INFO: task syz.1.463:7080 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.463 state:D stack:26232 pid:7080 tgid:7079 ppid:5808 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
io_schedule+0xbf/0x130 kernel/sched/core.c:7871
folio_wait_bit_common+0x3d5/0x9e0 mm/filemap.c:1330
folio_lock include/linux/pagemap.h:1141 [inline]
migrate_folio_unmap mm/migrate.c:1241 [inline]
migrate_pages_batch+0x1487/0x3bb0 mm/migrate.c:1882
migrate_pages_sync+0x4c5/0x8a0 mm/migrate.c:2026
migrate_pages+0x1b5f/0x23a0 mm/migrate.c:2108
compact_zone+0x2018/0x4750 mm/compaction.c:2647
compact_node+0x1a3/0x2c0 mm/compaction.c:2916
compact_nodes mm/compaction.c:2938 [inline]
sysctl_compaction_handler mm/compaction.c:2989 [inline]
sysctl_compaction_handler+0x141/0x210 mm/compaction.c:2976
proc_sys_call_handler+0x445/0x570 fs/proc/proc_sysctl.c:600
iter_file_splice_write+0xa24/0x12e0 fs/splice.c:738
do_splice_from fs/splice.c:938 [inline]
direct_splice_actor+0x192/0x6c0 fs/splice.c:1161
splice_direct_to_actor+0x345/0xa30 fs/splice.c:1105
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0x174/0x240 fs/splice.c:1230
do_sendfile+0xb06/0xe50 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1425 [inline]
__se_sys_sendfile64 fs/read_write.c:1417 [inline]
__x64_sys_sendfile64+0x154/0x220 fs/read_write.c:1417
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5ecf8f6c9
RSP: 002b:00007ff5ede50038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ff5ed1e5fa0 RCX: 00007ff5ecf8f6c9
RDX: 00002000000000c0 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 00007ff5ed011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff5ed1e6038 R14: 00007ff5ed1e5fa0 R15: 00007ffcef341878
Showing all locks held in the system:
4 locks held by kworker/0:0/9:
#0: ffff88813ff11948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc900000e7d00 ((work_completion)(&aux->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff8880b8425b18 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x127/0x1d0 kernel/time/timer.c:1004
#3: ffffffff9ad46328 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 lib/debugobjects.c:818
3 locks held by kworker/1:0/24:
#0: ffff88813ff11948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc900001e7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff8880553a3240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b6/0x6da0 drivers/net/netdevsim/fib.c:1490
1 lock held by khungtaskd/31:
#0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
3 locks held by acpid/5169:
#0: ffff888054751160 (&mousedev->mutex#2){+.+.}-{4:4}, at: mousedev_open_device+0x23/0x140 drivers/input/mousedev.c:423
#1: ffff888057f0d2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:230 [inline]
#1: ffff888057f0d2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_open_device+0x4b/0x3d0 drivers/input/input.c:583
#2: ffff88801d761148 (&dev->pm_mutex#2){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:228 [inline]
#2: ffff88801d761148 (&dev->pm_mutex#2){+.+.}-{4:4}, at: bcm5974_open+0xa5/0x1c0 drivers/input/mouse/bcm5974.c:837
2 locks held by getty/5570:
#0: ffff88803138c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
8 locks held by kworker/0:3/5867:
#0: ffff888023689548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000411fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff888029221198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:914 [inline]
#2: ffff888029221198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 drivers/usb/core/hub.c:5898
#3: ffff888054728198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:914 [inline]
#3: ffff888054728198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1006
#4: ffff888057f0c160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:914 [inline]
#4: ffff888057f0c160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1006
#5: ffffffff8f911fe8 (input_mutex){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:230 [inline]
#5: ffffffff8f911fe8 (input_mutex){+.+.}-{4:4}, at: input_register_device+0x992/0x1180 drivers/input/input.c:2374
#6: ffff8881473f5160 (&mousedev->mutex/1){+.+.}-{4:4}, at: mixdev_add_device drivers/input/mousedev.c:939 [inline]
#6: ffff8881473f5160 (&mousedev->mutex/1){+.+.}-{4:4}, at: mousedev_connect+0x5d/0x340 drivers/input/mousedev.c:985
#7: ffff888054751160 (&mousedev->mutex#2){+.+.}-{4:4}, at: mousedev_open_device+0x23/0x140 drivers/input/mousedev.c:423
1 lock held by udevd/6100:
#0: ffff8881437b3358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:945
1 lock held by udevd/6348:
#0: ffff888025efb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:945
1 lock held by syz.1.463/7080:
#0: ffff888032412420 (sb_writers#3){.+.+}-{0:0}, at: splice_direct_to_actor+0x345/0xa30 fs/splice.c:1105
1 lock held by syz.5.1387/9458:
#0: ffffffff8e3cfcb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.6.2323/11709:
#0: ffffffff8e3cfcb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.0.2337/11742:
#0: ffffffff8e3cfb80 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6e0 kernel/rcu/tree.c:3820
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3f/0x1170 kernel/hung_task.c:495
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 2955 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:rol32 include/linux/bitops.h:126 [inline]
RIP: 0010:chacha_permute+0x48e/0x6d0 lib/crypto/chacha-block-generic.c:41
Code: d7 31 fd 45 01 ee 41 01 c3 45 01 e7 c1 c5 08 45 31 f1 44 31 de 44 31 f9 41 c1 c1 07 41 01 ea c1 c6 08 44 31 d2 44 89 4c 24 08 c1 07 c1 c2 07 01 cb 41 89 d1 8b 54 24 04 45 01 c8 01 f2 31 de
RSP: 0018:ffffc9000c0877c0 EFLAGS: 00000082
RAX: 00000000da2cfb33 RBX: 00000000a62e2117 RCX: 00000000a9eb4246
RDX: 00000000deface8a RSI: 0000000097c03673 RDI: 000000001a269e21
RBP: 0000000060243d05 R08: 00000000d0482819 R09: 0000000041c6fa97
R10: 00000000257f4c77 R11: 00000000348652c8 R12: 0000000052194a3b
R13: 00000000508b5e24 R14: 00000000657560d0 R15: 000000007beb1c11
FS: 0000000000000000(0000) GS:ffff888124a08000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056027d948ad8 CR3: 0000000028c59000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000004501 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
chacha_block_generic+0x129/0x330 lib/crypto/chacha-block-generic.c:83
chacha20_block include/crypto/chacha.h:45 [inline]
crng_fast_key_erasure+0x19e/0x250 drivers/char/random.c:326
crng_make_state+0x1cc/0x6d0 drivers/char/random.c:392
_get_random_bytes+0x120/0x1e0 drivers/char/random.c:406
eth_random_addr include/linux/etherdevice.h:238 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:770 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
nsim_dev_trap_report_work+0x371/0xcf0 drivers/net/netdevsim/dev.c:866
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245