INFO: task syz.0.3764:17705 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.3764      state:D stack:26728 pid:17705 tgid:17703 ppid:5610   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17b4/0x5680
 schedule+0x164/0x360
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7f7/0x1550
 nfsd_nl_listener_set_doit+0x141/0x1670
 genl_family_rcv_msg_doit+0x22a/0x330
 genl_rcv_msg+0x61c/0x7a0
 netlink_rcv_skb+0x232/0x4b0
 genl_rcv+0x28/0x40
 netlink_unicast+0x75c/0x8e0
 netlink_sendmsg+0x813/0xb40
 ____sys_sendmsg+0x972/0x9f0
 ___sys_sendmsg+0x2a5/0x360
 __x64_sys_sendmsg+0x1bd/0x2a0
 do_syscall_64+0x15f/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb86b99cdd9
RSP: 002b:00007fb86c899028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb86bc16090 RCX: 00007fb86b99cdd9
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000006
RBP: 00007fb86ba32d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb86bc16128 R14: 00007fb86bc16090 R15: 00007fffc79e1488
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/34:
 #0: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
3 locks held by kworker/u9:2/404:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc900040a7c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdce940 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
2 locks held by getty/5437:
 #0: ffff888112c1d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc9000346b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0
2 locks held by syz.2.2090/12454:
 #0: ffffffff8fe3dd88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
 #1: ffffffff8ec8aae0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x1670
3 locks held by kworker/u10:8/14292:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc90004387c40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8e963068 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770
2 locks held by syz.0.3764/17705:
 #0: ffffffff8fe3dd88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
 #1: ffffffff8ec8aae0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x1670
3 locks held by kworker/u8:5/18120:
 #0: ffff888110aa6140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc90008ccfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdce940 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0
1 lock held by syz.1.6432/25799:
 #0: ffffffff8fdce940 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0
2 locks held by syz.4.6436/25822:
 #0: ffffffff8fdce940 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0
 #1: ffffffff8e963068 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770
1 lock held by syz.3.6439/25831:
 #0: ffffffff8fdce940 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x83c/0x1150

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17a/0x300
 sys_info+0x135/0x170
 watchdog+0xfd3/0x1030
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:native_apic_msr_write+0x39/0x50
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 e9 c0 46 35 0a cc 89 f6 31 d2 e9 b6 27 7a 03 66 0f 1f 44 00
RSP: 0018:ffffc90000a08c90 EFLAGS: 00000046
RAX: 000000000000000f RBX: ffff88823c623e40 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 000000000000000f RDI: 0000000000000838
RBP: ffffc90000a08d58 R08: ffffffff81b2cf35 R09: ffffffff9a487588
R10: 0000000000000003 R11: ffffffff817436c0 R12: ffffffff817436c0
R13: 1ffff110478c47d1 R14: 0000000000000000 R15: ffff88823c623e8c
FS:  0000000000000000(0000) GS:ffff8882a9293000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556a8e0dc000 CR3: 00000001bc2ae000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 lapic_next_event+0x11/0x20
 clockevents_program_event+0x44e/0x630
 __hrtimer_rearm_deferred+0x270/0x450
 irqentry_exit+0x6a0/0x730
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:its_return_thunk+0x0/0x10
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <c3> cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e9 2b 98 88 f5 cc
RSP: 0018:ffffc90000a08eb8 EFLAGS: 00000293
RAX: 0000000080000102 RBX: ffff8881bd702158 RCX: 0000000000000100
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: ffff8881bd70215b R09: 1ffff11037ae042b
R10: dffffc0000000000 R11: ffffed1037ae042c R12: ffff8881bd702010
R13: 0000000000000000 R14: ffff8881bd7021b0 R15: ffff8881bd702000
 _raw_spin_unlock+0x28/0x50
 net_tx_action+0x9dd/0xc30
 handle_softirqs+0x22a/0x840
 __irq_exit_rcu+0xca/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 8a 6f f7 f5 48 89 df e8 92 e4 f7 f5 e8 6d 6f 23 f6 fb bf 01 00 00 00 <e8> f2 66 e9 f5 65 8b 05 7b 70 8e 07 85 c0 74 07 5b c3 cc cc cc cc
RSP: 0018:ffffc90000127ad0 EFLAGS: 00000206
RAX: 00000000000d7abb RBX: ffff88810068b000 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8dfa3a8e RDI: 0000000000000001
RBP: ffffc90000127ce8 R08: ffffffff903096f7 R09: 1ffffffff20612de
R10: dffffc0000000000 R11: fffffbfff20612df R12: 0000000002000000
R13: ffff888022d10c50 R14: dffffc0000000000 R15: ffff888100080218
 process_scheduled_works+0x953/0x1860
 worker_thread+0xa53/0xfc0
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
