ion_ioctl: ioctl validate failed
INFO: task syz-executor7:2981 blocked for more than 140 seconds.
      Not tainted 4.9.111-g03c70fe #58
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7   D28216  2981   3838 0x00000004
 ffff8801a1de0000 ffff8801ca5164c0 ffff8801ca5164c0 ffff8801a1de1800
 ffff8801db221c18 ffff8801d6e8f3e0 ffffffff839e7ded ffffffff855ba920
 ffff8801db221c18 0000000000004c93 00ff8801a1de08e0 ffff8801db2224e8
Call Trace:
 [<ffffffff839e93ef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3557
 [<ffffffff839f5801>] schedule_timeout+0x861/0xf70 kernel/time/timer.c:1768
 [<ffffffff839ec5b3>] do_wait_for_common kernel/sched/completion.c:75 [inline]
 [<ffffffff839ec5b3>] __wait_for_common kernel/sched/completion.c:93 [inline]
 [<ffffffff839ec5b3>] wait_for_common kernel/sched/completion.c:101 [inline]
 [<ffffffff839ec5b3>] wait_for_completion+0x203/0x2e0 kernel/sched/completion.c:122
 [<ffffffff81189754>] flush_work+0x3a4/0x6c0 kernel/workqueue.c:2846
 [<ffffffff811904ae>] __cancel_work_timer+0x17e/0x440 kernel/workqueue.c:2912
 [<ffffffff81190787>] cancel_work_sync+0x17/0x20 kernel/workqueue.c:2947
 [<ffffffff839c1ed5>] p9_conn_destroy net/9p/trans_fd.c:856 [inline]
 [<ffffffff839c1ed5>] p9_fd_close+0x1e5/0x330 net/9p/trans_fd.c:883
 [<ffffffff839b33c5>] p9_client_create+0x825/0x10a0 net/9p/client.c:1050
 [<ffffffff8195ab03>] v9fs_session_init+0x333/0x13a0 fs/9p/v9fs.c:343
 [<ffffffff8194c3fd>] v9fs_mount+0x7d/0x810 fs/9p/vfs_super.c:130
 [<ffffffff8157e22c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815dd9f1>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 [<ffffffff815e5319>] vfs_kern_mount fs/namespace.c:973 [inline]
 [<ffffffff815e5319>] do_new_mount fs/namespace.c:2513 [inline]
 [<ffffffff815e5319>] do_mount+0x3c9/0x2740 fs/namespace.c:2835
 [<ffffffff815e806e>] SYSC_mount fs/namespace.c:3051 [inline]
 [<ffffffff815e806e>] SyS_mount+0xfe/0x110 fs/namespace.c:3028
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f8cd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/519:
 #0:  (rcu_read_lock){......}, at: [<ffffffff813666fc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff813666fc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff81425d87>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
2 locks held by kworker/0:3/1836:
 #0:  ("events"){.+.+.+}, at: [<ffffffff8118d03e>] work_static include/linux/workqueue.h:186 [inline]
 #0:  ("events"){.+.+.+}, at: [<ffffffff8118d03e>] set_work_data kernel/workqueue.c:617 [inline]
 #0:  ("events"){.+.+.+}, at: [<ffffffff8118d03e>] set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0:  ("events"){.+.+.+}, at: [<ffffffff8118d03e>] process_one_work+0x6ee/0x1500 kernel/workqueue.c:2085
 #1:  ((&m->rq)){+.+...}, at: [<ffffffff8118d078>] process_one_work+0x728/0x1500 kernel/workqueue.c:2089
1 lock held by rsyslogd/3672:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff815d810c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/3768:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff839f6e92>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff8211e602>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2133

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 519 Comm: khungtaskd Not tainted 4.9.111-g03c70fe #58
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d86f7d08 ffffffff81eb2729 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810b9af0 ffff8801d86f7d40
 ffffffff81ebda27 0000000000000001 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81eb2729>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb2729>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81ebda27>] nmi_cpu_backtrace.cold.2+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81ebd9ba>] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60
 [<ffffffff810b9bf4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff81366c94>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff81366c94>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81366c94>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81366c94>] watchdog+0x6b4/0xa20 kernel/hung_task.c:239
 [<ffffffff8119d05d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff839f8e9c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff839f78f6