[v6.1] BUG: soft lockup in sock_close

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 29f02ec58a94 Linux 6.1.121
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17613fe8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f738f3c37768d3ef
dashboard link: https://syzkaller.appspot.com/bug?extid=bb721a1495edb233298b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143c38c4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f0e977ac21f4/disk-29f02ec5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2114c6ce7c93/vmlinux-29f02ec5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3ec83a920b74/Image-29f02ec5.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb721a...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz.2.10139:2640]
Modules linked in:
irq event stamp: 5973
hardirqs last enabled at (5972): [<ffff80001232a3e8>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (5972): [<ffff80001232a3e8>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (5973): [<ffff8000123280c4>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (5973): [<ffff8000123280c4>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (1898): [<ffff800008030408>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1908): [<ffff8000105996b4>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (1908): [<ffff8000105996b4>] lock_sock_nested+0x90/0x138 net/core/sock.c:3488
CPU: 0 PID: 2640 Comm: syz.2.10139 Tainted: G W 6.1.121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x15c/0xe48 kernel/locking/qspinlock.c:383
lr : queued_spin_lock_slowpath+0x168/0xe48 kernel/locking/qspinlock.c:383
sp : ffff8000249775e0
x29: ffff800024977680 x28: 1fffe0001e14fa33 x27: 1ffff0000492eec8
x26: dfff800000000000 x25: 1fffe0001e14fa35 x24: ffff800024977600
x23: ffff800024977640 x22: ffff70000492eec0 x21: 0000000000000001
x20: 0000000000000001 x19: ffff0000f0a7d198 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008978024 x15: 0000000000000000
x14: 1ffff00002b520b2 x13: dfff800000000000 x12: 0000000000000001
x11: 1fffe0001e14fa33 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000101 x7 : ffff8000105996b4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80001240f19c
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
__cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline]
__cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline]
queued_spin_lock_slowpath+0x15c/0xe48 kernel/locking/qspinlock.c:383
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
_raw_spin_lock_bh+0x5c/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
lock_sock_nested+0x90/0x138 net/core/sock.c:3488
lock_sock include/net/sock.h:1750 [inline]
tipc_release+0xa8/0x14c0 net/tipc/socket.c:639
__sock_release net/socket.c:654 [inline]
sock_close+0xb8/0x1fc net/socket.c:1400
__fput+0x1c8/0x7c8 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x240/0x2f0 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x2080/0x2cb8 arch/arm64/kernel/signal.c:1132
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: cd9b81672742 Linux 6.1.161
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1217445a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=bb721a1495edb233298b
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11427c5a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=161c8402580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6a7406401038/disk-cd9b8167.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4897d65a9b9a/vmlinux-cd9b8167.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1b1c5a0509b7/bzImage-cd9b8167.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb721a...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2664 jiffies s: 11101 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6165 Comm: syz.1.1656 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__pvclock_read_cycles arch/x86/include/asm/pvclock.h:84 [inline]
RIP: 0010:pvclock_clocksource_read+0x11d/0x760 arch/x86/kernel/pvclock.c:76
Code: 00 42 0f b6 0c 21 84 c9 0f 85 a6 01 00 00 48 8b 8c 24 88 00 00 00 42 0f b6 0c 21 84 c9 0f 85 e9 01 00 00 48 c1 e5 20 48 09 c5 <49> 2b 28 48 8b 84 24 80 00 00 00 42 0f b6 04 20 84 c0 0f 85 26 02
RSP: 0018:ffffc90000007800 EFLAGS: 00000006
RAX: 00000000e3aefe93 RBX: 0000000000000006 RCX: 0000000000000000
RDX: 0000000000000051 RSI: ffffffff8fa0801c RDI: ffffffff8fa08000
RBP: 00000051e3aefe93 R08: ffffffff8fa08008 R09: ffffffff8fa08018
R10: ffffffff8fa08010 R11: ffffffff8fa08003 R12: dffffc0000000000
R13: dffffc0000000000 R14: 1ffffffff1f41000 R15: ffffffff8c64f980
FS: 000055558cd1a500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd7671de2f8 CR3: 0000000025924000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
kvm_clock_read arch/x86/kernel/kvmclock.c:79 [inline]
kvm_sched_clock_read+0x14/0x40 arch/x86/kernel/kvmclock.c:91
sched_clock_cpu+0x6e/0x260 kernel/sched/clock.c:369
irqtime_account_irq+0x6a/0x1b0 kernel/sched/cputime.c:60
instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline]
sysvec_irq_work+0x45/0xc0 arch/x86/kernel/irq_work.c:17
asm_sysvec_irq_work+0x16/0x20 arch/x86/include/asm/idtentry.h:728
RIP: 0010:rcu_read_unlock_special+0x7f/0x510 kernel/rcu/tree_plugin.h:685
Code: eb 03 48 b8 f1 f1 f1 f1 f8 f2 f2 f2 4a 89 04 2b 42 c7 44 2b 08 f8 f3 f3 f3 65 44 8b 35 92 30 95 7e 41 f7 c6 00 00 f0 00 74 40 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 42 c7 44 2b 08
RSP: 0018:ffffc90000007aa0 EFLAGS: 00000206
RAX: 23d9c664f6e94300 RBX: 1ffff92000000f5c RCX: 23d9c664f6e94300
RDX: dffffc0000000000 RSI: ffffffff8a8c1220 RDI: ffffffff8adf0c20
RBP: ffffc90000007b90 R08: ffffffff90af32e7 R09: 1ffffffff215e65c
R10: dffffc0000000000 R11: fffffbfff215e65d R12: 0000000000000246
R13: dffffc0000000000 R14: ffff8880b8e3b900 R15: 0000000000000001
__rcu_read_unlock+0x78/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:823 [inline]
ieee80211_iterate_active_interfaces_atomic+0x156/0x170 net/mac80211/util.c:826
mac80211_hwsim_beacon+0xb7/0x1b0 drivers/net/wireless/mac80211_hwsim.c:2147
__run_hrtimer kernel/time/hrtimer.c:1747 [inline]
__hrtimer_run_queues+0x560/0xd70 kernel/time/hrtimer.c:1811
hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1828
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 1f 7e 22 f7 65 8b 05 e0 01 cc 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90006107b00 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 23d9c664f6e94300
RDX: dffffc0000000000 RSI: ffffffff8a8c1220 RDI: 0000000000000001
RBP: ffffc90006107b80 R08: ffffffff90af32e7 R09: 1ffffffff215e65c
R10: dffffc0000000000 R11: fffffbfff215e65d R12: dffffc0000000000
R13: ffff8880777533c0 R14: ffffffff96e507e8 R15: 1ffff92000c20f60
__debug_check_no_obj_freed lib/debugobjects.c:988 [inline]
debug_check_no_obj_freed+0x515/0x530 lib/debugobjects.c:1009
slab_free_hook mm/slub.c:1704 [inline]
slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
kmem_cache_free+0xf7/0x290 mm/slub.c:3709
sk_prot_free net/core/sock.c:2089 [inline]
__sk_destruct+0x4ab/0x650 net/core/sock.c:2177
pn_socket_release+0x91/0xb0 net/phonet/socket.c:34
__sock_release net/socket.c:654 [inline]
sock_close+0xd5/0x240 net/socket.c:1399
__fput+0x22c/0x920 fs/file_table.c:320
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9725f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcdf14f208 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffcdf14f2f0 RCX: 00007f9725f9aeb9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001f895 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2e220000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9726215fac R14: 00007f9726215fa8 R15: 00007f9726215fa0
</TASK>


---