[v6.1] WARNING in kcm_write_msgs

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 69e434a1cb21 Linux 6.1.63
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e1406f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb9f1be873e58e15
dashboard link: https://syzkaller.appspot.com/bug?extid=102e0a04d98b7d969ceb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/042eff9b94a8/disk-69e434a1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dce36c399f65/vmlinux-69e434a1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c40f6d7a93b8/bzImage-69e434a1.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+102e0a...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 14144 at net/kcm/kcmsock.c:634 kcm_write_msgs+0x11e9/0x14b0
Modules linked in:
CPU: 1 PID: 14144 Comm: syz-executor.2 Not tainted 6.1.63-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:kcm_write_msgs+0x11e9/0x14b0 net/kcm/kcmsock.c:634
Code: 5c 24 14 89 de e8 37 93 ca f7 85 db 8b 44 24 28 0f 45 c3 48 81 c4 90 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 b7 8f ca f7 <0f> 0b e9 33 ff ff ff e8 ab 8f ca f7 0f 0b e9 2d f6 ff ff e8 9f 8f
RSP: 0018:ffffc90005447878 EFLAGS: 00010283
RAX: ffffffff89c00039 RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc9000bfa9000 RSI: 0000000000005cd8 RDI: 0000000000005cd9
RBP: dffffc0000000000 R08: ffffffff89bff78a R09: fffffbfff2091a6c
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807a7420c0
R13: ffff88806cd6c140 R14: ffff88808df2d000 R15: ffff888075525280
FS: 00007fc6d73fe6c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002002b000 CR3: 0000000079026000 CR4: 00000000003506e0
Call Trace:
<TASK>
kcm_sendmsg+0x1f72/0x2580 net/kcm/kcmsock.c:1040
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
sock_write_iter+0x394/0x4e0 net/socket.c:1130
call_write_iter include/linux/fs.h:2205 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x7ae/0xba0 fs/read_write.c:584
ksys_write+0x19c/0x2c0 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc6d887cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc6d73fe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc6d899c120 RCX: 00007fc6d887cae9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007fc6d88c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007fc6d899c120 R15: 00007fff71933d38
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a3eb3a74aa8c Linux 6.1.80
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13a748e4180000
kernel config: https://syzkaller.appspot.com/x/.config?x=40fd5f1c69352c2d

dashboard link: https://syzkaller.appspot.com/bug?extid=102e0a04d98b7d969ceb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162498a6180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=178aee96180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fcf176340788/disk-a3eb3a74.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/31d4ae9bb2ff/vmlinux-a3eb3a74.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb907876b80a/Image-a3eb3a74.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+102e0a...@syzkaller.appspotmail.com

------------[ cut here ]------------

WARNING: CPU: 0 PID: 4374 at net/kcm/kcmsock.c:634 kcm_write_msgs+0x800/0xfc0
Modules linked in:
CPU: 0 PID: 4374 Comm: syz-executor374 Not tainted 6.1.80-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : kcm_write_msgs+0x800/0xfc0
lr : kcm_write_msgs+0x7fc/0xfc0 net/kcm/kcmsock.c:634
sp : ffff80001e297640
x29: ffff80001e2976c0 x28: 00000000ffffffea x27: dfff800000000000
x26: 0000000000088000 x25: ffff0000e5903c00 x24: ffff0000e5c4de40
x23: ffff0000e44d4b40 x22: ffff0000e44d4c80 x21: 0000000000000011
x20: ffff0000d9274800 x19: 0000000000000000 x18: 00000000000001a8
x17: ffff80019ebee000 x16: ffff8000084f8d9c x15: 0000000000000000
x14: 1ffff00002b040b0 x13: dfff800000000000 x12: 0000000000000003
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff8000115fcdbc
x8 : ffff0000d811b780 x7 : ffff8000103b6e90 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
kcm_write_msgs+0x800/0xfc0
kcm_sendmsg+0x1964/0x1e8c net/kcm/kcmsock.c:1040
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
sock_write_iter+0x2d8/0x414 net/socket.c:1143
call_write_iter include/linux/fs.h:2251 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x914 fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4962
hardirqs last enabled at (4961): [<ffff8000081c7770>] __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401
hardirqs last disabled at (4962): [<ffff800012141c04>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (4960): [<ffff8000103b6fcc>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (4960): [<ffff8000103b6fcc>] release_sock+0x178/0x1cc net/core/sock.c:3510
softirqs last disabled at (4958): [<ffff8000103b6e90>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (4958): [<ffff8000103b6e90>] release_sock+0x3c/0x1cc net/core/sock.c:3497
---[ end trace 0000000000000000 ]---
KCM: Hard failure on kcm_write_msgs


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.