[v6.1] BUG: soft lockup in fq_pie_timer

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d2869ace6eeb Linux 6.1.31
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=133eecb5280000
kernel config: https://syzkaller.appspot.com/x/.config?x=11263f470b7a4c92
dashboard link: https://syzkaller.appspot.com/bug?extid=0f435c2ca38c42c73d4e
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119758c9280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=101a975d280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b17a7cd87498/disk-d2869ace.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc8291ae723a/vmlinux-d2869ace.xz
kernel image: https://storage.googleapis.com/syzbot-assets/04943541fc25/Image-d2869ace.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f435c...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:0]
Modules linked in:
irq event stamp: 184045
hardirqs last enabled at (184044): [<ffff8000120f8ed0>] __el1_irq arch/arm64/kernel/entry-common.c:476 [inline]
hardirqs last enabled at (184044): [<ffff8000120f8ed0>] el1_interrupt+0x58/0x68 arch/arm64/kernel/entry-common.c:486
hardirqs last disabled at (184045): [<ffff8000120f8e9c>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (184045): [<ffff8000120f8e9c>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (178774): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (178774): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (178889): [<ffff80000802a994>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.31-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x15c/0xe48 kernel/locking/qspinlock.c:383
lr : queued_spin_lock_slowpath+0x168/0xe48 kernel/locking/qspinlock.c:383
sp : ffff8000080079c0
x29: ffff800008007a60 x28: 1fffe0001bce091e x27: 1ffff00001000f44
x26: dfff800000000000 x25: 1fffe0001bce0920 x24: ffff8000080079e0
x23: ffff800008007a20 x22: ffff700001000f3c x21: 0000000000000001
x20: 0000000000000001 x19: ffff0000de7048f0 x18: ffff8000080078c0
x17: ffff80019f09e000 x16: ffff80000896d2d4 x15: 000000000000da67
x14: 00000000f6df2a64 x13: dfff800000000000 x12: 0000000000000001
x11: 1fffe0001bce091e x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000101 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80001878b728 x4 : 0000000000000008 x3 : ffff8000121dcbf4
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
__cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline]
__cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline]
queued_spin_lock_slowpath+0x15c/0xe48 kernel/locking/qspinlock.c:383
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
_raw_spin_lock+0x5c/0x6c kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:350 [inline]
fq_pie_timer+0x94/0x248 net/sched/sch_fq_pie.c:377
call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1790
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803
__do_softirq+0x30c/0xea0 kernel/softirq.c:571
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650
irq_exit_rcu+0x14/0x84 kernel/softirq.c:662
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:577
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xdc kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x1e0/0x514 kernel/sched/idle.c:303
cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:400
rest_init+0x2d8/0x2f0 init/main.c:729
start_kernel+0x0/0x60c init/main.c:890
start_kernel+0x44c/0x60c init/main.c:1145
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 1d37434ffc1376306167dc61f37f78da18455b74
Author: Eric Dumazet <edum...@google.com>
Date: Fri Jun 2 12:37:47 2023 +0000

net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12150d21a80000
start commit: 76ba310227d2 Linux 6.1.32
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=3d054c5c4a3e2d63
dashboard link: https://syzkaller.appspot.com/bug?extid=0f435c2ca38c42c73d4e
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b762c9280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d0f5a5280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values

For information about bisection process see: https://goo.gl/tpsmEJ#bisection