INFO: task kcompactd0:30 blocked for more than 143 seconds.
      Not tainted 5.15.0-rc5-next-20211013-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kcompactd0      state:D stack:28312 pid:   30 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4965 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6246
 schedule+0xd2/0x260 kernel/sched/core.c:6319
 io_schedule+0xba/0x130 kernel/sched/core.c:8363
 folio_wait_bit_common+0x4f2/0xa60 mm/filemap.c:1364
 lock_page include/linux/pagemap.h:747 [inline]
 __unmap_and_move mm/migrate.c:980 [inline]
 unmap_and_move mm/migrate.c:1204 [inline]
 migrate_pages+0xa5a/0x3880 mm/migrate.c:1481
 compact_zone+0x1abb/0x3860 mm/compaction.c:2393
 kcompactd_do_work+0x2c9/0x730 mm/compaction.c:2833
 kcompactd+0x86b/0xf30 mm/compaction.c:2935
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task syz-executor.1:7707 can't die for more than 144 seconds.
task:syz-executor.1  state:R  running task     stack:24416 pid: 7707 ppid: 19613 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4965 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6246
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6412
 __cond_resched+0x13/0x20 kernel/sched/core.c:8125
 _cond_resched include/linux/sched.h:2027 [inline]
 shrink_page_list+0x26e/0x6730 mm/vmscan.c:1410
 shrink_inactive_list mm/vmscan.c:2306 [inline]
 shrink_list mm/vmscan.c:2530 [inline]
 shrink_lruvec+0xbc8/0x25b0 mm/vmscan.c:2849
 shrink_node_memcgs mm/vmscan.c:3038 [inline]
 shrink_node+0x858/0x1eb0 mm/vmscan.c:3161
 shrink_zones mm/vmscan.c:3364 [inline]
 do_try_to_free_pages+0x386/0x1480 mm/vmscan.c:3419
 try_to_free_pages+0x29f/0x750 mm/vmscan.c:3654
 __perform_reclaim mm/page_alloc.c:4586 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4607 [inline]
 __alloc_pages_slowpath.constprop.0+0xac7/0x2290 mm/page_alloc.c:5024
 __alloc_pages+0x412/0x500 mm/page_alloc.c:5395
 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
 folio_alloc+0x1c/0x70 mm/mempolicy.c:2201
 filemap_alloc_folio+0x8e/0xb0 mm/filemap.c:1029
 __page_cache_alloc include/linux/pagemap.h:325 [inline]
 page_cache_ra_unbounded+0x36a/0x940 mm/readahead.c:215
 do_page_cache_ra+0xf9/0x140 mm/readahead.c:268
 do_sync_mmap_readahead mm/filemap.c:2986 [inline]
 filemap_fault+0x1562/0x26d0 mm/filemap.c:3079
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4155 [inline]
 do_fault mm/memory.c:4284 [inline]
 handle_pte_fault mm/memory.c:4542 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4677
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4775
 faultin_page mm/gup.c:937 [inline]
 __get_user_pages+0x503/0xf80 mm/gup.c:1158
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1490
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1599
 mm_populate include/linux/mm.h:2733 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x49f/0x620 mm/mmap.c:1624
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fae501b9a39
RSP: 002b:00007fae4d72f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fae502bcf60 RCX: 00007fae501b9a39
RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007fae50213c5f R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdf22c4d1f R14: 00007fae4d72f300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.1:7716 can't die for more than 147 seconds.
task:syz-executor.1  state:D stack:29576 pid: 7716 ppid: 19613 flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4965 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6246
 schedule+0xd2/0x260 kernel/sched/core.c:6319
 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107
 __down_write_common kernel/locking/rwsem.c:1262 [inline]
 __down_write_common kernel/locking/rwsem.c:1259 [inline]
 __down_write kernel/locking/rwsem.c:1271 [inline]
 down_write+0x135/0x150 kernel/locking/rwsem.c:1518
 filemap_invalidate_lock include/linux/fs.h:827 [inline]
 blkdev_fallocate+0x22c/0x480 block/fops.c:552
 vfs_fallocate+0x48d/0xe10 fs/open.c:307
 madvise_remove mm/madvise.c:925 [inline]
 madvise_vma mm/madvise.c:987 [inline]
 do_madvise.part.0+0xb60/0x2250 mm/madvise.c:1202
 do_madvise mm/madvise.c:1228 [inline]
 __do_sys_madvise mm/madvise.c:1228 [inline]
 __se_sys_madvise mm/madvise.c:1226 [inline]
 __x64_sys_madvise+0x113/0x150 mm/madvise.c:1226
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fae501b9a39
RSP: 002b:00007fae4d70e188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007fae502bd020 RCX: 00007fae501b9a39
RDX: 0000000000000009 RSI: 0000000000003000 RDI: 0000000020598000
RBP: 00007fae50213c5f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdf22c4d1f R14: 00007fae4d70e300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.1:7716 blocked for more than 147 seconds.
      Not tainted 5.15.0-rc5-next-20211013-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1  state:D stack:29576 pid: 7716 ppid: 19613 flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4965 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6246
 schedule+0xd2/0x260 kernel/sched/core.c:6319
 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107
 __down_write_common kernel/locking/rwsem.c:1262 [inline]
 __down_write_common kernel/locking/rwsem.c:1259 [inline]
 __down_write kernel/locking/rwsem.c:1271 [inline]
 down_write+0x135/0x150 kernel/locking/rwsem.c:1518
 filemap_invalidate_lock include/linux/fs.h:827 [inline]
 blkdev_fallocate+0x22c/0x480 block/fops.c:552
 vfs_fallocate+0x48d/0xe10 fs/open.c:307
 madvise_remove mm/madvise.c:925 [inline]
 madvise_vma mm/madvise.c:987 [inline]
 do_madvise.part.0+0xb60/0x2250 mm/madvise.c:1202
 do_madvise mm/madvise.c:1228 [inline]
 __do_sys_madvise mm/madvise.c:1228 [inline]
 __se_sys_madvise mm/madvise.c:1226 [inline]
 __x64_sys_madvise+0x113/0x150 mm/madvise.c:1226
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fae501b9a39
RSP: 002b:00007fae4d70e188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007fae502bd020 RCX: 00007fae501b9a39
RDX: 0000000000000009 RSI: 0000000000003000 RDI: 0000000020598000
RBP: 00007fae50213c5f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdf22c4d1f R14: 00007fae4d70e300 R15: 0000000000022000
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8bb82ea0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
1 lock held by khugepaged/33:
 #0: ffffffff8bc673e8 (lock#5){+.+.}-{3:3}, at: __lru_add_drain_all+0x65/0x760 mm/swap.c:797
3 locks held by kswapd0/98:
1 lock held by kswapd1/99:
1 lock held by systemd-journal/2966:
1 lock held by systemd-timesyn/3055:
2 locks held by in:imklog/6245:
4 locks held by rs:main Q:Reg/6246:
2 locks held by agetty/6470:
 #0: ffff888022c09098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffffc900029f82e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113
1 lock held by syz-fuzzer/6542:
2 locks held by syz-fuzzer/6546:
 #0: ffff8880b9d39a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
 #1: ffff8880b9d279c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3a6/0x490 kernel/sched/psi.c:880
5 locks held by kworker/1:4/6760:
3 locks held by kworker/0:11/32457:
2 locks held by syz-executor.1/7707:
 #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:837 [inline]
 #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194
 #1: ffffffff8bca6ac8 (pcpu_drain_mutex){+.+.}-{3:3}, at: __drain_all_pages+0x4f/0x6c0 mm/page_alloc.c:3179
1 lock held by syz-executor.1/7716:
 #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:827 [inline]
 #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x22c/0x480 block/fops.c:552

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc5-next-20211013-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:254 [inline]
 watchdog+0xcb7/0xed0 kernel/hung_task.c:339
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6542 Comm: syz-fuzzer Not tainted 5.15.0-rc5-next-20211013-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
Code: 81 e1 00 01 00 00 65 48 8b 14 25 40 70 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 ac 15 00 00 85 c0 74 2b 8b 82 88 15 00 00 <83> f8 02 75 20 48 8b 8a 90 15 00 00 8b 92 8c 15 00 00 48 8b 01 48
RSP: 0018:ffffc90001a7eed8 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffffea0008973e48 RCX: 0000000000000000
RDX: ffff88801c619d00 RSI: ffffffff81a35e53 RDI: ffffea0008973e74
RBP: ffffea0008973e40 R08: 0000000000000001 R09: ffffea0008973e77
R10: fffff9400112e7ce R11: 0000000000000000 R12: 0000000000000002
R13: dffffc0000000000 R14: ffff888140768020 R15: ffffea0008973e74
FS:  000000c00002e890(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0002a4d15 CR3: 000000007f71f000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 arch_atomic_fetch_add_unless include/linux/atomic/atomic-arch-fallback.h:1161 [inline]
 arch_atomic_add_unless include/linux/atomic/atomic-arch-fallback.h:1183 [inline]
 atomic_add_unless include/linux/atomic/atomic-instrumented.h:571 [inline]
 page_ref_add_unless include/linux/page_ref.h:238 [inline]
 get_page_unless_zero include/linux/mm.h:754 [inline]
 isolate_lru_pages+0x3f3/0x17b0 mm/vmscan.c:2043
 shrink_inactive_list mm/vmscan.c:2288 [inline]
 shrink_list mm/vmscan.c:2530 [inline]
 shrink_lruvec+0xa42/0x25b0 mm/vmscan.c:2849
 shrink_node_memcgs mm/vmscan.c:3038 [inline]
 shrink_node+0x858/0x1eb0 mm/vmscan.c:3161
 shrink_zones mm/vmscan.c:3364 [inline]
 do_try_to_free_pages+0x386/0x1480 mm/vmscan.c:3419
 try_to_free_pages+0x29f/0x750 mm/vmscan.c:3654
 __perform_reclaim mm/page_alloc.c:4586 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4607 [inline]
 __alloc_pages_slowpath.constprop.0+0xac7/0x2290 mm/page_alloc.c:5024
 __alloc_pages+0x412/0x500 mm/page_alloc.c:5395
 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
 folio_alloc+0x1c/0x70 mm/mempolicy.c:2201
 filemap_alloc_folio+0x8e/0xb0 mm/filemap.c:1029
 __page_cache_alloc include/linux/pagemap.h:325 [inline]
 page_cache_ra_unbounded+0x36a/0x940 mm/readahead.c:215
 do_page_cache_ra+0xf9/0x140 mm/readahead.c:268
 do_sync_mmap_readahead mm/filemap.c:2986 [inline]
 filemap_fault+0x1562/0x26d0 mm/filemap.c:3079
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4155 [inline]
 do_fault mm/memory.c:4284 [inline]
 handle_pte_fault mm/memory.c:4542 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4677
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4775
 do_user_addr_fault+0x489/0x11c0 arch/x86/mm/fault.c:1397
 handle_page_fault arch/x86/mm/fault.c:1485 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1541
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x402a14
Code: fd d7 d6 48 83 c6 40 48 83 c7 40 48 83 eb 40 81 fa ff ff ff ff 74 c4 c5 f8 77 c6 00 00 c3 c5 f8 77 48 83 fb 08 76 1b 48 8b 0e <48> 8b 17 48 83 c6 08 48 83 c7 08 48 83 eb 08 48 39 d1 74 e3 c6 00
RSP: 002b:000000c002748e80 EFLAGS: 00010212
RAX: 000000c002748ea0 RBX: 0000000000000010 RCX: 0000000030746973
RDX: 0000000000000010 RSI: 000000c002fcb5c0 RDI: 00000000007ff863
RBP: 000000c002748f88 R08: 00000000019dcc30 R09: 0000000000000003
R10: 00000000007ff863 R11: 000000c002fcb5c0 R12: ffffffffffffffff
R13: 000000000000015d R14: 000000000000015c R15: 0000000000000200
 </TASK>
----------------
Code disassembly (best guess):
   0:	81 e1 00 01 00 00    	and    $0x100,%ecx
   6:	65 48 8b 14 25 40 70 	mov    %gs:0x27040,%rdx
   d:	02 00
   f:	a9 00 01 ff 00       	test   $0xff0100,%eax
  14:	74 0e                	je     0x24
  16:	85 c9                	test   %ecx,%ecx
  18:	74 35                	je     0x4f
  1a:	8b 82 ac 15 00 00    	mov    0x15ac(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 2b                	je     0x4f
  24:	8b 82 88 15 00 00    	mov    0x1588(%rdx),%eax
* 2a:	83 f8 02             	cmp    $0x2,%eax <-- trapping instruction
  2d:	75 20                	jne    0x4f
  2f:	48 8b 8a 90 15 00 00 	mov    0x1590(%rdx),%rcx
  36:	8b 92 8c 15 00 00    	mov    0x158c(%rdx),%edx
  3c:	48 8b 01             	mov    (%rcx),%rax
  3f:	48                   	rex.W