Extracting prog: 3m43.259753132s
Minimizing prog: 55m52.862636767s
Simplifying prog options: 0s
Extracting C: 3m5.319695561s
Simplifying C: 17m19.691570141s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program crashed: INFO: task hung in jbd2_journal_commit_transaction
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
pwrite64(0xffffffffffffffff, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-pwrite64
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, 0x0, 0x0, 0x2)

program did not crash
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0), 0x0, 0x2)

program did not crash
extracting C reproducer
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in jbd2_journal_commit_transaction
simplifying C reproducer
testing compiled C program (duration=5m29.00893553s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in do_get_write_access
a never seen crash title: INFO: task hung in do_get_write_access, ignore
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in do_get_write_access
a never seen crash title: INFO: task hung in do_get_write_access, ignore
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in jbd2_journal_commit_transaction
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in do_get_write_access
a never seen crash title: INFO: task hung in do_get_write_access, ignore
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in do_get_write_access
a never seen crash title: INFO: task hung in do_get_write_access, ignore
testing compiled C program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
program crashed: INFO: task hung in jbd2_journal_commit_transaction
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program crashed: INFO: task hung in do_get_write_access
validation run: crashed=true
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program crashed: INFO: task hung in jbd2_journal_commit_transaction
validation run: crashed=true
testing program (duration=5m29.00893553s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-pwrite64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f00000004c0)="02155e65", 0x4, 0x2)

program crashed: INFO: task hung in jbd2_journal_commit_transaction
validation run: crashed=true
reproducing took 1h28m18.141547466s
repro crashed as (corrupted=false):
INFO: task jbd2/sda1-8:74 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8     state:D stack:0     pid:74    tgid:74    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 __wait_on_buffer+0x5a/0x70 fs/buffer.c:123
 wait_on_buffer include/linux/buffer_head.h:422 [inline]
 jbd2_journal_commit_transaction+0x2dba/0x5510 fs/jbd2/commit.c:814
 kjournald2+0x386/0x6a0 fs/jbd2/journal.c:201
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.5.545:1448 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.545       state:D stack:0     pid:1448  tgid:1448  ppid:381    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fe1328668b1
RSP: 002b:00007ffe2b8012a0 EFLAGS: 00010202
RAX: 0000001b33e64000 RBX: 0000000000000000 RCX: 000000000003fde8
RDX: 0000001b33e63fff RSI: 0000000000000008 RDI: 00007fe133755720
RBP: 00007fe133755720 R08: 0000000000000000 R09: 00007fe132c26038
R10: 00007fe133755700 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
 </TASK>
INFO: task syz.4.544:1451 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.544       state:D stack:0     pid:1451  tgid:1451  ppid:382    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f54eda668b1
RSP: 002b:00007fff49485280 EFLAGS: 00010202
RAX: 0000001b34764000 RBX: 0000000000000000 RCX: 000000000003fde8
RDX: 0000001b34763fff RSI: 0000000000000008 RDI: 00007f54ee955720
RBP: 00007f54ee955720 R08: 0000000000000000 R09: 00007f54ede26038
R10: 00007f54ee955700 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
 </TASK>
INFO: task syz.1.543:1453 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.543       state:D stack:0     pid:1453  tgid:1453  ppid:383    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f9d19e6bae3
RSP: 002b:00007fff4e9dd8f0 EFLAGS: 00010246
RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000001b34624000 RSI: 0000000000040000 RDI: 00007f9d1a1e2708
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff4e9ddb80
 </TASK>
INFO: task syz.0.546:1454 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.546       state:D stack:0     pid:1454  tgid:1454  ppid:380    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f9d34c6bae3
RSP: 002b:00007ffe3ac56c50 EFLAGS: 00010246
RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000001b34524000 RSI: 0000000000040000 RDI: 00007f9d34fe2708
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe3ac56ee0
 </TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:114
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:63
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 cpumask_backtrace+0x1f/0x30 lib/nmi_backtrace.c:127
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xe45/0xf90 kernel/hung_task.c:423
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 100 Comm: klogd Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:___update_load_sum kernel/sched/pelt.c:183 [inline]
RIP: 0010:__update_load_avg_se+0x19b/0xdc0 kernel/sched/pelt.c:325
Code: 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 0d 4c 89 ff e8 b8 10 7f 00 4c 8b 44 24 10 4d 8b 3f 48 8b 44 24 30 42 c6 44 28 04 04 <c7> 84 24 80 00 00 00 00 00 00 00 49 89 dc 49 c1 ec 03 43 80 3c 2c
RSP: 0018:ffffc900007ff4c0 EFLAGS: 00000046
RAX: 1ffff920000ffea4 RBX: ffff88810b77e080 RCX: dffffc0000000000
RDX: ffff88810b77dfc0 RSI: ffff8881f6f4fe40 RDI: ffff88810b77e010
RBP: ffffc900007ff5b8 R08: ffff88810b77dfc0 R09: 0000000000000000
R10: ffff88810b77dfd8 R11: ffffed10216efbfd R12: ffff88810b77e011
R13: dffffc0000000000 R14: ffff88810b77e080 R15: ffff88810b77dfc0
FS:  00007fcc43e2ac80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff71a549300 CR3: 000000010bb0a000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 update_load_avg+0x115/0x1980 kernel/sched/fair.c:4951
 put_prev_entity+0x70/0x160 kernel/sched/fair.c:5840
 pick_next_task_fair+0x725/0x7a0 kernel/sched/fair.c:9228
 __pick_next_task kernel/sched/core.c:6723 [inline]
 pick_next_task kernel/sched/core.c:7243 [inline]
 __schedule+0x682/0x20b0 kernel/sched/core.c:7781
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 unix_wait_for_peer+0x1f6/0x300 net/unix/af_unix.c:1540
 unix_dgram_sendmsg+0x114a/0x1a90 net/unix/af_unix.c:2144
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 __sys_sendto+0x663/0x6e0 net/socket.c:2197
 __do_sys_sendto net/socket.c:2204 [inline]
 __se_sys_sendto net/socket.c:2200 [inline]
 __x64_sys_sendto+0xe9/0x100 net/socket.c:2200
 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fcc43f7a407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff880bdeb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcc43e2ac80 RCX: 00007fcc43f7a407
RDX: 0000000000000051 RSI: 00007fff880bdff0 RDI: 0000000000000003
RBP: 00007fff880be420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007fff880be438
R13: 00007fff880bdff0 R14: 0000000000000036 R15: 00007fff880bdff0
 </TASK>

final repro crashed as (corrupted=false):
INFO: task jbd2/sda1-8:74 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8     state:D stack:0     pid:74    tgid:74    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 __wait_on_buffer+0x5a/0x70 fs/buffer.c:123
 wait_on_buffer include/linux/buffer_head.h:422 [inline]
 jbd2_journal_commit_transaction+0x2dba/0x5510 fs/jbd2/commit.c:814
 kjournald2+0x386/0x6a0 fs/jbd2/journal.c:201
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.5.545:1448 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.545       state:D stack:0     pid:1448  tgid:1448  ppid:381    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fe1328668b1
RSP: 002b:00007ffe2b8012a0 EFLAGS: 00010202
RAX: 0000001b33e64000 RBX: 0000000000000000 RCX: 000000000003fde8
RDX: 0000001b33e63fff RSI: 0000000000000008 RDI: 00007fe133755720
RBP: 00007fe133755720 R08: 0000000000000000 R09: 00007fe132c26038
R10: 00007fe133755700 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
 </TASK>
INFO: task syz.4.544:1451 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.544       state:D stack:0     pid:1451  tgid:1451  ppid:382    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f54eda668b1
RSP: 002b:00007fff49485280 EFLAGS: 00010202
RAX: 0000001b34764000 RBX: 0000000000000000 RCX: 000000000003fde8
RDX: 0000001b34763fff RSI: 0000000000000008 RDI: 00007f54ee955720
RBP: 00007f54ee955720 R08: 0000000000000000 R09: 00007f54ede26038
R10: 00007f54ee955700 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
 </TASK>
INFO: task syz.1.543:1453 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.543       state:D stack:0     pid:1453  tgid:1453  ppid:383    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f9d19e6bae3
RSP: 002b:00007fff4e9dd8f0 EFLAGS: 00010246
RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000001b34624000 RSI: 0000000000040000 RDI: 00007f9d1a1e2708
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff4e9ddb80
 </TASK>
INFO: task syz.0.546:1454 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.546       state:D stack:0     pid:1454  tgid:1454  ppid:380    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:6063 [inline]
 __schedule+0x1496/0x20b0 kernel/sched/core.c:7883
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 io_schedule+0x85/0x150 kernel/sched/core.c:8790
 bit_wait_io+0x17/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0xb6/0x2e0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x139/0x190 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:101 [inline]
 do_get_write_access+0x558/0xd70 fs/jbd2/transaction.c:1096
 jbd2_journal_get_write_access+0x268/0x3d0 fs/jbd2/transaction.c:1245
 __ext4_journal_get_write_access+0x1b6/0x6a0 fs/ext4/ext4_jbd2.c:239
 ext4_reserve_inode_write+0x1f6/0x2e0 fs/ext4/inode.c:5892
 __ext4_mark_inode_dirty+0xac/0x5e0 fs/ext4/inode.c:6066
 ext4_dirty_inode+0xc9/0x110 fs/ext4/inode.c:6103
 __mark_inode_dirty+0x24e/0xc50 fs/fs-writeback.c:2515
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2069 [inline]
 __file_update_time fs/inode.c:2258 [inline]
 file_update_time+0x1d3/0x210 fs/inode.c:2288
 ext4_page_mkwrite+0x2bf/0x1120 fs/ext4/inode.c:6221
 do_page_mkwrite mm/memory.c:3263 [inline]
 do_shared_fault mm/memory.c:5537 [inline]
 do_fault mm/memory.c:5599 [inline]
 do_pte_missing+0x12c4/0x4440 mm/memory.c:4069
 handle_pte_fault mm/memory.c:5940 [inline]
 __handle_mm_fault mm/memory.c:6083 [inline]
 handle_mm_fault+0x1189/0x1ba0 mm/memory.c:6251
 do_user_addr_fault+0x951/0x1230 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1479 [inline]
 exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f9d34c6bae3
RSP: 002b:00007ffe3ac56c50 EFLAGS: 00010246
RAX: 000000000003fde8 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000001b34524000 RSI: 0000000000040000 RDI: 00007f9d34fe2708
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe3ac56ee0
 </TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:114
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:63
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 cpumask_backtrace+0x1f/0x30 lib/nmi_backtrace.c:127
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xe45/0xf90 kernel/hung_task.c:423
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 100 Comm: klogd Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:___update_load_sum kernel/sched/pelt.c:183 [inline]
RIP: 0010:__update_load_avg_se+0x19b/0xdc0 kernel/sched/pelt.c:325
Code: 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 0d 4c 89 ff e8 b8 10 7f 00 4c 8b 44 24 10 4d 8b 3f 48 8b 44 24 30 42 c6 44 28 04 04 <c7> 84 24 80 00 00 00 00 00 00 00 49 89 dc 49 c1 ec 03 43 80 3c 2c
RSP: 0018:ffffc900007ff4c0 EFLAGS: 00000046
RAX: 1ffff920000ffea4 RBX: ffff88810b77e080 RCX: dffffc0000000000
RDX: ffff88810b77dfc0 RSI: ffff8881f6f4fe40 RDI: ffff88810b77e010
RBP: ffffc900007ff5b8 R08: ffff88810b77dfc0 R09: 0000000000000000
R10: ffff88810b77dfd8 R11: ffffed10216efbfd R12: ffff88810b77e011
R13: dffffc0000000000 R14: ffff88810b77e080 R15: ffff88810b77dfc0
FS:  00007fcc43e2ac80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff71a549300 CR3: 000000010bb0a000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 update_load_avg+0x115/0x1980 kernel/sched/fair.c:4951
 put_prev_entity+0x70/0x160 kernel/sched/fair.c:5840
 pick_next_task_fair+0x725/0x7a0 kernel/sched/fair.c:9228
 __pick_next_task kernel/sched/core.c:6723 [inline]
 pick_next_task kernel/sched/core.c:7243 [inline]
 __schedule+0x682/0x20b0 kernel/sched/core.c:7781
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 unix_wait_for_peer+0x1f6/0x300 net/unix/af_unix.c:1540
 unix_dgram_sendmsg+0x114a/0x1a90 net/unix/af_unix.c:2144
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 __sys_sendto+0x663/0x6e0 net/socket.c:2197
 __do_sys_sendto net/socket.c:2204 [inline]
 __se_sys_sendto net/socket.c:2200 [inline]
 __x64_sys_sendto+0xe9/0x100 net/socket.c:2200
 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fcc43f7a407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff880bdeb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcc43e2ac80 RCX: 00007fcc43f7a407
RDX: 0000000000000051 RSI: 00007fff880bdff0 RDI: 0000000000000003
RBP: 00007fff880be420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007fff880be438
R13: 00007fff880bdff0 R14: 0000000000000036 R15: 00007fff880bdff0
 </TASK>