attempt to access beyond end of device
loop7: rw=536870912, want=313, limit=128
INFO: task syz-executor6:25150 blocked for more than 140 seconds.
      Not tainted 4.9.112-gf540ce0 #8
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor6   D28680 25150   3880 0x00000004
 ffff88019989e000 0000000000000000 ffff8801d9206f40 ffffffff84629800
 ffff8801db221c18 ffff8801cba875b8 ffffffff839e907d ffff88019989e8c8
 ffffed0033313d18 ffff88019989e000 00fffc0000000000 ffff8801db2224e8
Call Trace:
 [<ffffffff839ea67f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3557
 [<ffffffff839eb003>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3590
 [<ffffffff839ef486>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff839ef486>] mutex_lock_nested+0x326/0x870 kernel/locking/mutex.c:621
 [<ffffffff81938722>] fuse_lock_inode+0xa2/0xd0 fs/fuse/inode.c:362
 [<ffffffff8191b16f>] fuse_lookup+0x8f/0x3a0 fs/fuse/dir.c:405
 [<ffffffff81594dae>] lookup_slow+0x23e/0x470 fs/namei.c:1668
 [<ffffffff815a1336>] walk_component+0x716/0x1bb0 fs/namei.c:1784
 [<ffffffff815a3c96>] lookup_last fs/namei.c:2266 [inline]
 [<ffffffff815a3c96>] path_lookupat.isra.41+0x186/0x410 fs/namei.c:2283
 [<ffffffff815a9747>] filename_lookup.part.55+0x177/0x370 fs/namei.c:2317
 [<ffffffff815a9b03>] filename_lookup fs/namei.c:2310 [inline]
 [<ffffffff815a9b03>] user_path_at_empty+0x53/0x70 fs/namei.c:2578
 [<ffffffff815e5104>] user_path include/linux/namei.h:60 [inline]
 [<ffffffff815e5104>] do_mount+0x134/0x2740 fs/namespace.c:2780
 [<ffffffff815e80ee>] SYSC_mount fs/namespace.c:3051 [inline]
 [<ffffffff815e80ee>] SyS_mount+0xfe/0x110 fs/namespace.c:3028
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f9f53>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/519:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8136675c>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8136675c>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff81425de7>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
2 locks held by getty/3772:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff839f8122>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<ffffffff8211edc2>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor6/25150:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
 #1:  (&fi->mutex){+.+.+.}, at: [<ffffffff81938722>] fuse_lock_inode+0xa2/0xd0 fs/fuse/inode.c:362
2 locks held by syz-executor6/25154:
 #0:  (sb_writers#20){.+.+..}, at: [<ffffffff815e0a2f>] sb_start_write include/linux/fs.h:1573 [inline]
 #0:  (sb_writers#20){.+.+..}, at: [<ffffffff815e0a2f>] mnt_want_write+0x3f/0xb0 fs/namespace.c:391
 #1:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff815a4df5>] inode_lock include/linux/fs.h:766 [inline]
 #1:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff815a4df5>] do_last fs/namei.c:3312 [inline]
 #1:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff815a4df5>] path_openat+0xed5/0x3590 fs/namei.c:3534
1 lock held by syz-executor6/25158:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
1 lock held by syz-executor6/25159:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
1 lock held by syz-executor6/25164:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
1 lock held by syz-executor6/25169:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff815e184c>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff815e184c>] lock_mount+0x8c/0x2c0 fs/namespace.c:2077
1 lock held by syz-executor6/25172:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
1 lock held by syz-executor6/25174:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645
1 lock held by syz-executor6/25176:
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] inode_lock_shared include/linux/fs.h:776 [inline]
 #0:  (&type->i_mutex_dir_key#4){++++++}, at: [<ffffffff81594cb1>] lookup_slow+0x141/0x470 fs/namei.c:1645

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 519 Comm: khungtaskd Not tainted 4.9.112-gf540ce0 #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d8627d08 ffffffff81eb3249 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810b9bd0 ffff8801d8627d40
 ffffffff81ebe547 0000000000000001 0000000000000000 0000000000000002
Call Trace:
 [<ffffffff81eb3249>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb3249>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81ebe547>] nmi_cpu_backtrace.cold.2+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81ebe4da>] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60
 [<ffffffff810b9cd4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff81366cf4>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff81366cf4>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81366cf4>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81366cf4>] watchdog+0x6b4/0xa20 kernel/hung_task.c:239
 [<ffffffff8119d0bd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff839fa11c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 25157 Comm: syz-executor6 Not tainted 4.9.112-gf540ce0 #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801bf310000 task.stack: ffff8801d00a8000
RIP: 0010:[<ffffffff812343a9>] 
c [<ffffffff812343a9>] hlock_class kernel/locking/lockdep.c:149 [inline]
RIP: 0010:[<ffffffff812343a9>] 
c [<ffffffff812343a9>] mark_lock+0x89/0x1280 kernel/locking/lockdep.c:3039
RSP: 0018:ffff8801d00af2a8  EFLAGS: 00000002
RAX: 00000000000004ad RBX: ffff8801bf3108c8 RCX: 1ffff10037e6211d
RDX: 0000000000000000 RSI: ffff8801bf3108c8 RDI: ffff8801bf310000
RBP: ffff8801d00af2f0 R08: ffff8801bf3108e8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000007e240
R13: 0000000000000080 R14: 0000000000000007 R15: ffff8801bf310000
FS:  00007efdfe63a700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8183017000 CR3: 00000001b7e7e000 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffff8801bf3108f0
c 0000000000000002
c ffff8801d00af370
c 0000000000000046
c
 0000000000000000
c ffff8801bf3108c8
c ffffed0037e62118
c ffff8801bf310000
c
 dffffc0000000000
c ffff8801d00af340
c ffffffff81235667
c 0000000000000000
c
Call Trace:
 [<ffffffff81235667>] mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2660
 [<ffffffff81235a5b>] __trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline]
 [<ffffffff81235a5b>] trace_hardirqs_on_caller+0x38b/0x590 kernel/locking/lockdep.c:2736
 [<ffffffff81235c6d>] trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743
 [<ffffffff839f967a>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
 [<ffffffff839f967a>] _raw_spin_unlock_irqrestore+0x5a/0x70 kernel/locking/spinlock.c:191
 [<ffffffff81221749>] spin_unlock_irqrestore include/linux/spinlock.h:362 [inline]
 [<ffffffff81221749>] prepare_to_wait_event+0x1d9/0x450 kernel/sched/wait.c:238
 [<ffffffff81907b5e>] request_wait_answer+0x22e/0x6e0 fs/fuse/dev.c:459
 [<ffffffff81908669>] __fuse_request_send+0x109/0x1b0 fs/fuse/dev.c:480
 [<ffffffff8190876d>] fuse_request_send+0x5d/0x70 fs/fuse/dev.c:493
 [<ffffffff819129c4>] fuse_simple_request+0x2f4/0x660 fs/fuse/dev.c:551
 [<ffffffff8191ad63>] fuse_lookup_name+0x253/0x5d0 fs/fuse/dir.c:369
 [<ffffffff8191b1cd>] fuse_lookup+0xed/0x3a0 fs/fuse/dir.c:406
 [<ffffffff81594dae>] lookup_slow+0x23e/0x470 fs/namei.c:1668
 [<ffffffff815a1336>] walk_component+0x716/0x1bb0 fs/namei.c:1784
 [<ffffffff815a3c96>] lookup_last fs/namei.c:2266 [inline]
 [<ffffffff815a3c96>] path_lookupat.isra.41+0x186/0x410 fs/namei.c:2283
 [<ffffffff815a9747>] filename_lookup.part.55+0x177/0x370 fs/namei.c:2317
 [<ffffffff815a9b03>] filename_lookup fs/namei.c:2310 [inline]
 [<ffffffff815a9b03>] user_path_at_empty+0x53/0x70 fs/namei.c:2578
 [<ffffffff81580ae6>] user_path_at include/linux/namei.h:55 [inline]
 [<ffffffff81580ae6>] vfs_fstatat+0xc6/0x170 fs/stat.c:106
 [<ffffffff81581c96>] vfs_stat fs/stat.c:123 [inline]
 [<ffffffff81581c96>] SYSC_newstat+0x86/0xf0 fs/stat.c:270
 [<ffffffff8158209d>] SyS_newstat+0x1d/0x30 fs/stat.c:266
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f9f53>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 
c4c 
c89 
cc1 
c48 
cc1 
ce9 
c03 
c0f 
cb6 
c14 
c11 
c84 
cd2 
c74 
c09 
c80 
cfa 
c03 
c0f 
c8e 
c99 
c04 
c00 
c00 
c25 
cff 
c1f 
c00 
c00 
c4c 
c69 
ce0 
cb0 
c01 
c00 
c00 
c49 
c81 
cec 
cb0 
c01 
c00 
c00 
c<49> 
c81 
cc4 
c00 
c90 
c58 
c85 
c49 
c8d 
c7c 
c24 
c30 
c48 
cb8 
c00 
c00 
c00 
c00 
c00 
cfc 
cff 
c