gfs2_kill_sb() issues a synchronous log flush before stopping the gfs2_logd and
gfs2_quotad kthreads. Given a corrupted filesystem image, that flush can spend a
long time while holding sd_log_flush_lock. Since the background threads are
still alive at that point, gfs2_logd can be woken and block on sd_log_flush_lock
in gfs2_logd(), and gfs2_quotad can block on the same lock through
gfs2_statfs_sync() -> __gfs2_trans_begin(). The threads can then remain in
uninterruptible sleep long enough to trigger the hung task.

Stop the background threads before the kill_sb log flush. gfs2_destroy_threads()
waits for both kthreads to exit via kthread_stop_put(), so after it returns
there is no live logd or quotad thread that can wait behind sd_log_flush_lock.

Closes: https://lore.kernel.org/lkml/CANypQFasb8voDrg=O9xJikYHdRFeupb5VP2VeJaZ_wFNMoGr2Q@mail.gmail.com/
Assisted-by: Codex:gpt-5.5-xhigh
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
---
 fs/gfs2/ops_fstype.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 718e0da7dfce..65c536fffefd 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1777,6 +1777,8 @@ static void gfs2_kill_sb(struct super_block *sb)
 		return;
 	}
 
+	gfs2_destroy_threads(sdp);
+
 	gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_SYNC | GFS2_LFC_KILL_SB);
 	dput(sdp->sd_root_dir);
 	dput(sdp->sd_master_dir);
-- 
2.43.0