INFO: task jbd2/sda1-8:2815 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:jbd2/sda1-8 state:D stack:26536 pid:2815 tgid:2815 ppid:2 task_flags:0x240040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0xeb1/0x4220 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7008 io_schedule+0x8a/0xf0 kernel/sched/core.c:7835 bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250 __wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67 wait_on_bit_io include/linux/wait_bit.h:105 [inline] __wait_on_buffer+0x64/0x70 fs/buffer.c:124 wait_on_buffer include/linux/buffer_head.h:420 [inline] journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline] jbd2_journal_commit_transaction+0x49a6/0x6900 fs/jbd2/commit.c:881 kjournald2+0x200/0x760 fs/jbd2/journal.c:201 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 3 locks held by kworker/0:0/9: #0: ffff88810006b148 ( (wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251 #1: ffffc9000009fd18 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252 #2: ffffffff896ea2f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311 3 locks held by kworker/1:0/23: 1 lock held by khungtaskd/30: #0: ffffffff896de6e0 (rcu_read_lock ){....}-{1:3} , at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] , at: rcu_read_lock include/linux/rcupdate.h:850 [inline] , at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 2 locks held by kworker/u8:6/321: 2 locks held by kworker/1:2/916: 2 locks held by getty/2916: #0: ffff888112bc80a0 (&tty->ldisc_sem ){++++}-{0:0} , at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000432f0 (&ldata->atomic_read_lock ){+.+.}-{4:4} , at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 1 lock held by sshd-session/2951: 3 locks held by kworker/1:3/5226: 4 locks held by udevd/5231: #0: ffff888124fc88b8 ( &p->lock ){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183 #1: ffff88810fbabc88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff8881150a5b48 (kn->active#16){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff8881150a5b48 (kn->active#16){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff88813d767198 (&dev->mutex){....}-{4:4} , at: device_lock_interruptible include/linux/device.h:900 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 6 locks held by kworker/1:6/5294: 5 locks held by kworker/0:6/5356: 8 locks held by kworker/1:8/9469: 6 locks held by kworker/0:1/11753: 3 locks held by kworker/0:4/14328: 2 locks held by kworker/u8:1/15256: #0: ffff8881000ac948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251 #1: ffffc90001b8fd18 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252 3 locks held by kworker/0:3/15559: 1 lock held by syz-executor/17490: #0: ffffffff896ea2f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 2 locks held by modprobe/17869: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xd25/0x1050 kernel/hung_task.c:515 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: yealink 2-1:36.0: urb_ctl_callback - urb status -71 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5294 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:univ8250_console_write+0x2f/0x90 drivers/tty/serial/8250/8250_core.c:396 Code: 54 41 89 d4 55 48 89 f5 53 48 89 fb e8 2a 53 92 fe 48 8d 7b 4a 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 01 38 d0 7c 04 84 d2 75 32 48 0f bf 73 4a RSP: 0018:ffffc900001a8590 EFLAGS: 00000806 RAX: dffffc0000000000 RBX: ffffffff89c75c20 RCX: 0000000000000008 RDX: 0000000000000000 RSI: ffffffff831f91f6 RDI: ffffffff89c75c6a RBP: ffffffff93ff36e0 R08: 000000006922f0dd R09: 000000000000000f R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000066 R13: ffffffff89c75c78 R14: ffffc900001a8630 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8882687ce000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb74131bfe0 CR3: 0000000117574000 CR4: 00000000003506f0 Call Trace: console_emit_next_record kernel/printk/printk.c:3183 [inline] console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4913 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4924 __dev_printk+0xcb/0x100 drivers/base/core.c:4936 _dev_err+0xef/0x127 drivers/base/core.c:4979 urb_ctl_callback.cold+0x41/0x8c drivers/input/misc/yealink.c:456 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1785 [inline] __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866 handle_softirqs+0x1de/0x9d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 96 20 23 fa 48 89 df e8 7e 70 23 fa f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 e5 e6 16 fa 65 8b 05 5e 5f 89 05 85 c0 74 16 5b RSP: 0018:ffffc90003657038 EFLAGS: 00000246 RAX: 0000000000000002 RBX: ffffffff940fcb30 RCX: 0000000000000080 RDX: 0000000000000000 RSI: ffffffff89022879 RDI: ffffffff87afc6a0 RBP: 0000000000000286 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888117638000 __debug_check_no_obj_freed lib/debugobjects.c:1125 [inline] debug_check_no_obj_freed+0x31f/0x630 lib/debugobjects.c:1146 __free_pages_prepare mm/page_alloc.c:1440 [inline] __free_frozen_pages+0x34e/0xfb0 mm/page_alloc.c:2978 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] __kmalloc_cache_noprof+0x254/0x6b0 mm/slub.c:5375 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] device_private_init drivers/base/core.c:3534 [inline] device_add+0xd3a/0x1950 drivers/base/core.c:3585 usb_create_ep_devs+0x160/0x2b0 drivers/usb/core/endpoint.c:162 create_intf_ep_devs.isra.0+0x161/0x200 drivers/usb/core/message.c:1312 usb_set_configuration+0xdb9/0x1c60 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:961 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1033 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x64/0x160 drivers/base/bus.c:574 device_add+0x11d9/0x1950 drivers/base/core.c:3689 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245