[Android 6.1] BUG: soft lockup in smp_call_function

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 931187cc187d ANDROID: GKI: Add symbol list for Nothing
git tree: android14-6.1
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1197bfb1180000
kernel config: https://syzkaller.appspot.com/x/.config?x=54c503ca94c7e582
dashboard link: https://syzkaller.appspot.com/bug?extid=0c78669af74220668cbf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160fb92d180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a95795180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a72c4a3ce6ef/disk-931187cc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c5f12722cad8/vmlinux-931187cc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ad9d6cd4877f/bzImage-931187cc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0c7866...@syzkaller.appspotmail.com

RBP: 00007ff8909d12b0 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000006 R11: 0000000000000246 R12: 00007ff8909d12b0
R13: 0000000000000000 R14: 00007ff8909d1d00 R15: 00007ff890927170
</TASK>
watchdog: BUG: soft lockup - CPU#1 stuck for 246s! [syz-executor198:295]
Modules linked in:
CPU: 1 PID: 295 Comm: syz-executor198 Not tainted 6.1.68-syzkaller-00102-g931187cc187d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline]
RIP: 0010:smp_call_function_many_cond+0x851/0x930 kernel/smp.c:998
Code: 3e 44 89 fe 83 e6 01 31 ff e8 0b 9e 09 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0a e8 46 9a 09 00 e9 2f ff ff ff f3 90 <42> 0f b6 04 3b 84 c0 75 14 41 f7 06 01 00 00 00 0f 84 12 ff ff ff
RSP: 0018:ffffc90000ea7620 EFLAGS: 00000293
RAX: ffffffff816bd75c RBX: 1ffff1103ee07919 RCX: ffff888121709440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000ea7738 R08: ffffffff816bd725 R09: ffffed103ee2707b
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: 0000000800000000 R14: ffff8881f703c8c8 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff8909d2110 CR3: 0000000006c0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
</IRQ>
<TASK>
on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1166
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1329 [inline]
text_poke_bp_batch+0x1e9/0x730 arch/x86/kernel/alternative.c:1529
text_poke_flush arch/x86/kernel/alternative.c:1720 [inline]
text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1727
arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
__jump_label_update+0x36a/0x380 kernel/jump_label.c:455
jump_label_update+0x3af/0x450 kernel/jump_label.c:801
static_key_disable_cpuslocked+0xcd/0x1b0 kernel/jump_label.c:207
static_key_disable+0x1a/0x30 kernel/jump_label.c:215
tracepoint_remove_func kernel/tracepoint.c:417 [inline]
tracepoint_probe_unregister+0x60a/0x900 kernel/tracepoint.c:551
bpf_probe_unregister+0x61/0x70 kernel/trace/bpf_trace.c:2351
bpf_raw_tp_link_release+0x63/0x90 kernel/bpf/syscall.c:3140
bpf_link_free+0x129/0x3f0 kernel/bpf/syscall.c:2723
bpf_link_put kernel/bpf/syscall.c:2749 [inline]
bpf_link_release+0x170/0x180 kernel/bpf/syscall.c:2758
__fput+0x3ab/0x870 fs/file_table.c:320
____fput+0x15/0x20 fs/file_table.c:348
task_work_run+0x24d/0x2e0 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xbd5/0x2b80 kernel/exit.c:875
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
__do_sys_exit_group kernel/exit.c:1036 [inline]
__se_sys_exit_group kernel/exit.c:1034 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1034
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff890955f09
Code: Unable to access opcode bytes at 0x7ff890955edf.
RSP: 002b:00007ffeee271058 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff890955f09
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007ff8909d12b0 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000006 R11: 0000000000000246 R12: 00007ff8909d12b0
R13: 0000000000000000 R14: 00007ff8909d1d00 R15: 00007ff890927170
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup