INFO: task kcompactd0:1153 blocked for more than 143 seconds. Not tainted 5.7.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kcompactd0 D28464 1153 2 0x80004000 Call Trace: context_switch kernel/sched/core.c:3430 [inline] __schedule+0x8f3/0x1fc0 kernel/sched/core.c:4156 schedule+0xd0/0x2a0 kernel/sched/core.c:4231 io_schedule+0x17/0x60 kernel/sched/core.c:5874 wait_on_page_bit_common mm/filemap.c:1150 [inline] __lock_page+0x3e7/0x9c0 mm/filemap.c:1358 lock_page include/linux/pagemap.h:521 [inline] __unmap_and_move mm/migrate.c:1046 [inline] unmap_and_move mm/migrate.c:1207 [inline] migrate_pages+0x19f0/0x2810 mm/migrate.c:1455 compact_zone+0x1b25/0x3780 mm/compaction.c:2207 kcompactd_do_work+0x2d5/0xac0 mm/compaction.c:2564 kcompactd+0x226/0x860 mm/compaction.c:2657 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Showing all locks held in the system: 1 lock held by systemd/1: 1 lock held by kthreadd/2: 4 locks held by kworker/0:1/12: #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: __write_once_size include/linux/compiler.h:279 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff888093bc5138 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: process_one_work+0x844/0x16a0 kernel/workqueue.c:2239 #1: ffffc90000d2fdc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((typeof(*((worker))) *)((worker)))); (typeof((typeof(*((worker))) *)((worker)))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x878/0x16a0 kernel/workqueue.c:2243 #2: ffff88801e981048 (&wg->static_identity.lock){++++}-{3:3}, at: wg_noise_handshake_consume_initiation+0xaa/0x6a0 drivers/net/wireguard/noise.c:568 #3: ffff8880344c8690 (&handshake->lock){++++}-{3:3}, at: wg_noise_handshake_consume_initiation+0x3a6/0x6a0 drivers/net/wireguard/noise.c:602 4 locks held by kworker/u4:2/25: #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: __write_once_size include/linux/compiler.h:279 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8880a3591138 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: process_one_work+0x844/0x16a0 kernel/workqueue.c:2239 #1: ffffc90000e17dc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x878/0x16a0 kernel/workqueue.c:2243 #2: ffff888031f55048 (&wg->static_identity.lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xa9/0x620 drivers/net/wireguard/noise.c:499 #3: ffff88818ad76690 (&handshake->lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xbd/0x620 drivers/net/wireguard/noise.c:500 1 lock held by khungtaskd/1149: #0: ffffffff899bdd80 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:5779 1 lock held by kswapd1/1669: 1 lock held by systemd-journal/3889: 1 lock held by systemd-timesyn/4411: 1 lock held by cron/6455: 1 lock held by rsyslogd/6474: 1 lock held by in:imklog/6489: 1 lock held by syz-fuzzer/6788: 1 lock held by syz-fuzzer/6790: 4 locks held by kworker/0:2/26949: 4 locks held by kworker/1:3/23063: 4 locks held by kworker/0:4/24771: #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: __write_once_size include/linux/compiler.h:279 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff88808ec64138 ((wq_completion)wg-kex-wg0#18){+.+.}-{0:0}, at: process_one_work+0x844/0x16a0 kernel/workqueue.c:2239 #1: ffffc900041a7dc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((typeof(*((worker))) *)((worker)))); (typeof((typeof(*((worker))) *)((worker)))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x878/0x16a0 kernel/workqueue.c:2243 #2: ffff888214ff1048 (&wg->static_identity.lock){++++}-{3:3}, at: wg_noise_handshake_consume_initiation+0xaa/0x6a0 drivers/net/wireguard/noise.c:568 #3: ffff8882019fc690 (&handshake->lock){++++}-{3:3}, at: wg_noise_handshake_consume_initiation+0x3a6/0x6a0 drivers/net/wireguard/noise.c:602 4 locks held by kworker/u4:5/26915: #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: __write_once_size include/linux/compiler.h:279 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff88808b043138 ((wq_completion)wg-kex-wg0#23){+.+.}-{0:0}, at: process_one_work+0x844/0x16a0 kernel/workqueue.c:2239 #1: ffffc900063d7dc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x878/0x16a0 kernel/workqueue.c:2243 #2: ffff88801e981048 (&wg->static_identity.lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xa9/0x620 drivers/net/wireguard/noise.c:499 #3: ffff8880344c8690 (&handshake->lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xbd/0x620 drivers/net/wireguard/noise.c:500 4 locks held by kworker/1:5/27316: 4 locks held by kworker/0:5/28262: 4 locks held by kworker/u4:0/28263: #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: __write_once_size include/linux/compiler.h:279 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline] #0: ffff8880917a2138 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: process_one_work+0x844/0x16a0 kernel/workqueue.c:2239 #1: ffffc90001f3fdc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x878/0x16a0 kernel/workqueue.c:2243 #2: ffff888214ff1048 (&wg->static_identity.lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xa9/0x620 drivers/net/wireguard/noise.c:499 #3: ffff8882019fc690 (&handshake->lock){++++}-{3:3}, at: wg_noise_handshake_create_initiation+0xbd/0x620 drivers/net/wireguard/noise.c:500 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1149 Comm: khungtaskd Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1e6/0x221 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xa8c/0x1010 kernel/hung_task.c:289 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 28210 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:163 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x9/0x60 kernel/kcov.c:197 Code: cc 65 48 8b 04 25 00 1f 02 00 48 8b 80 f8 13 00 00 c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 04 25 00 1f 02 00 <65> 8b 15 f8 4f 8e 7e f7 c2 00 01 ff 00 48 8b 34 24 74 0f 80 e6 01 RSP: 0018:ffffc90001db6e20 EFLAGS: 00000002 RAX: ffff888019fca480 RBX: ffffea00064c8748 RCX: ffffffff819a2979 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff888019fca480 R09: fffff94000c990e9 R10: ffffea00064c8747 R11: fffff94000c990e8 R12: 0000000000000001 R13: ffffea00064c8708 R14: ffff88821b77d020 R15: 0000000000000000 FS: 0000000002a30940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005588b5a0bbbd CR3: 00000000385b5000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:70 [inline] list_add include/linux/list.h:86 [inline] list_move include/linux/list.h:216 [inline] isolate_lru_pages+0x9a7/0x10f0 mm/vmscan.c:1699 shrink_inactive_list+0x2a0/0xca0 mm/vmscan.c:1946 shrink_list mm/vmscan.c:2170 [inline] shrink_lruvec+0x5fa/0x1170 mm/vmscan.c:2464 shrink_node_memcgs mm/vmscan.c:2653 [inline] shrink_node+0x4d4/0x1c00 mm/vmscan.c:2767 shrink_zones mm/vmscan.c:2970 [inline] do_try_to_free_pages+0x38d/0x1380 mm/vmscan.c:3023 try_to_free_pages+0x29b/0x8d0 mm/vmscan.c:3262 __perform_reclaim mm/page_alloc.c:4223 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4244 [inline] __alloc_pages_slowpath.constprop.0+0x903/0x2640 mm/page_alloc.c:4650 __alloc_pages_nodemask+0x5d9/0x810 mm/page_alloc.c:4863 alloc_pages_current+0xff/0x200 mm/mempolicy.c:2292 alloc_pages include/linux/gfp.h:545 [inline] __page_cache_alloc+0x298/0x480 mm/filemap.c:956 page_cache_readahead_unbounded+0x32d/0x820 mm/readahead.c:222 __do_page_cache_readahead+0xc2/0xf0 mm/readahead.c:273 ra_submit mm/internal.h:64 [inline] do_sync_mmap_readahead mm/filemap.c:2405 [inline] filemap_fault+0x1f3f/0x2ed0 mm/filemap.c:2491 __do_fault+0x10d/0x520 mm/memory.c:3454 do_shared_fault mm/memory.c:3901 [inline] do_fault mm/memory.c:3979 [inline] handle_pte_fault mm/memory.c:4215 [inline] __handle_mm_fault mm/memory.c:4347 [inline] handle_mm_fault+0x2cc6/0x3c10 mm/memory.c:4384 do_user_addr_fault arch/x86/mm/fault.c:1301 [inline] do_page_fault+0x56a/0x13d4 arch/x86/mm/fault.c:1390 page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203 RIP: 0033:0x400604 Code: Bad RIP value. RSP: 002b:00007ffe3d5c8920 EFLAGS: 00010206 RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000020cab000 RDI: 000000000000000c RBP: 00000000007901c8 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffe3d5c8a40 R11: 0000000000000246 R12: 00000000007901d0 R13: 000000000035401a R14: fffffffffffffffe R15: 000000000078bf0c