INFO: task syz.1.2856:14359 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2856 state:D stack:24296 pid:14359 tgid:14356 ppid:5796 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x1553/0x5240 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
io_schedule+0x80/0xe0 kernel/sched/core.c:7835
folio_wait_bit_common+0x6dd/0xbc0 mm/filemap.c:1323
folio_lock include/linux/pagemap.h:1159 [inline]
migrate_folio_unmap mm/migrate.c:1250 [inline]
migrate_pages_batch+0x1864/0x4090 mm/migrate.c:1890
migrate_pages_sync mm/migrate.c:2034 [inline]
migrate_pages+0x20c5/0x2a50 mm/migrate.c:2116
compact_zone+0x26ec/0x4890 mm/compaction.c:2647
compact_node mm/compaction.c:2916 [inline]
compact_nodes mm/compaction.c:2938 [inline]
sysctl_compaction_handler+0x3f3/0x870 mm/compaction.c:2989
proc_sys_call_handler+0x4c9/0x830 fs/proc/proc_sysctl.c:600
iter_file_splice_write+0x9a6/0x10f0 fs/splice.c:736
do_splice_from fs/splice.c:936 [inline]
direct_splice_actor+0x104/0x160 fs/splice.c:1159
splice_direct_to_actor+0x545/0xc80 fs/splice.c:1103
do_splice_direct_actor fs/splice.c:1202 [inline]
do_splice_direct+0x19b/0x2a0 fs/splice.c:1228
do_sendfile+0x547/0x7e0 fs/read_write.c:1372
__do_sys_sendfile64 fs/read_write.c:1427 [inline]
__se_sys_sendfile64+0xdf/0x1a0 fs/read_write.c:1419
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1ffcedc819
RSP: 002b:00007f1ffb136028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f1ffd155fa0 RCX: 00007f1ffcedc819
RDX: 00002000000000c0 RSI: 0000000000000006 RDI: 0000000000000007
RBP: 00007f1ffcf72c91 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1ffd156038 R14: 00007f1ffd155fa0 R15: 00007fffeb3e31d8
Showing all locks held in the system:
1 lock held by khungtaskd/38:
#0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by kworker/u8:13/1550:
#0: ffff888019c44938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff888019c44938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc900063c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc900063c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
6 locks held by kworker/u8:14/1778:
4 locks held by kworker/u8:15/4166:
#0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc9001036fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc9001036fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffffffff8f14eb40 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:675
#3: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by klogd/5155:
2 locks held by getty/5556:
#0: ffff88803797e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e832e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 drivers/tty/n_tty.c:2211
5 locks held by syz-executor/5783:
2 locks held by kworker/1:5/5889:
7 locks held by kworker/1:2H/9362:
5 locks held by kworker/u8:1/11303:
5 locks held by kworker/u8:1/11303:
5 locks held by kworker/0:8/11890:
#0: ffff888021ec9538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff888021ec9538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc900059efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc900059efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffff88802963a210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#2: ffff88802963a210 (&dev->mutex){....}-{4:4}, at: hub_event+0x17c/0x4f60 drivers/usb/core/hub.c:5899
#3: ffff888058fce210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#3: ffff888058fce210 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1068
#4: ffff8880807dc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#4: ffff8880807dc1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1068
6 locks held by kworker/0:10/11891:
3 locks held by kworker/1:9/11912:
1 lock held by udevd/13160:
#0: ffff88802675f4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 block/bdev.c:961
4 locks held by kworker/u8:7/14132:
#0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc900065d7c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc900065d7c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffffffff8dc5bb30 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222
#3: ffffffff8de9bf98 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline]
#3: ffffffff8de9bf98 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207
1 lock held by syz.1.2856/14359:
#0: ffff88804c73a480 (sb_writers#3){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1158
1 lock held by syz.0.3212/15658:
#0: ffff88802675f4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 block/bdev.c:961
2 locks held by syz-executor/15793:
1 lock held by modprobe/15896:
3 locks held by syz.3.3276/15903:
#0: ffffffff8f1cb8a0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
#1: ffff88804068e928 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 net/netlink/af_netlink.c:2404
#2: ffffffff8f15d2f8 (rtnl_mutex){+.+.}-{4:4}, at: ethnl_default_dump_one+0x151/0x7e0 net/ethtool/netlink.c:590
3 locks held by syz.6.3275/15898:
1 lock held by syz.6.3275/15900:
#0: ffffffff8f160ab8 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0xc6/0xd70 kernel/bpf/dispatcher.c:146
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfd9/0x1030 kernel/hung_task.c:515
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 11303 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__sanitizer_cov_trace_switch+0x8a/0x140 kernel/kcov.c:350
Code: 85 c0 0f 84 d2 00 00 00 55 41 57 41 56 41 55 41 54 53 48 8b 54 24 30 65 4c 8b 05 a9 57 8a 10 45 31 c9 41 ba 00 01 00 00 eb 0c <49> ff c1 4c 39 c8 0f 84 86 00 00 00 4e 8b 5c ce 10 65 8b 2d ae 57
RSP: 0018:ffffc900075a7088 EFLAGS: 00000293
RAX: 000000000000002b RBX: 0000000000000000 RCX: 0000000000000001
RDX: ffffffff8aa2fbbf RSI: ffffffff8f41a790 RDI: 00000000000000dd
RBP: 0000000000000000 R08: ffff888028528000 R09: 0000000000000024
R10: 0000000000000100 R11: 00000000000000d3 R12: ffff888059694a53
R13: ffff888059694a5c R14: 0000000000000000 R15: 00000000000000dd
FS: 0000000000000000(0000) GS:ffff888126432000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f192d517e20 CR3: 0000000072780000 CR4: 00000000003526f0
Call Trace:
_ieee802_11_parse_elems_full+0xd3f/0x4380 net/mac80211/parse.c:397
ieee802_11_parse_elems_full+0x1226/0x2ab0 net/mac80211/parse.c:1102
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2480 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1571 [inline]
ieee80211_ibss_rx_queued_mgmt+0x4ca/0x2cd0 net/mac80211/ibss.c:1602
ieee80211_iface_process_skb net/mac80211/iface.c:1748 [inline]
ieee80211_iface_work+0x84e/0x1340 net/mac80211/iface.c:1802
cfg80211_wiphy_work+0x2ab/0x4a0 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245