INFO: task jbd2/sda1-8:2817 blocked in I/O wait for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8 state:D
stack:26952 pid:2817 tgid:2817 ppid:2 task_flags:0x240040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5387 [inline]
__schedule+0xf89/0x4840 kernel/sched/core.c:7188
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
io_schedule+0x8a/0xf0 kernel/sched/core.c:8109
bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250
__wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52
out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67
wait_on_bit_io include/linux/wait_bit.h:105 [inline]
__wait_on_buffer+0x64/0x70 fs/buffer.c:123
wait_on_buffer include/linux/buffer_head.h:420 [inline]
journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline]
jbd2_journal_commit_transaction+0x494c/0x6870 fs/jbd2/commit.c:910
kjournald2+0x200/0x760 fs/jbd2/journal.c:201
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
2 locks held by kworker/0:0/9:
5 locks held by kworker/u8:0/12:
3 locks held by kworker/1:0/23:
4 locks held by kworker/1:1/28:
1 lock held by khungtaskd/30:
#0:
ffffffff896ddaa0
(
rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:1/32:
#0:
ffff888113345940
(
(wq_completion)ipv6_addrconf
){+.+.}-{0:0}
, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1:
ffffc90000227d18
(
(work_completion)(&(&net->ipv6.addr_chk_work)->work)
){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2:
ffffffff8aaf92a0
(rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
(rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4746
3 locks held by kworker/1:2/2513:
6 locks held by kworker/1:3/2815:
2 locks held by udevd/2857:
2 locks held by getty/2919:
#0: ffff8881087f00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1:
ffffc900000452e8
(&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211
8 locks held by kworker/0:5/5231:
#0:
ffff888105ef4d40
((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277
#1: ffffc9000227fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278
#2: ffff88810d7041d8 (&dev->mutex){....}-{4:4}
, at: device_lock include/linux/device.h:1040 [inline]
, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88813cd811d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff88813cd811d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#4:
ffff88810fbdf1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
ffff88810fbdf1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#5:
ffff8881251a5a58
(
&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
#6:
ffffffff8a8a8468
(
minors_rwsem){+.+.}-{4:4}
, at: hidraw_connect+0x75/0x440 drivers/hid/hidraw.c:612
#7:
ffff888100e87980
(&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x38/0x850 fs/kernfs/dir.c:826
5 locks held by kworker/1:6/5442:
1 lock held by syz.4.94/5521:
2 locks held by syz-executor/5528:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5531:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5533:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5536:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5545:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5575:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/5586:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2102
2 locks held by syz-executor/5588:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2102
2 locks held by syz-executor/5596:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2102
2 locks held by syz-executor/5602:
#0:
ffffffff8aae0868
(
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:575
#1:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: register_netdevice_notifier_net+0x23/0xb0 net/core/dev.c:2102
1 lock held by syz-executor/5625:
#0:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/5630:
#0:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/5633:
#0:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/5638:
#0:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/5641:
#0:
ffffffff8aaf92a0
(
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
yealink 2-1:36.0: urb_irq_callback - urb status -71
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5442 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_power_efficient gc_worker
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:408
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d c3 cc cc cc cc e8 d1 ce f4 fe eb a0 e8 5a cf f4
RSP: 0018:ffffc900001a8490 EFLAGS: 00000002
RAX: 0000000000000031 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff83232705 RDI: ffffffff941d8d40
RBP: ffffffff941d8d00 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000031 R14: 0000000000000010 R15: ffffffff832326a0
FS: 0000000000000000(0000) GS:ffff8882687a9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d7b534fd8 CR3: 00000000094ac000 CR4: 00000000003506f0
Call Trace:
serial_port_out include/linux/serial_core.h:811 [inline]
serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3217 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3279 [inline]
serial8250_console_write+0xde8/0x1900 drivers/tty/serial/8250/8250_port.c:3357
console_emit_next_record kernel/printk/printk.c:3183 [inline]
console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4930
dev_printk_emit+0xd2/0x10d drivers/base/core.c:4941
__dev_printk+0xcb/0x100 drivers/base/core.c:4953
_dev_err+0xef/0x127 drivers/base/core.c:4996
urb_irq_callback.cold+0x41/0xfd drivers/input/misc/yealink.c:418
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011
handle_softirqs+0x1dd/0x9e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 fb 6b 68 0b 83 f8 07 0f 87 d9 02 00 00 48 0f a3 05 86 95 61 09 0f 82 a4 02 00 00 8b 35 0e a5 61 09 85 f6 0f 85 bf 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d 6b 68 0b 0f 85 ed 02 00 00 48 83 c4
RSP: 0018:ffffc9000221fad8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff890a43d9 RDI: ffffffff87b04160
RBP: ffffffff896ddaa0 R08: 000000008ff434a7 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
gc_worker+0x222/0x1630 net/netfilter/nf_conntrack_core.c:1543
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 48 8d 7d 40 lea 0x40(%rbp),%rdi
4: 44 89 e1 mov %r12d,%ecx
7: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
e: fc ff df
11: 48 89 fa mov %rdi,%rdx
14: d3 e3 shl %cl,%ebx
16: 48 c1 ea 03 shr $0x3,%rdx
1a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1e: 75 1c jne 0x3c
20: 66 03 5d 40 add 0x40(%rbp),%bx
24: 44 89 e8 mov %r13d,%eax
27: 89 da mov %ebx,%edx
29: ee out %al,(%dx)
* 2a: 5b pop %rbx <-- trapping instruction
2b: 5d pop %rbp
2c: 41 5c pop %r12
2e: 41 5d pop %r13
30: c3 ret
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: e8 d1 ce f4 fe call 0xfef4cf0b
3a: eb a0 jmp 0xffffffdc
3c: e8 .byte 0xe8
3d: 5a pop %rdx
3e: cf iret
3f: f4 hlt