[v5.15] BUG: soft lockup in ser_release (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0c935c049b5c Linux 5.15.179
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1712bff8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=98c228fbc016eb3a
dashboard link: https://syzkaller.appspot.com/bug?extid=214523025b2e6d07ba98
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d5477072f336/disk-0c935c04.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/77d15907ffb3/vmlinux-0c935c04.xz
kernel image: https://storage.googleapis.com/syzbot-assets/efe5d79cb16a/Image-0c935c04.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+214523...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [kworker/0:2:1534]
Modules linked in:
irq event stamp: 175719
hardirqs last enabled at (175718): [<ffff800011b5913c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline]
hardirqs last enabled at (175718): [<ffff800011b5913c>] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91
hardirqs last disabled at (175719): [<ffff800011b59384>] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227
softirqs last enabled at (171630): [<ffff80001093e0e0>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last enabled at (171630): [<ffff80001093e0e0>] clusterip_netdev_event+0x380/0x3a8 net/ipv4/netfilter/ipt_CLUSTERIP.c:233
softirqs last disabled at (171632): [<ffff80001015984c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
CPU: 0 PID: 1534 Comm: kworker/0:2 Not tainted 5.15.179-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events ser_release
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
lr : queued_spin_lock_slowpath+0x16c/0x938 kernel/locking/qspinlock.c:382
sp : ffff800023d675a0
x29: ffff800023d67640 x28: 1ffff000047acec0 x27: 1fffe0001ab69511
x26: dfff800000000000 x25: ffff7000047aceb8 x24: ffff800023d675c0
x23: 1fffe0001ab69510 x22: ffff800023d67600 x21: 0000000000000001
x20: 0000000000000001 x19: ffff0000d5b4a880 x18: ffff800023d674a0
x17: 0000000000000000 x16: ffff800008305acc x15: 000000000002486b
x14: 00000000b5b3edcb x13: dfff800000000000 x12: 0000000000000001
x11: 1fffe0001ab69510 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000101 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff8000179a2dc0 x4 : 0000000000000008 x3 : ffff800008304cf4
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
__cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline]
__cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline]
queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_lock+0xb8/0x10c kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
__netif_tx_lock include/linux/netdevice.h:4437 [inline]
netif_tx_lock include/linux/netdevice.h:4522 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4531 [inline]
dev_watchdog_down net/sched/sch_generic.c:511 [inline]
dev_deactivate_many+0x2f8/0xbe4 net/sched/sch_generic.c:1302
__dev_close_many+0x290/0x3e8 net/core/dev.c:1608
dev_close_many+0x1e0/0x46c net/core/dev.c:1646
dev_close+0x174/0x250 net/core/dev.c:1672
ser_release+0x188/0x238 drivers/net/caif/caif_serial.c:309
process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
worker_thread+0x910/0x1034 kernel/workqueue.c:2457
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.