INFO: task jbd2/sda1-8:2819 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8     state:D
 stack:25880 pid:2819  tgid:2819  ppid:2      task_flags:0x240040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5260 [inline]
 __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
 __schedule_loop kernel/sched/core.c:6949 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:6964
 io_schedule+0x8a/0xf0 kernel/sched/core.c:7791
 bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250
 __wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52
 out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67
 wait_on_bit_io include/linux/wait_bit.h:105 [inline]
 __wait_on_buffer+0x64/0x70 fs/buffer.c:123
 wait_on_buffer include/linux/buffer_head.h:420 [inline]
 journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline]
 jbd2_journal_commit_transaction+0x4851/0x6680 fs/jbd2/commit.c:881
 kjournald2+0x200/0x760 fs/jbd2/journal.c:201
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Showing all locks held in the system:
1 lock held by kworker/R-mm_pe/13:
5 locks held by kworker/1:0/23:
1 lock held by khungtaskd/30:
 #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
3 locks held by kworker/1:1/38:
3 locks held by kworker/u8:4/85:
 #0: ffff888112226148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90000557ca8 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734
2 locks held by kworker/u8:5/324:
 #0: ffff888100089948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90001787ca8 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
1 lock held by kworker/u8:6/325:
 #0: ffffffff89393408 (wq_pool_attach_mutex){+.+.}-{4:4}, at: set_pf_worker kernel/workqueue.c:3346 [inline]
 #0: ffffffff89393408 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_thread+0x642/0xe40 kernel/workqueue.c:3379
3 locks held by kworker/1:2/1121:
 #0: ffff888100072948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90001dcfca8 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x10e0 net/wireless/reg.c:2453
5 locks held by kworker/u8:9/1447:
 #0: ffff888100ac4948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000204fca8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xab/0x900 net/core/net_namespace.c:670
 #3: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
 #3: ffffffff8a8ccfe8 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
 #4: ffffffff894e6b78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
2 locks held by getty/2920:
 #0: 
ffff888115bd00a0
 (&tty->ldisc_sem){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900000452f0 (
&ldata->atomic_read_lock){+.+.}-{4:4}
, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
3 locks held by kworker/0:2/5212:
 #0: ffff888100071948
 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: 
ffffc90003f0fca8
 (free_ipc_work){+.+.}-{0:0}
, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff894e6b78 (rcu_state.exp_mutex){+.+.}-{4:4}
, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
4 locks held by udevd/5237:
 #0: ffff88811444c668 (
&p->lock
){+.+.}-{4:4}
, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:182
 #1: 
ffff8881f57390d8
 (&rq->__lock
){-.-.}-{2:2}, at: do_notify_parent+0x6fd/0xf90 kernel/signal.c:2231
 #2: ffff888115fac8b8 (&sig->wait_chldexit){....}-{3:3}, at: __wake_up_common_lock kernel/sched/wait.c:124 [inline]
 #2: ffff888115fac8b8 (&sig->wait_chldexit){....}-{3:3}, at: __wake_up_sync_key+0x1c/0x50 kernel/sched/wait.c:192
 #3: ffff888115dcf558 (&ep->lock){....}-{3:3}, at: ep_poll_callback+0x80/0xbe0 fs/eventpoll.c:1256
4 locks held by udevd/5238:
 #0: ffff888114148e80 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:182
 #1: ffff88811b6dec88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
 #2: ffff8881357d7f08 (kn->active#9){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff8881357d7f08 (kn->active#9){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
 #3: ffff88811ac22198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
 #3: ffff88811ac22198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
5 locks held by kworker/1:4/5286:
 #0: ffff888105e84148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9001197fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffff88810a3e6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff88810a3e6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
 #3: ffff88810d3a0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88810d3a0198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 drivers/usb/core/hub.c:2336
 #4: ffff88810ff69160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff88810ff69160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1104 [inline]
 #4: ffff88810ff69160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xaa/0x600 drivers/base/dd.c:1302
4 locks held by kworker/1:7/5570:
 #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc900121bfca8 ((work_completion)(&dev->request_module_wk)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8a52f3c8 (em28xx_devlist_mutex){+.+.}-{4:4}, at: em28xx_init_extension+0x2f/0x200 drivers/media/usb/em28xx/em28xx-core.c:1113
 #3: ffffffff8a2e0f48 (input_mutex){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
 #3: ffffffff8a2e0f48 (input_mutex){+.+.}-{4:4}, at: input_register_device.cold+0x5b/0x375 drivers/input/input.c:2374
1 lock held by syz-executor/5849:
 #0: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
1 lock held by syz-executor/5870:
 #0: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
1 lock held by syz-executor/5875:
 #0: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
1 lock held by syz-executor/5919:
 #0: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
1 lock held by syz-executor/5921:
 #0: ffffffff8a8b49b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
1 lock held by syz-executor/5949:
1 lock held by syz-executor/5951:
1 lock held by syz-executor/5957:
1 lock held by syz-executor/5964:
2 locks held by kworker/u8:0/5977:
 #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90003f5fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
2 locks held by kworker/u8:3/6173:
 #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90003f4fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
1 lock held by modprobe/6196:
1 lock held by modprobe/6199:
1 lock held by modprobe/6201:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6201 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
RIP: 0010:__lock_acquire+0x341/0x2630 kernel/locking/lockdep.c:5187
Code: 38 c7 44 0f 47 f8 80 be c6 00 00 00 02 44 0f 44 f8 41 83 c6 01 48 83 c3 28 44 3b b5 a0 0a 00 00 0f 8d b2 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 10 d5 42 0d 72 a9 44 8b 1d 27 81
RSP: 0018:ffffc9002936f628 EFLAGS: 00000006
RAX: 000000000000019e RBX: ffff8881148dc528 RCX: 0000000000000003
RDX: 0000000000000001 RSI: ffff8881148dc500 RDI: 0000000000000000
RBP: ffff8881148dba80 R08: 0000000000000000 R09: 000000000000001a
R10: 0000000000000003 R11: 0000000000000000 R12: ffff8881148dc5a0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
FS:  0000000000000000(0000) GS:ffff888268a6a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a3a92de9c CR3: 00000000092a8000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock_sched include/linux/rcupdate.h:958 [inline]
 pfn_valid include/linux/mmzone.h:2183 [inline]
 page_table_check_clear+0x67/0x9e0 mm/page_table_check.c:70
 __page_table_check_pte_clear+0xf1/0x100 mm/page_table_check.c:154
 page_table_check_pte_clear include/linux/page_table_check.h:51 [inline]
 ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1270 [inline]
 get_and_clear_full_ptes include/linux/pgtable.h:725 [inline]
 zap_present_folio_ptes mm/memory.c:1626 [inline]
 zap_present_ptes mm/memory.c:1708 [inline]
 do_zap_pte_range mm/memory.c:1810 [inline]
 zap_pte_range mm/memory.c:1854 [inline]
 zap_pmd_range mm/memory.c:1946 [inline]
 zap_pud_range mm/memory.c:1975 [inline]
 zap_p4d_range mm/memory.c:1996 [inline]
 unmap_page_range+0x214b/0x39e0 mm/memory.c:2017
 unmap_single_vma+0x153/0x240 mm/memory.c:2059
 unmap_vmas+0x218/0x470 mm/memory.c:2101
 exit_mmap+0x181/0xae0 mm/mmap.c:1277
 __mmput kernel/fork.c:1173 [inline]
 mmput+0xe0/0x430 kernel/fork.c:1196
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2a30 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 __do_sys_exit_group kernel/exit.c:1123 [inline]
 __se_sys_exit_group kernel/exit.c:1121 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
 x64_sys_call+0x14fd/0x1510 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0a3aa8c6c5
Code: Unable to access opcode bytes at 0x7f0a3aa8c69b.
RSP: 002b:00007ffc969a3c68 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f0a3ab8dfe8 RCX: 00007f0a3aa8c6c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007ffc969a3bf8 R09: 0000000000000000
R10: 00007ffc969a3a90 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f0a3ab8c680 R15: 00007f0a3ab8e000
 </TASK>