syzbot

INFO: task kcompactd0:30 blocked for more than 143 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kcompactd0      state:D stack:25584 pid:   30 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xb72/0x1460 kernel/sched/core.c:6253
 schedule+0x12b/0x1f0 kernel/sched/core.c:6326
 io_schedule+0x83/0x100 kernel/sched/core.c:8371
 folio_wait_bit_common+0x8aa/0xe00 mm/filemap.c:1371
 lock_page include/linux/pagemap.h:796 [inline]
 __unmap_and_move+0x9d9/0xda0 mm/migrate.c:980
 unmap_and_move+0x321/0xd70 mm/migrate.c:1204
 migrate_pages+0x562/0x16f0 mm/migrate.c:1481
 compact_zone+0x2d23/0x3d10 mm/compaction.c:2399
 kcompactd_do_work mm/compaction.c:2839 [inline]
 kcompactd+0x937/0x2920 mm/compaction.c:2941
 kthread+0x468/0x490 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8cb1db40 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/u4:2/44:
1 lock held by kswapd0/98:
2 locks held by kswapd1/99:
1 lock held by systemd-journal/2957:
 #0: ffff88801d955550 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #0: ffff88801d955550 (mapping.invalidate_lock){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b8/0x9f0 mm/readahead.c:194
1 lock held by in:imklog/6213:
 #0: ffff88807a59c160 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #0: ffff88807a59c160 (mapping.invalidate_lock){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b8/0x9f0 mm/readahead.c:194
2 locks held by agetty/6220:
 #0: ffff88807e5a6098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc90002f832e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6c5/0x1c60 drivers/tty/n_tty.c:2113
3 locks held by kworker/0:8/8517:
2 locks held by agetty/21618:
 #0: ffff88807a245098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc900050a32e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6c5/0x1c60 drivers/tty/n_tty.c:2113
2 locks held by kworker/u4:6/22739:
3 locks held by kworker/1:5/32575:
1 lock held by syz-executor.0/11667:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
 watchdog+0xc82/0xcd0 kernel/hung_task.c:295
 kthread+0x468/0x490 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 32575 Comm: kworker/1:5 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events fill_page_cache_func
RIP: 0010:check_preemption_disabled+0x3/0x1c0 lib/smp_processor_id.c:13
Code: cc cc cc cc cc cc cc 0f 1f 44 00 00 48 c7 c7 e0 48 d5 8a 48 c7 c6 20 49 d5 8a eb 0b 66 2e 0f 1f 84 00 00 00 00 00 90 55 41 57 <41> 56 41 55 41 54 53 48 83 ec 10 49 89 f6 49 89 ff 65 48 8b 04 25
RSP: 0000:ffffc9000b91e940 EFLAGS: 00000086
RAX: 00000000000bc401 RBX: 1ffff92001723d30 RCX: 0000000080000002
RDX: 0000000000000000 RSI: ffffffff8ad54920 RDI: ffffffff8ad548e0
RBP: ffffc9000b91ea08 R08: dffffc0000000000 R09: fffffbfff1bfd196
R10: fffffbfff1bfd196 R11: 0000000000000000 R12: 0000000000000002
R13: 1ffff92001723d54 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f936597b560 CR3: 000000000c88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rcu_lockdep_current_cpu_online+0x36/0x130 kernel/rcu/tree.c:1169
 rcu_read_lock_held_common kernel/rcu/update.c:112 [inline]
 rcu_read_lock_sched_held+0x74/0x130 kernel/rcu/update.c:123
 trace_lock_acquire+0x59/0x190 include/trace/events/lock.h:13
 lock_acquire+0xa5/0x4d0 kernel/locking/lockdep.c:5608
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:268
 rcu_read_lock include/linux/rcupdate.h:688 [inline]
 page_evictable+0x23/0x290 mm/internal.h:123
 move_pages_to_lru+0x384/0x15c0 mm/vmscan.c:2278
 shrink_inactive_list+0x46f/0xad0 mm/vmscan.c:2397
 shrink_list mm/vmscan.c:2621 [inline]
 shrink_lruvec+0x49a/0xc90 mm/vmscan.c:2940
 shrink_node_memcgs+0x358/0x700 mm/vmscan.c:3129
 shrink_node+0xdc2/0x1ee0 mm/vmscan.c:3252
 shrink_zones+0x482/0xb90 mm/vmscan.c:3485
 do_try_to_free_pages+0x22a/0xce0 mm/vmscan.c:3541
 try_to_free_pages+0x3e3/0xc60 mm/vmscan.c:3776
 __perform_reclaim mm/page_alloc.c:4588 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4609 [inline]
 __alloc_pages_slowpath+0x1197/0x2530 mm/page_alloc.c:5007
 __alloc_pages+0x3d0/0x580 mm/page_alloc.c:5382
 __get_free_pages+0x8/0x30 mm/page_alloc.c:5418
 fill_page_cache_func+0xc4/0x220 kernel/rcu/tree.c:3412
 process_one_work+0x853/0x1140 kernel/workqueue.c:2298
 worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
 kthread+0x468/0x490 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   c:	48 c7 c7 e0 48 d5 8a 	mov    $0xffffffff8ad548e0,%rdi
  13:	48 c7 c6 20 49 d5 8a 	mov    $0xffffffff8ad54920,%rsi
  1a:	eb 0b                	jmp    0x27
  1c:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
  23:	00 00 00
  26:	90                   	nop
  27:	55                   	push   %rbp
  28:	41 57                	push   %r15
* 2a:	41 56                	push   %r14 <-- trapping instruction
  2c:	41 55                	push   %r13
  2e:	41 54                	push   %r12
  30:	53                   	push   %rbx
  31:	48 83 ec 10          	sub    $0x10,%rsp
  35:	49 89 f6             	mov    %rsi,%r14
  38:	49 89 ff             	mov    %rdi,%r15
  3b:	65                   	gs
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	04 25                	add    $0x25,%al