INFO: task jbd2/sda1-8:2816 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:jbd2/sda1-8 state:D stack:26120 pid:2816 tgid:2816 ppid:2 task_flags:0x240040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0xf89/0x4840 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 io_schedule+0x8a/0xf0 kernel/sched/core.c:8109 bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250 __wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:105 [inline] __wait_on_buffer+0x64/0x70 fs/buffer.c:123 wait_on_buffer include/linux/buffer_head.h:420 [inline] journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline] jbd2_journal_commit_transaction+0x494c/0x6870 fs/jbd2/commit.c:910 kjournald2+0x200/0x760 fs/jbd2/journal.c:201 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 3 locks held by kworker/1:0/23: #0: ffff888105affd40 ( (wq_completion)usb_hub_wq ){+.+.}-{0:0} , at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc9000018fd18 ( (work_completion)(&hub->events) ){+.+.}-{0:0} , at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 #2: ffff88810c7041d8 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:1040 [inline] , at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 1 lock held by khungtaskd/30: #0: ffffffff896ddaa0 ( rcu_read_lock ){....}-{1:3} , at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] , at: rcu_read_lock include/linux/rcupdate.h:838 [inline] , at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/1:2/1121: #0: ffff888105affd40 ( (wq_completion)usb_hub_wq ){+.+.}-{0:0} , at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc9000384fd18 ((work_completion)(&hub->events) ){+.+.}-{0:0} , at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 #2: ffff88810cfa41d8 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:1040 [inline] , at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88812e5801d8 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:1040 [inline] , at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076 #4: ffff88812f1871a0 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:1040 [inline] , at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076 #5: ffffffff8a5148c0 ( input_mutex ){+.+.}-{4:4} , at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline] , at: input_register_device.cold+0x5b/0x375 drivers/input/input.c:2391 3 locks held by jbd2/sda1-8/2816: 1 lock held by udevd/2854: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 2 locks held by getty/2916: #0: ffff8881156930a0 ( &tty->ldisc_sem ){++++}-{0:0} , at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452e8 ( &ldata->atomic_read_lock ){+.+.}-{4:4} , at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211 2 locks held by syz-executor/3525: 1 lock held by syz-executor/3532: #0: ffffffff896e95e8 ( rcu_state.exp_mutex ){+.+.}-{4:4} , at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 1 lock held by syz-executor/3534: #0: ffffffff896e95e8 ( rcu_state.exp_mutex ){+.+.}-{4:4} , at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311 5 locks held by kworker/1:3/5778: 4 locks held by kworker/1:4/5781: 1 lock held by udevd/5791: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 1 lock held by udevd/5792: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 4 locks held by udevd/5839: #0: ffff88812b51fe18 ( &p->lock ){+.+.}-{4:4} , at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183 #1: ffff8881282f4480 ( &of->mutex ){+.+.}-{4:4} , at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff88811aa110f8 ( kn->active #20 ){++++}-{0:0} , at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] , at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff88812e5801d8 ( &dev->mutex ){....}-{4:4} , at: device_lock_interruptible include/linux/device.h:1045 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 5 locks held by kworker/1:5/5894: 2 locks held by syz.7.240/6254: 1 lock held by syz-executor/6257: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 1 lock held by syz-executor/6258: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 1 lock held by syz-executor/6259: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 1 lock held by syz-executor/6260: #0: ffff888100e87980 ( &root->kernfs_rwsem ){++++}-{4:4} , at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1218 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: yealink 8-1:36.0: urb_irq_callback - urb status -71 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3525 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:number+0x602/0xc90 lib/vsprintf.c:529 Code: 31 ff 29 c3 89 44 24 40 89 5c 24 14 e8 a7 08 49 fa 40 84 ed 0f 85 97 00 00 00 e8 49 0e 49 fa 83 eb 01 31 ff 89 de 89 5c 24 14 <89> dd e8 e7 08 49 fa 8b 54 24 14 85 d2 0f 88 64 05 00 00 49 bc 00 RSP: 0018:ffffc900001a7f68 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff87694549 RDX: ffff88811559bb80 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 00000000001be070 R12: 0000000000000166 R13: ffffc900801a8397 R14: 0000000000000003 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff8882687a9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31414ff8 CR3: 00000000094ac000 CR4: 00000000003506f0 Call Trace: vsnprintf+0x30e/0x1240 lib/vsprintf.c:2912 sprintf+0xcc/0x100 lib/vsprintf.c:3111 print_time kernel/printk/printk.c:1359 [inline] info_print_prefix+0x25a/0x350 kernel/printk/printk.c:1385 record_print_text+0x143/0x3c0 kernel/printk/printk.c:1434 printk_get_next_message+0x2d1/0x6c0 kernel/printk/printk.c:3072 console_emit_next_record kernel/printk/printk.c:3137 [inline] console_flush_one_record+0x67c/0xe50 kernel/printk/printk.c:3269 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4930 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4941 __dev_printk+0xcb/0x100 drivers/base/core.c:4953 _dev_err+0xef/0x127 drivers/base/core.c:4996 urb_irq_callback.cold+0x41/0xfd drivers/input/misc/yealink.c:418 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005 __run_hrtimer kernel/time/hrtimer.c:1930 [inline] __hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011 handle_softirqs+0x1dd/0x9e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_release+0x19e/0x310 kernel/locking/lockdep.c:5893 Code: ff 65 0f c1 05 3b a9 68 0b 83 f8 01 0f 85 28 01 00 00 9c 58 f6 c4 02 0f 85 13 01 00 00 41 f7 c6 00 02 00 00 0f 85 c0 00 00 00 <48> 8b 44 24 10 65 48 2b 05 ed 64 68 0b 0f 85 4e 01 00 00 48 83 c4 RSP: 0018:ffffc900017bf470 EFLAGS: 00000206 RAX: 0000000000000046 RBX: ffffffff896dd9e0 RCX: ffffc900017bf47c RDX: 0000000000000003 RSI: ffffffff890a43d9 RDI: ffffffff87b04160 RBP: ffffffff821ccd75 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88811559bb80 R13: 0000000000000001 R14: 0000000000000206 R15: 0000000000000004 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock_sched include/linux/rcupdate.h:960 [inline] pfn_valid include/linux/mmzone.h:2291 [inline] page_table_check_clear+0x17a/0x8f0 mm/page_table_check.c:70 __page_table_check_pte_clear+0xf1/0x100 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1263 [inline] get_and_clear_full_ptes include/linux/pgtable.h:845 [inline] zap_present_folio_ptes mm/memory.c:1632 [inline] zap_present_ptes mm/memory.c:1714 [inline] do_zap_pte_range mm/memory.c:1816 [inline] zap_pte_range mm/memory.c:1918 [inline] zap_pmd_range mm/memory.c:2004 [inline] zap_pud_range mm/memory.c:2032 [inline] zap_p4d_range mm/memory.c:2053 [inline] __zap_vma_range+0x267d/0x41f0 mm/memory.c:2093 unmap_vmas+0x299/0x5f0 mm/memory.c:2162 exit_mmap+0x1ef/0xa10 mm/mmap.c:1300 __mmput kernel/fork.c:1178 [inline] mmput+0xe0/0x430 kernel/fork.c:1201 exit_mm kernel/exit.c:581 [inline] do_exit+0x833/0x2a60 kernel/exit.c:963 do_group_exit+0xd5/0x2a0 kernel/exit.c:1117 get_signal+0x1ec7/0x21e0 kernel/signal.c:3037 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x7e/0x430 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x682/0x7f0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f88c62dc0fc Code: Unable to access opcode bytes at 0x7f88c62dc0d2. RSP: 002b:00007ffeeeafa970 EFLAGS: 00000206 ORIG_RAX: 0000000000000101 RAX: fffffffffffffffe RBX: 000000000000005a RCX: 00007f88c62dc0fc RDX: 0000000000090800 RSI: 00007f88c63726ab RDI: 00000000ffffff9c RBP: 00007ffeeeafaa1c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000002c R13: 0000000000000000 R14: 000000000002a0ed R15: 00007ffeeeafaa70 ---------------- Code disassembly (best guess): 0: 31 ff xor %edi,%edi 2: 29 c3 sub %eax,%ebx 4: 89 44 24 40 mov %eax,0x40(%rsp) 8: 89 5c 24 14 mov %ebx,0x14(%rsp) c: e8 a7 08 49 fa call 0xfa4908b8 11: 40 84 ed test %bpl,%bpl 14: 0f 85 97 00 00 00 jne 0xb1 1a: e8 49 0e 49 fa call 0xfa490e68 1f: 83 eb 01 sub $0x1,%ebx 22: 31 ff xor %edi,%edi 24: 89 de mov %ebx,%esi 26: 89 5c 24 14 mov %ebx,0x14(%rsp) * 2a: 89 dd mov %ebx,%ebp <-- trapping instruction 2c: e8 e7 08 49 fa call 0xfa490918 31: 8b 54 24 14 mov 0x14(%rsp),%edx 35: 85 d2 test %edx,%edx 37: 0f 88 64 05 00 00 js 0x5a1 3d: 49 rex.WB 3e: bc .byte 0xbc