syzbot

INFO: task syz.3.1334:11198 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1334      state:D stack:25336 pid:11198 tgid:11196 ppid:5808   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6911
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7008
 io_schedule+0x8a/0xf0 kernel/sched/core.c:7835
 folio_wait_bit_common+0x414/0xa70 mm/filemap.c:1323
 folio_lock include/linux/pagemap.h:1170 [inline]
 migrate_folio_unmap mm/migrate.c:1250 [inline]
 migrate_pages_batch+0x1b85/0x4530 mm/migrate.c:1890
 migrate_pages_sync+0x4db/0x880 mm/migrate.c:2034
 migrate_pages+0x1aae/0x28a0 mm/migrate.c:2116
 compact_zone+0x2464/0x44c0 mm/compaction.c:2647
 compact_node+0x17f/0x2c0 mm/compaction.c:2916
 compact_nodes mm/compaction.c:2938 [inline]
 sysctl_compaction_handler mm/compaction.c:2989 [inline]
 sysctl_compaction_handler+0x141/0x210 mm/compaction.c:2976
 proc_sys_call_handler+0x47f/0x5a0 fs/proc/proc_sysctl.c:600
 iter_file_splice_write+0x830/0x10a0 fs/splice.c:736
 do_splice_from fs/splice.c:936 [inline]
 direct_splice_actor+0x192/0x6c0 fs/splice.c:1159
 splice_direct_to_actor+0x345/0xa30 fs/splice.c:1103
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x174/0x240 fs/splice.c:1228
 do_sendfile+0xadc/0xe20 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1427 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x154/0x220 fs/read_write.c:1419
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe25af9c799
RSP: 002b:00007fe25bde7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fe25b216090 RCX: 00007fe25af9c799
RDX: 00002000000000c0 RSI: 0000000000000006 RDI: 0000000000000007
RBP: 00007fe25b032c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe25b216128 R14: 00007fe25b216090 R15: 00007ffdd75f9948
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
2 locks held by getty/5572:
 #0: ffff88803301d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
3 locks held by kworker/0:5/5865:
 #0: ffff88813fe67148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251
 #1: ffffc90004317d08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252
 #2: ffff888078710240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x63b0 drivers/net/netdevsim/fib.c:1490
1 lock held by udevd/5963:
 #0: ffff888027380358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:961
4 locks held by kworker/u8:12/7082:
3 locks held by kworker/u8:16/7093:
 #0: ffff88813fe9c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 kernel/workqueue.c:3251
 #1: ffffc9000d50fd08 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 kernel/workqueue.c:3252
 #2: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:313
1 lock held by syz.3.1334/11198:
 #0: ffff88807f1d6420 (sb_writers#3){.+.+}-{0:0}, at: splice_direct_to_actor+0x345/0xa30 fs/splice.c:1103
3 locks held by syz.2.1826/13078:
 #0: ffffffff90dba768 (&ops->srcu#2){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #0: ffffffff90dba768 (&ops->srcu#2){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #0: ffffffff90dba768 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 net/core/rtnetlink.c:574
 #1: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #1: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #1: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8bb/0x2380 net/core/rtnetlink.c:4071
 #2: ffffffff8e7f32b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
4 locks held by syz.5.1828/13085:
 #0: ffffffff906bd7d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
 #1: ffff888057dc60e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #1: ffff888057dc60e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline]
 #1: ffff888057dc60e8 (&dev->mutex){....}-{4:4}, at: devlink_get_from_attrs_lock+0x2ff/0x420 net/devlink/netlink.c:198
 #2: ffff8880298a8250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline]
 #2: ffff8880298a8250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devlink_get_from_attrs_lock+0x307/0x420 net/devlink/netlink.c:198
 #3: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #3: ffffffff90611468 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x146/0x360 net/core/dev.c:2162

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xd25/0x1050 kernel/hung_task.c:515
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5873 Comm: kworker/1:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events legacy_dvb_usb_read_remote_control
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:407
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 4d 19 06 e8 61 61 fb fc eb a0 e8 ea 61 fb
RSP: 0018:ffffc90004397660 EFLAGS: 00000006
RAX: 0000000000000000 RBX: 00000000000003f9 RCX: 0000000000000000
RDX: 00000000000003f9 RSI: ffffffff8579ee15 RDI: ffffffff9b4a3a80
RBP: ffffffff9b4a3a40 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff9b4a3a90 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124442000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000032000 CR3: 000000001fee2000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 serial_out drivers/tty/serial/8250/8250.h:133 [inline]
 serial8250_clear_IER+0xa7/0xd0 drivers/tty/serial/8250/8250_port.c:714
 serial8250_console_write+0x252/0x1900 drivers/tty/serial/8250/8250_port.c:3307
 console_emit_next_record kernel/printk/printk.c:3183 [inline]
 console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269
 console_flush_all kernel/printk/printk.c:3343 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3413
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
 _printk+0xcf/0x110 kernel/printk/printk.c:2504
 m920x_read drivers/media/usb/dvb-usb/m920x.c:40 [inline]
 m920x_rc_query.cold+0x2b/0x30 drivers/media/usb/dvb-usb/m920x.c:188
 legacy_dvb_usb_read_remote_control+0x10c/0x4f0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:123
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>