audit: type=1400 audit(1572137507.540:39842): avc:  denied  { net_admin } for  pid=12778 comm="syz-executor.5" capability=12  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
audit: type=1400 audit(1572137507.540:39843): avc:  denied  { net_admin } for  pid=12778 comm="syz-executor.5" capability=12  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
audit: type=1400 audit(1572137507.540:39844): avc:  denied  { net_admin } for  pid=12778 comm="syz-executor.5" capability=12  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
INFO: task syz-executor.3:10568 blocked for more than 140 seconds.
      Not tainted 4.9.141+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3  D28920 10568   2080 0x80000002
 ffff88019d1faf80 ffff8801d05c2680 ffff8801d05c3700 ffff8801c52c17c0
 ffff8801db621018 ffff880195b7f7a8 ffffffff828075c2 0000000000000000
 ffff88019d1fb830 ffffed0033a3f705 00ff88019d1faf80 ffff8801db6218f0
Call Trace:
 [<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff828094a3>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3586
 [<ffffffff8280b51d>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff8280b51d>] mutex_lock_nested+0x38d/0x900 kernel/locking/mutex.c:621
 [<ffffffff81d276f9>] tty_release+0xb79/0xe90 drivers/tty/tty_io.c:1938
 [<ffffffff81510293>] __fput+0x263/0x700 fs/file_table.c:208
 [<ffffffff815107b5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8113dc4c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
 [<ffffffff810e6c4d>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff810e6c4d>] do_exit+0x78d/0x2a50 kernel/exit.c:833
 [<ffffffff810ed3a1>] do_group_exit+0x111/0x300 kernel/exit.c:937
 [<ffffffff8110eb61>] get_signal+0x4e1/0x1460 kernel/signal.c:2321
 [<ffffffff81052aa5>] do_signal+0x95/0x1b00 arch/x86/kernel/signal.c:807
 [<ffffffff81003e2e>] exit_to_usermode_loop+0x10e/0x150 arch/x86/entry/common.c:158
 [<ffffffff81005932>] prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 [<ffffffff81005932>] syscall_return_slowpath arch/x86/entry/common.c:263 [inline]
 [<ffffffff81005932>] do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.?..}, at: [<ffffffff813fe63f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1890:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cc7c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2017:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor.4/5081:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&tty->atomic_write_lock){+.+.+.}, at: [<ffffffff81d1f7e1>] tty_write_lock+0x21/0x60 drivers/tty/tty_io.c:1107
1 lock held by syz-executor.3/10568:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d276f9>] tty_release+0xb79/0xe90 drivers/tty/tty_io.c:1938
2 locks held by syz-executor.1/16340:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&tty->atomic_write_lock){+.+.+.}, at: [<ffffffff81d1f7e1>] tty_write_lock+0x21/0x60 drivers/tty/tty_io.c:1107
2 locks held by syz-executor.5/20074:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&tty->atomic_write_lock){+.+.+.}, at: [<ffffffff81d1f7e1>] tty_write_lock+0x21/0x60 drivers/tty/tty_io.c:1107
2 locks held by syz-executor.2/8526:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&tty->atomic_write_lock){+.+.+.}, at: [<ffffffff81d1f7e1>] tty_write_lock+0x21/0x60 drivers/tty/tty_io.c:1107
1 lock held by init/17370:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/17371:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/17372:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/17378:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/17380:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/17381:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1
 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c65d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3343 Comm: syz-executor.5 Not tainted 4.9.141+ #1
task: ffff8801d0438000 task.stack: ffff880195bd8000
RIP: 0010:[<ffffffff814ed3a9>] 
c [<ffffffff814ed3a9>] __cmpxchg_double_slab mm/slub.c:347 [inline]
RIP: 0010:[<ffffffff814ed3a9>] 
c [<ffffffff814ed3a9>] acquire_slab mm/slub.c:1774 [inline]
RIP: 0010:[<ffffffff814ed3a9>] 
c [<ffffffff814ed3a9>] get_partial_node.isra.28+0x1f9/0x4e0 mm/slub.c:1815
RSP: 0018:ffff880195bdf720  EFLAGS: 00000046
RAX: ffff8801c57973c0 RBX: ffff8801c57973c0 RCX: 00000001800c000b
RDX: 00000001000c000b RSI: 0000000000000000 RDI: 0000000000000046
RBP: ffff880195bdf820 R08: ffff8801d04388b0 R09: 00000001000c000b
R10: ffff8801c57973c0 R11: 0000000000000001 R12: ffffea000715e5c0
R13: ffff8801da4009c0 R14: ffff880127529dc0 R15: 000000000000000c
FS:  00007f58ecf19700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000712934 CR3: 000000012ab9c000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffffffff82e2eb6e
c 00000001000c000b
c ffff880127529dc0
c ffff8801db624680
c
 ffff8801da400a00
c 00000001024080c0
c ffffea000715e5e0
c ffffea0006d99480
c
 ffff8801da4009d8
c ffff8801da4013c0
c 80d50d3acf4b1154
c 0000000002627558
c
Call Trace:
 [<ffffffff814ed84a>] get_partial mm/slub.c:1915 [inline]
 [<ffffffff814ed84a>] new_slab_objects mm/slub.c:2414 [inline]
 [<ffffffff814ed84a>] ___slab_alloc.constprop.33+0x1ba/0x470 mm/slub.c:2576
 [<ffffffff814edb50>] __slab_alloc.isra.25.constprop.32+0x50/0xa0 mm/slub.c:2618
 [<ffffffff814ee42e>] slab_alloc_node mm/slub.c:2681 [inline]
 [<ffffffff814ee42e>] slab_alloc mm/slub.c:2723 [inline]
 [<ffffffff814ee42e>] __kmalloc+0x26e/0x310 mm/slub.c:3737
 [<ffffffff815ae043>] kmalloc_array include/linux/slab.h:582 [inline]
 [<ffffffff815ae043>] kcalloc include/linux/slab.h:593 [inline]
 [<ffffffff815ae043>] iter_file_splice_write+0x143/0xb30 fs/splice.c:711
 [<ffffffff815a9ab8>] do_splice_from fs/splice.c:870 [inline]
 [<ffffffff815a9ab8>] direct_splice_actor+0x128/0x190 fs/splice.c:1037
 [<ffffffff815ab6c1>] splice_direct_to_actor+0x2c1/0x7e0 fs/splice.c:992
 [<ffffffff815abd83>] do_splice_direct+0x1a3/0x270 fs/splice.c:1080
 [<ffffffff8150d780>] do_sendfile+0x4f0/0xc30 fs/read_write.c:1393
 [<ffffffff8150f864>] SYSC_sendfile64 fs/read_write.c:1454 [inline]
 [<ffffffff8150f864>] SyS_sendfile64+0x144/0x160 fs/read_write.c:1440
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 
cb7 
c44 
c24 
c1a 
c31 
cdb 
c66 
c25 
cff 
c7f 
c66 
c89 
c44 
c24 
c68 
ce9 
c13 
cff 
cff 
cff 
c41 
cf6 
cc4 
c0f 
c0f 
c85 
c54 
c02 
c00 
c00 
c4c 
c89 
cca 
c4c 
c89 
cd0 
cf0 
c49 
c0f 
cc7 
c4c 
c24 
c10 
c<0f> 
c94 
cc0 
c84 
cc0 
c74 
cb0 
c8b 
c05 
c4a 
c51 
cd0 
c01 
c85 
cc0 
c0f 
c85 
cdb 
c01 
c00 
c00 
c