INFO: task syz.4.3998:21393 blocked in I/O wait for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.3998      state:D stack:24328 pid:21393 tgid:21387 ppid:14626  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x16d9/0x5700 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7362
 io_schedule+0x80/0xe0 kernel/sched/core.c:8190
 folio_wait_bit_common+0x83c/0xbc0 mm/filemap.c:1329
 folio_lock include/linux/pagemap.h:1220 [inline]
 migrate_folio_unmap mm/migrate.c:1260 [inline]
 migrate_pages_batch+0x1c7f/0x43b0 mm/migrate.c:1918
 migrate_pages_sync mm/migrate.c:2062 [inline]
 migrate_pages+0x1f90/0x2900 mm/migrate.c:2144
 compact_zone+0x3434/0x4c00 mm/compaction.c:2698
 compact_node mm/compaction.c:2945 [inline]
 compact_nodes mm/compaction.c:2967 [inline]
 sysctl_compaction_handler+0x3f3/0x880 mm/compaction.c:3018
 proc_sys_call_handler+0x4c7/0x830 fs/proc/proc_sysctl.c:600
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5b4752e159
RSP: 002b:00007f5b45765028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5b477b6090 RCX: 00007f5b4752e159
RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000008
RBP: 00007f5b475c5024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5b477b6128 R14: 00007f5b477b6090 R15: 00007ffe28d5eda8
 </TASK>
INFO: task syz.6.4029:21494 blocked in I/O wait for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.4029      state:D stack:26208 pid:21494 tgid:21483 ppid:13209  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x16d9/0x5700 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7362
 io_schedule+0x80/0xe0 kernel/sched/core.c:8190
 folio_wait_bit_common+0x83c/0xbc0 mm/filemap.c:1329
 folio_lock include/linux/pagemap.h:1220 [inline]
 migrate_folio_unmap mm/migrate.c:1260 [inline]
 migrate_pages_batch+0x1c7f/0x43b0 mm/migrate.c:1918
 migrate_pages_sync mm/migrate.c:2062 [inline]
 migrate_pages+0x1f90/0x2900 mm/migrate.c:2144
 compact_zone+0x3434/0x4c00 mm/compaction.c:2698
 compact_node mm/compaction.c:2945 [inline]
 compact_nodes mm/compaction.c:2967 [inline]
 sysctl_compaction_handler+0x3f3/0x880 mm/compaction.c:3018
 proc_sys_call_handler+0x4c7/0x830 fs/proc/proc_sysctl.c:600
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1e525ae159
RSP: 002b:00007f1e507c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1e52836180 RCX: 00007f1e525ae159
RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000008
RBP: 00007f1e52645024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1e52836218 R14: 00007f1e52836180 R15: 00007ffea93436f8
 </TASK>

Showing all locks held in the system:
locks held by ksoftirqd/1/30: 9, last CPU#1:
 #0: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
 #1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
 #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: net_tx_action+0x5bb/0xc30 net/core/dev.c:5883
 #3: ffff888038cc0328 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:206 [inline]
 #3: ffff888038cc0328 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{3:3}, at: qdisc_run include/net/pkt_sched.h:120 [inline]
 #3: ffff888038cc0328 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{3:3}, at: net_tx_action+0x78a/0xc30 net/core/dev.c:5915
 #4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_trylock kernel/locking/spinlock_rt.c:127 [inline]
 #4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 kernel/locking/spinlock_rt.c:135
 #5: ffff88803bfaa198 (_xmit_ETHER#2){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
 #5: ffff88803bfaa198 (_xmit_ETHER#2){+...}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4838 [inline]
 #5: ffff88803bfaa198 (_xmit_ETHER#2){+...}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
 #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
 #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
 #7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: dev_queue_xmit_nit+0x2d/0xac0 net/core/dev.c:2580
 #8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_handle+0x5a/0x580 mm/page_owner.c:273
locks held by khungtaskd/38: 1, last CPU#0:
 #0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837
locks held by getty/5343: 2, on CPU#0:
 #0: ffff88803680b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900044cb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by udevd/8281: 1, on CPU#0:
 #0: ffff8880264b14c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8284: 1, on CPU#1:
 #0: ffff8880263a94c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8285: 1, on CPU#0:
 #0: ffff8880280314c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8291: 1, on CPU#0:
 #0: ffff8880263414c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8338: 1, on CPU#0:
 #0: ffff888027e294c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8356: 1, on CPU#0:
 #0: ffff888027d014c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8368: 1, on CPU#1:
 #0: ffff8880280214c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8436: 1, on CPU#1:
 #0: ffff888027f594c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8513: 1, on CPU#1:
 #0: ffff888027e494c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8522: 1, on CPU#0:
 #0: ffff888027e314c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8577: 1, on CPU#1:
 #0: ffff888027f314c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by udevd/8578: 1, on CPU#0:
 #0: ffff888027f494c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 block/bdev.c:990
locks held by syz.4.3998/21393: 2, on CPU#0:
 #0: ffff888035939928 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 fs/file.c:1259
 #1: ffff88802aad0510 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
 #1: ffff88802aad0510 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
locks held by syz.6.4029/21494: 2, on CPU#1:
 #0: ffff88802bfb3928 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 fs/file.c:1259
 #1: ffff88803a506510 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
 #1: ffff88803a506510 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
locks held by syz.1.4047/21551: 2, on CPU#0:
 #0: ffff888061957f28 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 fs/file.c:1259
 #1: ffff88803b1aa510 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
 #1: ffff88803b1aa510 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
locks held by syz.7.4085/21757: 2, on CPU#1:
 #0: ffff88802cafa528 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 fs/file.c:1259
 #1: ffff88806a97e510 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
 #1: ffff88806a97e510 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd7/0x1030 kernel/hung_task.c:561
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:check_preemption_disabled+0x26/0xd0 lib/smp_processor_id.c:19
Code: 90 90 90 90 55 41 57 41 56 53 65 8b 05 2b 3e 4f 07 65 48 8b 0d fb 3d 4f 07 85 c9 74 0c 5b 41 5e 41 5f 5d e9 bc b6 03 00 cc 9c <59> f7 c1 00 02 00 00 74 ea 65 4c 8b 3d d1 3d 4f 07 41 f6 47 2f 04
RSP: 0018:ffffc90000a4f3a8 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000202 RCX: 8000000000000000
RDX: ffffc90000a4f501 RSI: ffffffff8d8e31e4 RDI: ffffffff8bcc2080
RBP: 1ffffffff2087d01 R08: ffffc90000a4fe18 R09: 0000000000000000
R10: ffffc90000a4f538 R11: fffff52000149ea9 R12: ffffc90000a48000
R13: ffffffff8177e0ef R14: ffffffff8e1c3ac0 R15: ffff88801d2c1f40
FS:  0000000000000000(0000) GS:ffff888125cd6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ad5aa36008 CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
 lock_release+0xa1/0x3c0 kernel/locking/lockdep.c:5929
 rcu_lock_release include/linux/rcupdate.h:319 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0x1baa/0x2550 arch/x86/kernel/unwind_orc.c:709
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kmem_cache_free+0x187/0x6d0 mm/slub.c:6626
 packet_rcv+0x16e/0x16f0 net/packet/af_packet.c:2245
 dev_queue_xmit_nit+0xa2c/0xac0 net/core/dev.c:2632
 xmit_one net/core/dev.c:3933 [inline]
 dev_hard_start_xmit+0x1be/0x870 net/core/dev.c:3953
 sch_direct_xmit+0x257/0x4c0 net/sched/sch_generic.c:372
 qdisc_restart net/sched/sch_generic.c:437 [inline]
 __qdisc_run+0xb3c/0x1650 net/sched/sch_generic.c:445
 qdisc_run include/net/pkt_sched.h:121 [inline]
 net_tx_action+0x7cb/0xc30 net/core/dev.c:5915
 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
 run_ksoftirqd+0x53/0x190 kernel/softirq.c:1108
 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>