INFO: task kcompactd0:30 blocked for more than 143 seconds. Not tainted 5.15.0-rc5-next-20211013-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kcompactd0 state:D stack:28312 pid: 30 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4965 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6246 schedule+0xd2/0x260 kernel/sched/core.c:6319 io_schedule+0xba/0x130 kernel/sched/core.c:8363 folio_wait_bit_common+0x4f2/0xa60 mm/filemap.c:1364 lock_page include/linux/pagemap.h:747 [inline] __unmap_and_move mm/migrate.c:980 [inline] unmap_and_move mm/migrate.c:1204 [inline] migrate_pages+0xa5a/0x3880 mm/migrate.c:1481 compact_zone+0x1abb/0x3860 mm/compaction.c:2393 kcompactd_do_work+0x2c9/0x730 mm/compaction.c:2833 kcompactd+0x86b/0xf30 mm/compaction.c:2935 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor.1:7707 can't die for more than 144 seconds. task:syz-executor.1 state:R running task stack:24416 pid: 7707 ppid: 19613 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:4965 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6246 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6412 __cond_resched+0x13/0x20 kernel/sched/core.c:8125 _cond_resched include/linux/sched.h:2027 [inline] shrink_page_list+0x26e/0x6730 mm/vmscan.c:1410 shrink_inactive_list mm/vmscan.c:2306 [inline] shrink_list mm/vmscan.c:2530 [inline] shrink_lruvec+0xbc8/0x25b0 mm/vmscan.c:2849 shrink_node_memcgs mm/vmscan.c:3038 [inline] shrink_node+0x858/0x1eb0 mm/vmscan.c:3161 shrink_zones mm/vmscan.c:3364 [inline] do_try_to_free_pages+0x386/0x1480 mm/vmscan.c:3419 try_to_free_pages+0x29f/0x750 mm/vmscan.c:3654 __perform_reclaim mm/page_alloc.c:4586 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4607 [inline] __alloc_pages_slowpath.constprop.0+0xac7/0x2290 mm/page_alloc.c:5024 __alloc_pages+0x412/0x500 mm/page_alloc.c:5395 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 folio_alloc+0x1c/0x70 mm/mempolicy.c:2201 filemap_alloc_folio+0x8e/0xb0 mm/filemap.c:1029 __page_cache_alloc include/linux/pagemap.h:325 [inline] page_cache_ra_unbounded+0x36a/0x940 mm/readahead.c:215 do_page_cache_ra+0xf9/0x140 mm/readahead.c:268 do_sync_mmap_readahead mm/filemap.c:2986 [inline] filemap_fault+0x1562/0x26d0 mm/filemap.c:3079 __do_fault+0x10d/0x4d0 mm/memory.c:3849 do_read_fault mm/memory.c:4155 [inline] do_fault mm/memory.c:4284 [inline] handle_pte_fault mm/memory.c:4542 [inline] __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4677 handle_mm_fault+0x1c8/0x790 mm/memory.c:4775 faultin_page mm/gup.c:937 [inline] __get_user_pages+0x503/0xf80 mm/gup.c:1158 populate_vma_page_range+0x24d/0x330 mm/gup.c:1490 __mm_populate+0x1ea/0x3e0 mm/gup.c:1599 mm_populate include/linux/mm.h:2733 [inline] vm_mmap_pgoff+0x20e/0x290 mm/util.c:524 ksys_mmap_pgoff+0x49f/0x620 mm/mmap.c:1624 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fae501b9a39 RSP: 002b:00007fae4d72f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007fae502bcf60 RCX: 00007fae501b9a39 RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000000020000000 RBP: 00007fae50213c5f R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdf22c4d1f R14: 00007fae4d72f300 R15: 0000000000022000 INFO: task syz-executor.1:7716 can't die for more than 147 seconds. task:syz-executor.1 state:D stack:29576 pid: 7716 ppid: 19613 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4965 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6246 schedule+0xd2/0x260 kernel/sched/core.c:6319 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107 __down_write_common kernel/locking/rwsem.c:1262 [inline] __down_write_common kernel/locking/rwsem.c:1259 [inline] __down_write kernel/locking/rwsem.c:1271 [inline] down_write+0x135/0x150 kernel/locking/rwsem.c:1518 filemap_invalidate_lock include/linux/fs.h:827 [inline] blkdev_fallocate+0x22c/0x480 block/fops.c:552 vfs_fallocate+0x48d/0xe10 fs/open.c:307 madvise_remove mm/madvise.c:925 [inline] madvise_vma mm/madvise.c:987 [inline] do_madvise.part.0+0xb60/0x2250 mm/madvise.c:1202 do_madvise mm/madvise.c:1228 [inline] __do_sys_madvise mm/madvise.c:1228 [inline] __se_sys_madvise mm/madvise.c:1226 [inline] __x64_sys_madvise+0x113/0x150 mm/madvise.c:1226 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fae501b9a39 RSP: 002b:00007fae4d70e188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007fae502bd020 RCX: 00007fae501b9a39 RDX: 0000000000000009 RSI: 0000000000003000 RDI: 0000000020598000 RBP: 00007fae50213c5f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdf22c4d1f R14: 00007fae4d70e300 R15: 0000000000022000 INFO: task syz-executor.1:7716 blocked for more than 147 seconds. Not tainted 5.15.0-rc5-next-20211013-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.1 state:D stack:29576 pid: 7716 ppid: 19613 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4965 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6246 schedule+0xd2/0x260 kernel/sched/core.c:6319 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107 __down_write_common kernel/locking/rwsem.c:1262 [inline] __down_write_common kernel/locking/rwsem.c:1259 [inline] __down_write kernel/locking/rwsem.c:1271 [inline] down_write+0x135/0x150 kernel/locking/rwsem.c:1518 filemap_invalidate_lock include/linux/fs.h:827 [inline] blkdev_fallocate+0x22c/0x480 block/fops.c:552 vfs_fallocate+0x48d/0xe10 fs/open.c:307 madvise_remove mm/madvise.c:925 [inline] madvise_vma mm/madvise.c:987 [inline] do_madvise.part.0+0xb60/0x2250 mm/madvise.c:1202 do_madvise mm/madvise.c:1228 [inline] __do_sys_madvise mm/madvise.c:1228 [inline] __se_sys_madvise mm/madvise.c:1226 [inline] __x64_sys_madvise+0x113/0x150 mm/madvise.c:1226 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fae501b9a39 RSP: 002b:00007fae4d70e188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007fae502bd020 RCX: 00007fae501b9a39 RDX: 0000000000000009 RSI: 0000000000003000 RDI: 0000000020598000 RBP: 00007fae50213c5f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdf22c4d1f R14: 00007fae4d70e300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8bb82ea0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458 1 lock held by khugepaged/33: #0: ffffffff8bc673e8 (lock#5){+.+.}-{3:3}, at: __lru_add_drain_all+0x65/0x760 mm/swap.c:797 3 locks held by kswapd0/98: 1 lock held by kswapd1/99: 1 lock held by systemd-journal/2966: 1 lock held by systemd-timesyn/3055: 2 locks held by in:imklog/6245: 4 locks held by rs:main Q:Reg/6246: 2 locks held by agetty/6470: #0: ffff888022c09098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252 #1: ffffc900029f82e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113 1 lock held by syz-fuzzer/6542: 2 locks held by syz-fuzzer/6546: #0: ffff8880b9d39a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478 #1: ffff8880b9d279c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3a6/0x490 kernel/sched/psi.c:880 5 locks held by kworker/1:4/6760: 3 locks held by kworker/0:11/32457: 2 locks held by syz-executor.1/7707: #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:837 [inline] #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194 #1: ffffffff8bca6ac8 (pcpu_drain_mutex){+.+.}-{3:3}, at: __drain_all_pages+0x4f/0x6c0 mm/page_alloc.c:3179 1 lock held by syz-executor.1/7716: #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:827 [inline] #0: ffff888145e3b878 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x22c/0x480 block/fops.c:552 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc5-next-20211013-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:254 [inline] watchdog+0xcb7/0xed0 kernel/hung_task.c:339 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 6542 Comm: syz-fuzzer Not tainted 5.15.0-rc5-next-20211013-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200 Code: 81 e1 00 01 00 00 65 48 8b 14 25 40 70 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 ac 15 00 00 85 c0 74 2b 8b 82 88 15 00 00 <83> f8 02 75 20 48 8b 8a 90 15 00 00 8b 92 8c 15 00 00 48 8b 01 48 RSP: 0018:ffffc90001a7eed8 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffffea0008973e48 RCX: 0000000000000000 RDX: ffff88801c619d00 RSI: ffffffff81a35e53 RDI: ffffea0008973e74 RBP: ffffea0008973e40 R08: 0000000000000001 R09: ffffea0008973e77 R10: fffff9400112e7ce R11: 0000000000000000 R12: 0000000000000002 R13: dffffc0000000000 R14: ffff888140768020 R15: ffffea0008973e74 FS: 000000c00002e890(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c0002a4d15 CR3: 000000007f71f000 CR4: 00000000003506e0 Call Trace: arch_atomic_fetch_add_unless include/linux/atomic/atomic-arch-fallback.h:1161 [inline] arch_atomic_add_unless include/linux/atomic/atomic-arch-fallback.h:1183 [inline] atomic_add_unless include/linux/atomic/atomic-instrumented.h:571 [inline] page_ref_add_unless include/linux/page_ref.h:238 [inline] get_page_unless_zero include/linux/mm.h:754 [inline] isolate_lru_pages+0x3f3/0x17b0 mm/vmscan.c:2043 shrink_inactive_list mm/vmscan.c:2288 [inline] shrink_list mm/vmscan.c:2530 [inline] shrink_lruvec+0xa42/0x25b0 mm/vmscan.c:2849 shrink_node_memcgs mm/vmscan.c:3038 [inline] shrink_node+0x858/0x1eb0 mm/vmscan.c:3161 shrink_zones mm/vmscan.c:3364 [inline] do_try_to_free_pages+0x386/0x1480 mm/vmscan.c:3419 try_to_free_pages+0x29f/0x750 mm/vmscan.c:3654 __perform_reclaim mm/page_alloc.c:4586 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4607 [inline] __alloc_pages_slowpath.constprop.0+0xac7/0x2290 mm/page_alloc.c:5024 __alloc_pages+0x412/0x500 mm/page_alloc.c:5395 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 folio_alloc+0x1c/0x70 mm/mempolicy.c:2201 filemap_alloc_folio+0x8e/0xb0 mm/filemap.c:1029 __page_cache_alloc include/linux/pagemap.h:325 [inline] page_cache_ra_unbounded+0x36a/0x940 mm/readahead.c:215 do_page_cache_ra+0xf9/0x140 mm/readahead.c:268 do_sync_mmap_readahead mm/filemap.c:2986 [inline] filemap_fault+0x1562/0x26d0 mm/filemap.c:3079 __do_fault+0x10d/0x4d0 mm/memory.c:3849 do_read_fault mm/memory.c:4155 [inline] do_fault mm/memory.c:4284 [inline] handle_pte_fault mm/memory.c:4542 [inline] __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4677 handle_mm_fault+0x1c8/0x790 mm/memory.c:4775 do_user_addr_fault+0x489/0x11c0 arch/x86/mm/fault.c:1397 handle_page_fault arch/x86/mm/fault.c:1485 [inline] exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1541 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568 RIP: 0033:0x402a14 Code: fd d7 d6 48 83 c6 40 48 83 c7 40 48 83 eb 40 81 fa ff ff ff ff 74 c4 c5 f8 77 c6 00 00 c3 c5 f8 77 48 83 fb 08 76 1b 48 8b 0e <48> 8b 17 48 83 c6 08 48 83 c7 08 48 83 eb 08 48 39 d1 74 e3 c6 00 RSP: 002b:000000c002748e80 EFLAGS: 00010212 RAX: 000000c002748ea0 RBX: 0000000000000010 RCX: 0000000030746973 RDX: 0000000000000010 RSI: 000000c002fcb5c0 RDI: 00000000007ff863 RBP: 000000c002748f88 R08: 00000000019dcc30 R09: 0000000000000003 R10: 00000000007ff863 R11: 000000c002fcb5c0 R12: ffffffffffffffff R13: 000000000000015d R14: 000000000000015c R15: 0000000000000200 ---------------- Code disassembly (best guess): 0: 81 e1 00 01 00 00 and $0x100,%ecx 6: 65 48 8b 14 25 40 70 mov %gs:0x27040,%rdx d: 02 00 f: a9 00 01 ff 00 test $0xff0100,%eax 14: 74 0e je 0x24 16: 85 c9 test %ecx,%ecx 18: 74 35 je 0x4f 1a: 8b 82 ac 15 00 00 mov 0x15ac(%rdx),%eax 20: 85 c0 test %eax,%eax 22: 74 2b je 0x4f 24: 8b 82 88 15 00 00 mov 0x1588(%rdx),%eax * 2a: 83 f8 02 cmp $0x2,%eax <-- trapping instruction 2d: 75 20 jne 0x4f 2f: 48 8b 8a 90 15 00 00 mov 0x1590(%rdx),%rcx 36: 8b 92 8c 15 00 00 mov 0x158c(%rdx),%edx 3c: 48 8b 01 mov (%rcx),%rax 3f: 48 rex.W