rc1-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
nmi_cpu_backtrace.cold+0x46/0xe0 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1da/0x200 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xcf4/0xf90 kernel/hung_task.c:295
kthread+0x3c0/0x4a0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
NMI backtrace for cpu 0 skipped: idling at acpi_safe_halt drivers/acpi/processor_idle.c:109 [inline]
NMI backtrace for cpu 0 skipped: idling at acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:553

[charu]

Hello ,

Important information for you. See attached.

Password - cvbcvn33

Thank you.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit df05a9b05e466a46725564528b277d0c570d0104
Author: Alan Stern <st...@rowland.harvard.edu>
Date: Mon Apr 10 19:38:22 2023 +0000

USB: sisusbvga: Add endpoint checks

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1286f641280000
start commit: 7d2a07b76933 Linux 5.14
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=b04081cf516e2565
dashboard link: https://syzkaller.appspot.com/bug?extid=e761775e8f4a28711f19
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133519b1300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=116ec82e300000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: USB: sisusbvga: Add endpoint checks

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Alan Stern]

If that commit does fix this problem, it's entirely by accident. I
suspect that instead the commit merely prevents the reproducer from
entering the buggy pathway, but that pathway still exists.

In fact, I'd guess from reading through the driver that the problem is
that it does dozens of I/O operations, with 5-second timeouts and
multiple retries, without checking for errors until the end. All while
holding a contested mutex.

However the driver is not maintained much AFAICT, so it's not likely to
get fixed. It's probably also not used by more than a few people, if
any.

Alan Stern

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.