INFO: task syz.3.34950:6609 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.34950     state:D stack:24616 pid:6609  tgid:6608  ppid:11966  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17db/0x58f0
 schedule+0x164/0x2b0
 cgroup_lock_and_drain_offline+0x51a/0x650
 cgroup_kn_lock_live+0x120/0x230
 cgroup_subtree_control_write+0x4b5/0x1080
 cgroup_file_write+0x331/0x8f0
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f606c79e159
RSP: 002b:00007f606d5b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f606ca25fa0 RCX: 00007f606c79e159
RDX: 0000000000000006 RSI: 0000200000000080 RDI: 0000000000000008
RBP: 00007f606c83506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f606ca26038 R14: 00007f606ca25fa0 R15: 00007ffc516f1828
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/36: 1, last CPU#1:
 #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
locks held by getty/5421: 2, on CPU#0:
 #0: ffff888179f9a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900034762e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360
locks held by kworker/u8:1/31792: 4, last CPU#0:
 #0: ffff888169c1e140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc9000bc9fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff90254b00 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0
 #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __fib6_clean_all+0xb8/0x5d0
locks held by kworker/u9:16/16454: 2, last CPU#1:
 #0: ffff88816e41c140 ((wq_completion)wg-kex-wg1#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90004b37c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by kworker/1:6/18150: 5, on CPU#1:
 #0: ffff888104689940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90009c77c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffff88816f0d41d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
 #3: ffff8881a6a351d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #4: ffff8881a2e0e1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
locks held by kworker/0:5/18813: 3, on CPU#0:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90020c87c40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffff88816bd2e250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0
locks held by syz.3.34950/6609: 3, on CPU#0:
 #0: ffff88810e5ab2f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320
 #1: ffff8881bf412460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #2: ffff88810e2bcc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
locks held by udevd/12725: 4, on CPU#0:
 #0: ffff888110db11b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0
 #1: ffff88802a1d6880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420
 #2: ffff888177c66788 (kn->active#31){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420
 #3: ffff8881a6a351d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0
locks held by syz.2.37646/13025: 1, on CPU#1:
 #0: ffffffff8f15bd60 (cifs_mount_mutex){+.+.}-{4:4}, at: smb3_get_tree+0x2bf/0x400
locks held by syz.4.37651/13043: 1, last CPU#0:
 #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: futex_hash+0x4e/0x2b0

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 36 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17d/0x390
 sys_info+0x135/0x170
 watchdog+0xfd7/0x1030
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31792 Comm: kworker/u8:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ttwu_do_activate+0x1b/0x640
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 4c 24 08 89 d5 49 89 f7 48 89 fb <49> bc 00 00 00 00 00 fc ff df 48 c7 c0 80 93 7a 90 48 c1 e8 03 42
RSP: 0018:ffffc90000007c08 EFLAGS: 00000082
RAX: 1ffff110242078d1 RBX: ffff88812103bac0 RCX: ffffc90000007c80
RDX: 0000000000000088 RSI: ffff888114443c00 RDI: ffff88812103bac0
RBP: 0000000000000088 R08: 0000000001000001 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000f74 R12: ffff88812103c9a0
R13: 1ffff11024207934 R14: ffff88812103c6d8 R15: ffff888114443c00
FS:  0000000000000000(0000) GS:ffff88818d6c7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcceeb5ff8 CR3: 0000000031412000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 try_to_wake_up+0x82b/0x14d0
 signal_wake_up_state+0xb5/0x120
 posixtimer_send_sigqueue+0x4ba/0xbb0
 posix_timer_fn+0x11d/0x190
 __hrtimer_run_queues+0x3bc/0xa10
 hrtimer_interrupt+0x4cd/0xaa0
 __sysvec_apic_timer_interrupt+0x102/0x430
 sysvec_apic_timer_interrupt+0xa1/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_release+0x0/0x3c0
Code: e9 4f fe ff ff 41 bf 2f 00 00 00 e9 06 ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 30 49 89 f5 49
RSP: 0018:ffffc9000bc9f178 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc9000bc9f238 RCX: 8000000000000001
RDX: ffffc9000bc9f201 RSI: ffffffff817811df RDI: ffffffff8ed5c8a0
RBP: 1ffffffff233a201 R08: ffffc9000bc9f690 R09: 0000000000000000
R10: ffffc9000bc9f278 R11: fffff52001793e51 R12: ffffc9000bc98000
R13: ffffffff817811df R14: ffffc9000bc9f228 R15: ffffc9000bc9f6a0
 unwind_next_frame+0x1baa/0x2550
 arch_stack_walk+0x11b/0x150
 stack_trace_save+0xa9/0x100
 kasan_save_track+0x3e/0x80
 __kasan_slab_alloc+0x6c/0x80
 kmem_cache_alloc_noprof+0x2b9/0x600
 dst_alloc+0x105/0x170
 icmp6_dst_alloc+0x72/0x430
 mld_sendpack+0x697/0xe10
 ipv6_mc_dad_complete+0x87/0x410
 addrconf_dad_completed+0x8af/0xe60
 addrconf_dad_work+0xcf8/0x15c0
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
