INFO: task jbd2/sda1-8:2818 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8     state:D
 stack:26584 pid:2818  tgid:2818  ppid:2      task_flags:0x240040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xeb1/0x41f0 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7004
 io_schedule+0x8a/0xf0 kernel/sched/core.c:7831
 bit_wait_io+0xd/0xe0 kernel/sched/wait_bit.c:250
 __wait_on_bit+0x65/0x180 kernel/sched/wait_bit.c:52
 out_of_line_wait_on_bit+0xdc/0x110 kernel/sched/wait_bit.c:67
 wait_on_bit_io include/linux/wait_bit.h:105 [inline]
 __wait_on_buffer+0x64/0x70 fs/buffer.c:124
 wait_on_buffer include/linux/buffer_head.h:420 [inline]
 journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline]
 jbd2_journal_commit_transaction+0x49a6/0x6900 fs/jbd2/commit.c:881
 kjournald2+0x200/0x760 fs/jbd2/journal.c:201
 kthread+0x370/0x450 kernel/kthread.c:467
 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
10 locks held by kworker/1:0/23:
2 locks held by kworker/1:1/28:
1 lock held by khungtaskd/30:
 #0: 
ffffffff896e05a0
 (
rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:5/70:
 #0: 
ffff888101299148
 (
(wq_completion)netns
){+.+.}-{0:0}
, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
 #1: 
ffffc9000142fd18
 (
net_cleanup_work
){+.+.}-{0:0}
, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
 #2: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: cleanup_net+0xb8/0x9e0 net/core/net_namespace.c:675
 #3: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: ipmr_net_exit_batch+0x15/0xa0 net/ipv4/ipmr.c:3276
2 locks held by getty/2919:
 #0: 
ffff8881160710a0
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: 
ffffc900000432f0
 (
&ldata->atomic_read_lock
){+.+.}-{4:4}
, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by udevd/5206:
2 locks held by kworker/1:4/5224:
2 locks held by kworker/1:5/5237:
1 lock held by udevd/5276:
1 lock held by udevd/5277:
4 locks held by kworker/1:6/8049:
 #0: 
ffff8881062f5148
 (
(wq_completion)usb_hub_wq
){+.+.}-{0:0}
, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
 #1: 
ffffc90015fbfd18
 (
(work_completion)(&hub->events)
){+.+.}-{0:0}
, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
 #2: 
ffff88810afd3198 (
&dev->mutex
){....}-{4:4}
, at: device_lock include/linux/device.h:895 [inline]
, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
 #3: 
ffff888101298188
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_add_one+0x38/0x850 fs/kernfs/dir.c:796
2 locks held by syz-executor/10520:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff896ec080
 (
rcu_state.barrier_mutex
){+.+.}-{4:4}
, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3828
2 locks held by syz-executor/10533:
 #0: 
ffffffff8aae0830
 (pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff896ec080
 (
rcu_state.barrier_mutex
){+.+.}-{4:4}
, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3828
2 locks held by syz-executor/10536:
2 locks held by syz-executor/10539:
3 locks held by syz-executor/10543:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline]
, at: register_netdev+0x18/0x50 net/core/dev.c:11524
 #2: 
ffff888101298188
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_add_one+0x38/0x850 fs/kernfs/dir.c:796
2 locks held by syz-executor/10571:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/10581:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/10593:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/10595:
 #0: 
ffffffff8aae0830
 (pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz-executor/10598:
 #0: 
ffffffff8aae0830
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: copy_net_ns+0x41e/0x780 net/core/net_namespace.c:577
 #1: 
ffff888101298188
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_add_one+0x38/0x850 fs/kernfs/dir.c:796
1 lock held by syz-executor/10623:
 #0: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/10627:
 #0: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/10633:
 #0: ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/10635:
 #0: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
1 lock held by syz-executor/10636:
 #0: 
ffffffff8aaf8e68
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xd25/0x1050 kernel/hung_task.c:515
 kthread+0x370/0x450 kernel/kthread.c:467
 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
yealink 4-1:36.0: urb_irq_callback - urb status -71
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 28 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_power_efficient gc_worker
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:407
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d c3 cc cc cc cc e8 31 24 f6 fe eb a0 e8 ba 24 f6
RSP: 0000:ffffc900001a8450 EFLAGS: 00000002
RAX: 0000000000000020 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff831f6585 RDI: ffffffff941ae5c0
RBP: ffffffff941ae580 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000020 R14: 0000000000000010 R15: ffffffff831f6520
FS:  0000000000000000(0000) GS:ffff8882687d3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e223ffc CR3: 00000000094ae000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 serial_port_out include/linux/serial_core.h:811 [inline]
 serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3192 [inline]
 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3264 [inline]
 serial8250_console_write+0xde8/0x1900 drivers/tty/serial/8250/8250_port.c:3342
 console_emit_next_record kernel/printk/printk.c:3183 [inline]
 console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269
 console_flush_all kernel/printk/printk.c:3343 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3413
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
 dev_vprintk_emit+0x394/0x3e0 drivers/base/core.c:4913
 dev_printk_emit+0xd2/0x10d drivers/base/core.c:4924
 __dev_printk+0xcb/0x100 drivers/base/core.c:4936
 _dev_err+0xef/0x127 drivers/base/core.c:4979
 urb_irq_callback.cold+0x41/0xfd drivers/input/misc/yealink.c:418
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1785 [inline]
 __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866
 handle_softirqs+0x1de/0x9d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__seqprop_spinlock_sequence include/linux/seqlock.h:228 [inline]
RIP: 0010:nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:343 [inline]
RIP: 0010:gc_worker+0x2bb/0x1630 net/netfilter/nf_conntrack_core.c:1548
Code: 00 00 48 c7 c7 88 29 f0 8a e8 01 a5 15 fb 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 0f a2 38 fb 58 48 85 db 0f 85 93 0f 00 00 <e8> 20 a7 38 fb 8b 1d 9a 16 77 04 89 dd 31 ff 83 e5 01 89 ee e8 bc
RSP: 0000:ffffc900001e7b58 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff86791d76
RDX: ffff8881026b9d00 RSI: ffffffff86791d85 RDI: ffff8881026b9d00
RBP: 00000000000166af R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000040000 R14: 000000000000b358 R15: 0000000000001770
 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
 process_scheduled_works kernel/workqueue.c:3358 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3439
 kthread+0x370/0x450 kernel/kthread.c:467
 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>