INFO: task syz-executor3:2314 blocked for more than 140 seconds.
      Not tainted 4.4.169+ #2
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D ffff8800a6ac7970 29872  2314   2311 0x00000000
 ffff8800a6ac7970 ffff8801c098e7c8 0000000000000000 0000000000000000
 ffff8800a6ac7a98 ffffffff811ffe00 ffff8801db61f180 ffff8801db61f1a8
 ffff8801db61e898 ffff8800b58d0000 ffff8801c098df00 ffffed0014d58001
Call Trace:
 [<ffffffff827065e9>] schedule+0x99/0x1d0 kernel/sched/core.c:3355
 [<ffffffff827126bb>] schedule_timeout+0x47b/0x7c0 kernel/time/timer.c:1515
 [<ffffffff8271400f>] down_read_failed+0x27f/0x550 drivers/tty/tty_ldsem.c:241
 [<ffffffff82714378>] __ldsem_down_read_nested drivers/tty/tty_ldsem.c:332 [inline]
 [<ffffffff82714378>] ldsem_down_read+0x98/0xc0 drivers/tty/tty_ldsem.c:367
 [<ffffffff81c9a8eb>] tty_ldisc_ref_wait+0x2b/0xc0 drivers/tty/tty_ldisc.c:263
 [<ffffffff81c841cd>] tty_ioctl+0x4bd/0x2000 drivers/tty/tty_io.c:2988
 [<ffffffff814d1d67>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff814d1d67>] file_ioctl fs/ioctl.c:470 [inline]
 [<ffffffff814d1d67>] do_vfs_ioctl+0x6e7/0xfa0 fs/ioctl.c:605
 [<ffffffff814d26af>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff814d26af>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
 [<ffffffff827153a1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
1 lock held by syz-executor3/2314:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff81c9a8eb>] tty_ldisc_ref_wait+0x2b/0xc0 drivers/tty/tty_ldisc.c:263
Sending NMI to all CPUs:
NMI backtrace for cpu 0
CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.169+ #2
task: ffff8801da6f4740 task.stack: ffff8800001d0000
RIP: 0010:[<ffffffff8109b617>]  [<ffffffff8109b617>] _flat_send_IPI_mask arch/x86/kernel/apic/apic_flat_64.c:62 [inline]
RIP: 0010:[<ffffffff8109b617>]  [<ffffffff8109b617>] flat_send_IPI_mask+0xf7/0x1b0 arch/x86/kernel/apic/apic_flat_64.c:69
RSP: 0018:ffff8800001d7c88  EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300
RBP: ffff8800001d7cb8 R08: 0000000000000018 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246
R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000010295c0 CR3: 00000001d57a9000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000001 ffffffff82e5f2e0 ffffffff831a6340 fffffbfff0634b44
 000000000001b6c0 0000000000000008 ffff8800001d7cd8 ffffffff81092bee
 0000000000000008 ffffffff829241a0 ffff8800001d7d30 ffffffff81ab6a72
Call Trace:
 [<ffffffff81092bee>] nmi_raise_cpu_backtrace+0x5e/0x80 arch/x86/kernel/apic/hw_nmi.c:33
 [<ffffffff81ab6a72>] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae lib/nmi_backtrace.c:85
 [<ffffffff81092ca4>] arch_trigger_all_cpu_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 [<ffffffff813b4576>] trigger_all_cpu_backtrace include/linux/nmi.h:44 [inline]
 [<ffffffff813b4576>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff813b4576>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff813b4576>] watchdog.cold+0xd3/0xee kernel/hung_task.c:238
 [<ffffffff811340d3>] kthread+0x273/0x310 kernel/kthread.c:211
 [<ffffffff827157c5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537
Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 01 
NMI backtrace for cpu 1
CPU: 1 PID: 9022 Comm: syz-executor3 Not tainted 4.4.169+ #2
task: ffff8801d81aaf80 task.stack: ffff8801d05a8000
RIP: 0010:[<ffffffff81309426>]  [<ffffffff81309426>] __sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:100
RSP: 0018:ffff8801d05ae820  EFLAGS: 00000246
RAX: ffff8801d81aaf80 RBX: ffff8801d5702000 RCX: ffffc90006155000
RDX: 0000000000000002 RSI: ffffffff8224020f RDI: ffff8801d5702000
RBP: ffff8801d05ae820 R08: 0000000000000003 R09: ffff8801d81ab8e0
R10: ffffffff82836880 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8800b6f8e338 R14: ffff8801d57020a2 R15: 0000000000000000
FS:  00007fd3da75c700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f76e9bec518 CR3: 00000001d86a5000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d05ae8c8 ffffffff8224020f 1ffff1003a0b5d08 ffff8801d81ab838
 0000000041b58ab3 ffffffff82c9d018 ffffffff822401a0 ffff8801d05ae878
 ffffffff810e15ca 6a571df60739321f ffff8801d81aaf80 ffff8801d81aaf80
Call Trace:
 [<ffffffff8224020f>] netif_skb_features+0x6f/0x770 net/core/dev.c:2740
 [<ffffffff82240939>] validate_xmit_skb.isra.0.part.0+0x29/0xa90 net/core/dev.c:2831
 [<ffffffff82243f92>] validate_xmit_skb net/core/dev.c:2968 [inline]
 [<ffffffff82243f92>] __dev_queue_xmit+0x1612/0x1bb0 net/core/dev.c:3221
 [<ffffffff82244548>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff823c2c72>] neigh_hh_output include/net/neighbour.h:486 [inline]
 [<ffffffff823c2c72>] dst_neigh_output include/net/dst.h:459 [inline]
 [<ffffffff823c2c72>] ip_finish_output2+0xbf2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823c99f2>] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288
 [<ffffffff823cd7b7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823cd7b7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823ca52c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823ca52c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff824e673b>] iptunnel_xmit+0x54b/0x6c0 net/ipv4/ip_tunnel_core.c:82
 [<ffffffff824f2e74>] ip_tunnel_xmit+0xd24/0x31e0 net/ipv4/ip_tunnel.c:757
 [<ffffffff826a6335>] ipip_tunnel_xmit net/ipv6/sit.c:1015 [inline]
 [<ffffffff826a6335>] sit_tunnel_xmit+0x1e5/0x2610 net/ipv6/sit.c:1027
 [<ffffffff82241c71>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff82241c71>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff82241c71>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff82241c71>] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797
 [<ffffffff82243fcb>] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229
 [<ffffffff82244548>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff82258d