[Android 5.15] BUG: soft lockup in sys_exit_group

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 993bed180178 Merge "Merge branch 'android13-5.15' into bra..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1559c013180000
kernel config: https://syzkaller.appspot.com/x/.config?x=49ce29477ba81e8f
dashboard link: https://syzkaller.appspot.com/bug?extid=0ea45958ab457cad9241
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=139261d3180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100b2915180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/803c31a2cd6a/disk-993bed18.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb3ff89c92a4/vmlinux-993bed18.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b0859874279b/bzImage-993bed18.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0ea459...@syzkaller.appspotmail.com

RBP: 00007f1ed76e32b0 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1ed76e32b0
R13: 0000000000000000 R14: 00007f1ed76e3d00 R15: 00007f1ed7639240
</TASK>
watchdog: BUG: soft lockup - CPU#1 stuck for 245s! [syz-executor349:5673]
Modules linked in:
CPU: 1 PID: 5673 Comm: syz-executor349 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__sanitizer_cov_trace_pc+0x1/0x60 kernel/kcov.c:190
Code: 00 00 0f 0b 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 13 00 00 00 48 8b 3d d4 1a 96 05 48 89 de e8 b4 4d 41 00 5b 5d c3 cc 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d f0 4b 92 7e 65 8b 15 f1 4b 92 7e
RSP: 0018:ffffc900009678d0 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 1ffff1103ee07971 RCX: ffff88810c024f00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900009679f8 R08: ffffffff81657cfa R09: fffffbfff0d49e1d
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff8881f703cb88 R14: ffff8881f7138280 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ed76e4110 CR3: 000000000680f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
</IRQ>
<TASK>
on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
native_flush_tlb_multi+0x141/0x210
__flush_tlb_multi arch/x86/include/asm/paravirt.h:87 [inline]
flush_tlb_multi arch/x86/mm/tlb.c:900 [inline]
flush_tlb_mm_range+0x223/0x310 arch/x86/mm/tlb.c:986
tlb_flush arch/x86/include/asm/tlb.h:23 [inline]
tlb_flush_mmu_tlbonly+0x1b7/0x420 include/asm-generic/tlb.h:430
tlb_flush_mmu mm/mmu_gather.c:246 [inline]
tlb_finish_mmu+0xd4/0x320 mm/mmu_gather.c:338
exit_mmap+0x3ef/0x6f0 mm/mmap.c:3211
__mmput+0x95/0x310 kernel/fork.c:1179
mmput+0x5b/0x170 kernel/fork.c:1202
exit_mm kernel/exit.c:552 [inline]
do_exit+0xb9c/0x2ca0 kernel/exit.c:865
do_group_exit+0x141/0x310 kernel/exit.c:1000
__do_sys_exit_group kernel/exit.c:1011 [inline]
__se_sys_exit_group kernel/exit.c:1009 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1009
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f1ed7668009
Code: Unable to access opcode bytes at RIP 0x7f1ed7667fdf.
RSP: 002b:00007ffd003f8198 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1ed7668009
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f1ed76e32b0 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1ed76e32b0
R13: 0000000000000000 R14: 00007f1ed76e3d00 R15: 00007f1ed7639240
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup