[Android 5.15] BUG: soft lockup in smp_call_function

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5448b2fda85f Merge 5.15.94 into android13-5.15-lts
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=17657b04c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb55b12f877ddc70
dashboard link: https://syzkaller.appspot.com/bug?extid=19f2558f0b4ac07df383
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175b006cc80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11122322c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24924398a010/disk-5448b2fd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e244d5b44fff/vmlinux-5448b2fd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bc13eddc3000/bzImage-5448b2fd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+19f255...@syzkaller.appspotmail.com

worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 <unknown>:298
</TASK>
watchdog: BUG: soft lockup - CPU#0 stuck for 225s! [kworker/u4:0:8]
Modules linked in:
CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.94-syzkaller-03204-g5448b2fda85f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:check_kcov_mode kernel/kcov.c:174 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 kernel/kcov.c:197
Code: b0 fb 92 7e 65 8b 15 b1 fb 92 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 2c 0b 00 00 00 74 2c 8b 91 08 0b 00 00 <83> fa 02 75 21 48 8b 91 10 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 0c
RSP: 0018:ffffc90000087870 EFLAGS: 00000246
RAX: ffffffff8164ba8b RBX: 1ffff1103ee276c9 RCX: ffff8881002593c0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000087870 R08: ffffffff8164ba5a R09: ffffed103ee07053
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: ffff8881f713b648 R14: ffff8881f7038280 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde0fe14e8 CR3: 000000000640f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
csd_lock_wait kernel/smp.c:440 [inline]
smp_call_function_many_cond+0x85b/0x9b0 kernel/smp.c:969
on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1183 [inline]
text_poke_bp_batch+0x1c4/0x5d0 arch/x86/kernel/alternative.c:1374
text_poke_flush arch/x86/kernel/alternative.c:1542 [inline]
text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1549
arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
__jump_label_update+0x36a/0x380 kernel/jump_label.c:459
jump_label_update+0x3af/0x450 kernel/jump_label.c:830
static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
static_key_enable+0x1a/0x30 kernel/jump_label.c:190
toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:725
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 <unknown>:298
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches