BUG: soft lockup in umount_tree

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 03c70fea Merge 4.9.111 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=16b332c2400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca051f5c6a5ae8e0
dashboard link: https://syzkaller.appspot.com/bug?extid=1c79153afd6507ceb39d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13428162400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165b2970400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1c7915...@syzkaller.appspotmail.com

random: crng init done
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 123s!
[syz-executor694:3996]
Modules linked in:
irq event stamp: 933704
hardirqs last enabled at (933703): [<ffffffff839f9669>]
restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (933704): [<ffffffff839fa62b>]
apic_timer_interrupt+0x9b/0xb0 arch/x86/entry/entry_64.S:648
softirqs last enabled at (921172): [<ffffffff839ffb1c>]
__do_softirq+0x46c/0x937 kernel/softirq.c:310
softirqs last disabled at (921163): [<ffffffff8114b237>] invoke_softirq
kernel/softirq.c:364 [inline]
softirqs last disabled at (921163): [<ffffffff8114b237>]
irq_exit+0x147/0x190 kernel/softirq.c:405
CPU: 1 PID: 3996 Comm: syz-executor694 Not tainted 4.9.111-g03c70fe #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801d8ac3000 task.stack: ffff8801b70a0000
RIP: 0010:[<ffffffff8160fc09>] [<ffffffff8160fc09>] do_make_slave
fs/pnode.c:84 [inline]
RIP: 0010:[<ffffffff8160fc09>] [<ffffffff8160fc09>]
change_mnt_propagation+0xa9/0xbd0 fs/pnode.c:130
RSP: 0018:ffff8801b70a7af0 EFLAGS: 00000246
RAX: ffff8801d8ac3000 RBX: ffff8801cda6e400 RCX: ffff8801cda6e468
RDX: 1ffff1003723a2c4 RSI: ffffffff8160fbe8 RDI: ffff8801b91d1620
RBP: ffff8801b70a7b50 R08: ffff8801cda6e468 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1003b15872c R12: dffffc0000000000
R13: ffff8801b91d1600 R14: ffff8801d9c47340 R15: ffffed0039b4dc84
FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f7667b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f76cadb0 CR3: 00000001ca4fa000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801b70a7b20 ffffffff815db8af 0000000000000000 ffff8801cda6e4f0
ffff8801cda6e420 ffff8801cda6e4e0 00040000b70a7b50 ffff8801cda6e490
dffffc0000000000 ffff8801cda6e400 ffff8801d9c469a0 ffff8801b70a7bf0
Call Trace:
[<ffffffff815dbfd6>] umount_tree+0x326/0x820 fs/namespace.c:1516
[<ffffffff815e41e0>] attach_recursive_mnt+0x750/0x8f0 fs/namespace.c:2058
[<ffffffff815e44ef>] graft_tree+0x16f/0x1f0 fs/namespace.c:2122
[<ffffffff815e6eaf>] do_loopback fs/namespace.c:2243 [inline]
[<ffffffff815e6eaf>] do_mount+0x1f5f/0x2740 fs/namespace.c:2829
[<ffffffff8168c3ec>] C_SYSC_mount fs/compat.c:810 [inline]
[<ffffffff8168c3ec>] compat_SyS_mount+0x4fc/0xff0 fs/compat.c:775
[<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325
[inline]
[<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870
arch/x86/entry/common.c:387
[<ffffffff839fa3d0>] entry_SYSENTER_compat+0x90/0xa2
arch/x86/entry/entry_64_compat.S:137
Code: 4d 01 e7 eb 36 e8 28 ee d4 ff 49 8d 7d 20 48 89 fa 48 c1 ea 03 42 80
3c 22 00 0f 85 d7 08 00 00 41 80 3f 00 4d 8b b6 70 ff ff ff <0f> 85 b8 08
00 00 4c 3b 73 20 0f 84 1e 02 00 00 e8 f2 ed d4 ff
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1 Comm: init Not tainted 4.9.111-g03c70fe #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801d99b0000 task.stack: ffff8801d99b8000
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] rep_nop
arch/x86/include/asm/processor.h:582 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] cpu_relax
arch/x86/include/asm/processor.h:587 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>]
__read_seqcount_begin include/linux/seqlock.h:114 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>]
raw_read_seqcount_begin include/linux/seqlock.h:147 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] read_seqcount_begin
include/linux/seqlock.h:164 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] read_seqbegin
include/linux/seqlock.h:433 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>]
path_init+0x104b/0x1580 fs/namei.c:2189
RSP: 0018:ffff8801d99bfab0 EFLAGS: 00000293
RAX: ffff8801d99b0000 RBX: ffff8801d99bfbe0 RCX: 1ffffffff08c1bc8
RDX: 0000000000000000 RSI: ffffffff815a0669 RDI: 0000000000000246
RBP: ffff8801d99bfb48 R08: ffff8801d99b08e8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff08c1bc8
R13: ffff8801d5ea331c R14: 0000000000000041 R15: ffffffff8460de40
FS: 00007f19913a77a0(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f7667db0 CR3: 00000001cd40c000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffffffff815a3aba c 0000000000000046 c 0000000000000000 c ffffffff81f1cccc c
ffff8801d99b08c0 c ffff8801d99b08c8 c 0000000000000046 c ffffffff843c3108 c
ffffffff81f1cedd c 0000000300000002 c 0000000000000046 c 0000000000000092 c
Call Trace:
[<ffffffff815a3aba>] path_lookupat.isra.41+0x2a/0x410 fs/namei.c:2277
[<ffffffff815a96c7>] filename_lookup.part.55+0x177/0x370 fs/namei.c:2317
[<ffffffff815a9a83>] filename_lookup fs/namei.c:2310 [inline]
[<ffffffff815a9a83>] user_path_at_empty+0x53/0x70 fs/namei.c:2578
[<ffffffff81580a66>] user_path_at include/linux/namei.h:55 [inline]
[<ffffffff81580a66>] vfs_fstatat+0xc6/0x170 fs/stat.c:106
[<ffffffff81581c16>] vfs_stat fs/stat.c:123 [inline]
[<ffffffff81581c16>] SYSC_newstat+0x86/0xf0 fs/stat.c:270
[<ffffffff8158201d>] SyS_newstat+0x1d/0x30 fs/stat.c:266
[<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
[<ffffffff839f8cd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: cf6 cc2 c01 c75 cda c41 c89 cd5 ce9 c21 cfa cff cff c48
cba c00 c00 c00 c00 c00 cfc cff cdf c49 c89 cc4 c49 c89 cc7
c49 cc1 cec c03 c49 c01 cd4 ce8 ca7 ce3 cdb cff cf3 c90
c<41> c0f cb6 c14 c24 c84 cd2 c74 c09 c80 cfa c03 c0f c8e
c4c c04 c00 c00 c41 c8b c07 c


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches