[v5.15] INFO: task hung in virtio_cleanup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8020ae3c051d Linux 5.15.103
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1556da16c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f95b212e0ccdd4d1
dashboard link: https://syzkaller.appspot.com/bug?extid=0412dc78d4107e624ce9
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114dd3bec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=155ddb11c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6153dfa8dcc0/disk-8020ae3c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2093d52db59f/vmlinux-8020ae3c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85041d0bd356/Image-8020ae3c.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0412dc...@syzkaller.appspotmail.com

INFO: task kworker/1:0:21 blocked for more than 143 seconds.
Not tainted 5.15.103-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D stack: 0 pid: 21 ppid: 2 flags:0x00000008
Workqueue: usb_hub_wq hub_event
Call trace:
__switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
context_switch kernel/sched/core.c:5023 [inline]
__schedule+0xfcc/0x1f1c kernel/sched/core.c:6369
schedule+0x11c/0x1c8 kernel/sched/core.c:6452
schedule_timeout+0xb8/0x344 kernel/time/timer.c:1860
do_wait_for_common+0x214/0x388 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x4c/0x64 kernel/sched/completion.c:138
virtio_cleanup+0x7c/0xa4 drivers/char/hw_random/virtio-rng.c:85
cleanup_rng drivers/char/hw_random/core.c:82 [inline]
kref_put include/linux/kref.h:65 [inline]
drop_current_rng+0xa8/0x140 drivers/char/hw_random/core.c:110
set_current_rng+0x358/0x4ac drivers/char/hw_random/core.c:97
hwrng_register+0x31c/0x4c8 drivers/char/hw_random/core.c:500
chaoskey_probe+0x618/0x92c drivers/usb/misc/chaoskey.c:205
usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396
really_probe+0x26c/0xaec drivers/base/dd.c:595
__driver_probe_device+0x1bc/0x3f8 drivers/base/dd.c:750
driver_probe_device+0x78/0x34c drivers/base/dd.c:780
__device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:902
bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427
__device_attach+0x2f0/0x480 drivers/base/dd.c:974
device_initial_probe+0x24/0x34 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487
device_add+0xae0/0xef4 drivers/base/core.c:3394
usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238
usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293
really_probe+0x26c/0xaec drivers/base/dd.c:595
__driver_probe_device+0x1bc/0x3f8 drivers/base/dd.c:750
driver_probe_device+0x78/0x34c drivers/base/dd.c:780
__device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:902
bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427
__device_attach+0x2f0/0x480 drivers/base/dd.c:974
device_initial_probe+0x24/0x34 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487
device_add+0xae0/0xef4 drivers/base/core.c:3394
usb_new_device+0x8fc/0x1448 drivers/usb/core/hub.c:2568
hub_port_connect drivers/usb/core/hub.c:5358 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
port_event drivers/usb/core/hub.c:5648 [inline]
hub_event+0x22e4/0x48c4 drivers/usb/core/hub.c:5730
process_one_work+0x84c/0x14b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

Showing all locks held in the system:
6 locks held by kworker/1:0/21:
#0: ffff0000c2796138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x66c/0x14b8 kernel/workqueue.c:2279
#1: ffff800018a97c00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x14b8 kernel/workqueue.c:2281
#2: ffff0000cf172220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff0000cf172220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c8/0x48c4 drivers/usb/core/hub.c:5676
#3: ffff0000ce5b1220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#3: ffff0000ce5b1220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x90/0x480 drivers/base/dd.c:949
#4: ffff0000ce5b21a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#4: ffff0000ce5b21a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x90/0x480 drivers/base/dd.c:949
#5: ffff800015b3ce28 (rng_mutex){+.+.}-{3:3}, at: hwrng_register+0xb4/0x4c8 drivers/char/hw_random/core.c:473
1 lock held by khungtaskd/27:
#0: ffff800014b92620 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:268
1 lock held by hwrng/1218:
#0: ffff800015b3ce28 (rng_mutex){+.+.}-{3:3}, at: get_current_rng+0x28/0x120 drivers/char/hw_random/core.c:127
2 locks held by getty/3738:
#0: ffff0000d431a098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x40/0x50 drivers/tty/tty_ldsem.c:340
#1: ffff80001a1ce2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1200 drivers/tty/n_tty.c:2147

=============================================



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches