INFO: task syz-executor2:3912 blocked for more than 120 seconds.
      Not tainted 4.4.106-g2fea039 #8
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D ffff8800b6a577c8 29304  3912   3533 0x00000004
 ffff8800b6a577c8 dffffc0000000000 ffff8800ae954ef0 ffff8800b6a577a8
 ffffffff8122851f ffff8800ae954e00 ffff8801db51f878 ffff8801db51f8a0
 ffff8801db51ef98 ffff8801cdd25e00 ffff8800ae954680 ffff8800b6a50000
Call Trace:
 [<ffffffff8373bbfa>] schedule+0x9a/0x1c0 kernel/sched/core.c:3351
 [<ffffffff83745eaf>] rwsem_down_read_failed+0x1bf/0x300 kernel/locking/rwsem-xadd.c:250
 [<ffffffff81cf9b84>] call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:90
 [<ffffffff81f13ee2>] set_termios+0xe2/0x570 drivers/tty/tty_ioctl.c:599
 [<ffffffff81f14b9e>] tty_mode_ioctl+0x7ce/0x8b0 drivers/tty/tty_ioctl.c:977
 [<ffffffff81f14cd8>] n_tty_ioctl_helper+0x28/0x320 drivers/tty/tty_ioctl.c:1168
 [<ffffffff81f0787c>] n_tty_ioctl+0x12c/0x2c0 drivers/tty/n_tty.c:2503
 [<ffffffff81eff005>] tty_ioctl+0x675/0x1fa0 drivers/tty/tty_io.c:2980
 [<ffffffff81532211>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81532211>] do_vfs_ioctl+0x681/0xe10 fs/ioctl.c:607
 [<ffffffff81532a14>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff81532a14>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
 [<ffffffff8374a3b6>] entry_SYSCALL_64_fastpath+0x16/0x76
2 locks held by syz-executor2/3912:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff81f155bd>] tty_ldisc_ref_wait+0x1d/0xa0 drivers/tty/tty_ldisc.c:264
 #1:  (&o_tty->termios_rwsem/1){++++.+}, at: [<ffffffff81f13ee2>] set_termios+0xe2/0x570 drivers/tty/tty_ioctl.c:599
Sending NMI to all CPUs:
NMI backtrace for cpu 0
CPU: 0 PID: 483 Comm: khungtaskd Not tainted 4.4.106-g2fea039 #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800bac10000 task.stack: ffff8800bb3b0000
RIP: 0010:[<ffffffff810bf397>]  [<ffffffff810bf397>] native_apic_mem_write arch/x86/include/asm/apic.h:94 [inline]
RIP: 0010:[<ffffffff810bf397>]  [<ffffffff810bf397>] __default_send_IPI_dest_field arch/x86/include/asm/ipi.h:119 [inline]
RIP: 0010:[<ffffffff810bf397>]  [<ffffffff810bf397>] _flat_send_IPI_mask arch/x86/kernel/apic/apic_flat_64.c:61 [inline]
RIP: 0010:[<ffffffff810bf397>]  [<ffffffff810bf397>] flat_send_IPI_mask+0xf7/0x1a0 arch/x86/kernel/apic/apic_flat_64.c:69
RSP: 0018:ffff8800bb3b7cb8  EFLAGS: 00000046
RAX: 0000000003000000 RBX: 0000000000000c00 RCX: 0000000000000000
RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fb300
RBP: ffff8800bb3b7ce0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000246
R13: 0000000000000003 R14: ffffffff8426aba0 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f653b499000 CR3: 00000000b9e0b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8426aba0 ffffffff847e73c0 ffffffff847e4964 0000000000000001
 dffffc0000000000 ffff8800bb3b7d00 ffffffff810b4ecb fffffbfff08fc92c
 00000000000194a0 ffff8800bb3b7d68 ffffffff81cd3638 ffff8800bb3b7d28
Call Trace:
 [<ffffffff810b4ecb>] nmi_raise_cpu_backtrace+0x5b/0x70 arch/x86/kernel/apic/hw_nmi.c:33
 [<ffffffff81cd3638>] nmi_trigger_all_cpu_backtrace+0x428/0x590 lib/nmi_backtrace.c:85
 [<ffffffff810b4f64>] arch_trigger_all_cpu_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 [<ffffffff8134cf66>] trigger_all_cpu_backtrace include/linux/nmi.h:44 [inline]
 [<ffffffff8134cf66>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8134cf66>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8134cf66>] watchdog+0x636/0xa20 kernel/hung_task.c:238
 [<ffffffff81184135>] kthread+0x245/0x310 kernel/kthread.c:211
 [<ffffffff8374a76f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
Code: b3 5f ff f6 c4 10 75 e1 44 89 e8 c1 e0 18 89 04 25 10 b3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 b3 5f ff <41> f7 c4 00 02 00 00 74 1a e8 5b 97 16 00 4c 89 e7 57 9d 0f 1f 
NMI backtrace for cpu 1
CPU: 1 PID: 3906 Comm: syz-executor2 Not tainted 4.4.106-g2fea039 #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cdd25e00 task.stack: ffff8800ae938000
RIP: 0010:[<ffffffff81f07937>]  [<ffffffff81f07937>] variable_test_bit arch/x86/include/asm/bitops.h:318 [inline]
RIP: 0010:[<ffffffff81f07937>]  [<ffffffff81f07937>] inq_canon drivers/tty/n_tty.c:2477 [inline]
RIP: 0010:[<ffffffff81f07937>]  [<ffffffff81f07937>] n_tty_ioctl+0x1e7/0x2c0 drivers/tty/n_tty.c:2497
RSP: 0018:ffff8800ae93fb70  EFLAGS: 00000206
RAX: ffffffffffffffff RBX: dffffc0000000000 RCX: 0000000000000000
RDX: ffff8800bb9e4eb8 RSI: 0000000000000000 RDI: ffffc90000e36268
RBP: ffff8800ae93fbb8 R08: ffffc90000e35060 R09: ffffffff8511d760
R10: 0000000000000001 R11: 1ffff10015d27f34 R12: 0000000020e7f000
R13: ffffc90000e34000 R14: 0000000ea380b133 R15: 0000000000000133
FS:  00007eff34ca7700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c422400000 CR3: 00000000b6ff2000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8374947c ffffffff81f155bd ffff8800bb9e4c80 ffff8800bb9e4eb8
 ffff8800bb9e4c80 1ffff10015d27f7d ffff8801d9f2b800 000000000000541b
 ffffffffffffffea ffff8800ae93fdb0 ffffffff81eff005 ffff8800ae93fe18
Call Trace:
 [<ffffffff81eff005>] tty_ioctl+0x675/0x1fa0 drivers/tty/tty_io.c:2980
 [<ffffffff81532211>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81532211>] do_vfs_ioctl+0x681/0xe10 fs/ioctl.c:607
 [<ffffffff81532a14>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff81532a14>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
 [<ffffffff8374a3b6>] entry_SYSCALL_64_fastpath+0x16/0x76
Code: 0f 84 33 ff ff ff 4d 8d 85 60 10 00 00 48 89 f0 48 bb 00 00 00 00 00 fc ff df 4c 29 f0 4d 89 f7 41 81 e7 ff 0f 00 00 4d 0f a3 38 <19> c9 85 c9 74 2c 4b 8d 7c 3d 5e 48 89 f9 49 89 f9 48 c1 e9 03