BUG: soft lockup in do_munmap

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 3a5af36b6d0e Merge tag '4.19-rc3-smb3-cifs' of git://git.s..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12ac7c1a400000
kernel config: https://syzkaller.appspot.com/x/.config?x=9c4a80625153107e
dashboard link: https://syzkaller.appspot.com/bug?extid=0b665f1476fd118c6b53
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
CC: [ak...@linux-foundation.org ebie...@xmission.com
kees...@chromium.org kirill....@linux.intel.com
linux-...@vger.kernel.org lu...@amacapital.net marcos.s...@gmail.com
mho...@suse.com ri...@surriel.com w...@chromium.org]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0b665f...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor3:25153]
Modules linked in:
irq event stamp: 11930084
hardirqs last enabled at (11930083): [<ffffffff81007d91>]
trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (11930084): [<ffffffff81007dad>]
trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last enabled at (0): [<ffffffff81481d42>]
copy_process+0x22a2/0x8780 kernel/fork.c:1812
softirqs last disabled at (0): [<0000000000000000>] (null)
CPU: 1 PID: 25153 Comm: syz-executor3 Not tainted 4.19.0-rc3+ #141
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:csd_lock_wait kernel/smp.c:108 [inline]
RIP: 0010:smp_call_function_single+0x28e/0x660 kernel/smp.c:302
Code: e8 03 42 0f b6 04 30 84 c0 74 08 3c 03 0f 8e 52 03 00 00 41 0f b6 14
24 44 8b 7c 24 78 84 d2 74 09 80 fa 03 0f 8e 2c 03 00 00 <44> 89 bc 24 e0
00 00 00 41 83 e7 01 31 ff 41 c6 04 24 f8 44 89 fe
RSP: 0018:ffff880199dcef60 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff880199dcefd8 RCX: ffffc90002a5e000
RDX: 0000000000000004 RSI: ffffffff817283c8 RDI: 0000000000000005
RBP: ffff880199dcf0b8 R08: ffff8801cdc82400 R09: ffffed003b5c5ba0
R10: ffffed003b5c5ba0 R11: ffff8801dae2dd07 R12: ffffed00333b9e08
R13: 1ffff100333b9df4 R14: dffffc0000000000 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8801daf00000(0063) knlGS:00000000f5f04b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f5f04db0 CR3: 0000000191dbe000 CR4: 00000000001426e0
Call Trace:
smp_call_function_many+0x967/0xb60 kernel/smp.c:434
native_flush_tlb_others+0x106/0x6a0 arch/x86/mm/tlb.c:609
flush_tlb_others arch/x86/include/asm/paravirt.h:309 [inline]
flush_tlb_mm_range+0x350/0x4d0 arch/x86/mm/tlb.c:658
tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:147 [inline]
tlb_flush_mmu mm/memory.c:257 [inline]
arch_tlb_finish_mmu+0x338/0x540 mm/memory.c:273
tlb_finish_mmu+0x140/0x1f0 mm/memory.c:432
unmap_region+0x3e5/0x560 mm/mmap.c:2574
do_munmap+0x60c/0xf50 mm/mmap.c:2781
mmap_region+0x6a4/0x1cd0 mm/mmap.c:1705
do_mmap+0xa10/0x1220 mm/mmap.c:1535
do_mmap_pgoff include/linux/mm.h:2298 [inline]
vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585
__do_sys_mmap_pgoff mm/mmap.c:1596 [inline]
__se_sys_mmap_pgoff mm/mmap.c:1592 [inline]
__ia32_sys_mmap_pgoff+0xdd/0x1a0 mm/mmap.c:1592
do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f29ca9
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90
90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90
90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5f040cc EFLAGS: 00000296 ORIG_RAX: 00000000000000c0
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000e7e000
RDX: 0000000000000000 RSI: 0000000000000013 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 25147 Comm: syz-executor3 Not tainted 4.19.0-rc3+ #141
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__fire_sched_out_preempt_notifiers kernel/sched/core.c:2497
[inline]
RIP: 0010:fire_sched_out_preempt_notifiers kernel/sched/core.c:2505 [inline]
RIP: 0010:prepare_task_switch kernel/sched/core.c:2611 [inline]
RIP: 0010:context_switch kernel/sched/core.c:2790 [inline]
RIP: 0010:__schedule+0xfbc/0x1ed0 kernel/sched/core.c:3473
Code: 03 42 80 3c 28 00 0f 85 b9 09 00 00 4d 8b 24 24 4d 85 e4 0f 84 0b f7
ff ff 49 8d 7c 24 10 48 89 f8 48 c1 e8 03 42 80 3c 28 00 <74> a4 e8 3d 00
04 fa eb 9d 48 89 de 4c 89 ff e8 90 3b da f9 e9 a2
RSP: 0018:ffff88019783e538 EFLAGS: 00000046
RAX: 1ffff10038aea07b RBX: ffff8801c7e2e180 RCX: 1ffff10038aea8ff
RDX: 0000000040000002 RSI: 0000000000000000 RDI: ffff8801c57503d8
RBP: ffff88019783e710 R08: ffff8801972dc100 R09: fffff52002232e47
R10: fffff52002232e47 R11: ffffc9001119723b R12: ffff8801c57503c8
R13: dffffc0000000000 R14: ffff8801dae2cb40 R15: ffff8801972dc100
FS: 0000000000000000(0000) GS:ffff8801dae00000(0063) knlGS:00000000f5f25b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000191dbe000 CR4: 00000000001426f0
Call Trace:
preempt_schedule_irq+0x87/0x110 kernel/sched/core.c:3700
retint_kernel+0x1b/0x2d
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x50 kernel/kcov.c:146
Code: 14 dd 28 00 00 00 4d 39 d0 72 1b 49 83 c1 01 4a 89 7c 10 e0 4a 89 74
10 e8 4a 89 54 10 f0 4a 89 4c d8 20 4c 89 08 5d c3 66 90 <55> 48 89 e5 65
48 8b 04 25 40 ee 01 00 65 8b 15 8c 1d 83 7e 81 e2
RSP: 0018:ffff88019783e800 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
RAX: 0000000000000002 RBX: ffff8801c5753ca0 RCX: ffffffff81164dea
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff88019783e938 R08: ffff8801972dc100 R09: ffff88019783e9a0
R10: ffffed003b5c4732 R11: ffff8801dae23993 R12: 00000000000000f9
R13: 0000000000000002 R14: 0000000000000003 R15: 0000000000000000
segmented_read+0x99/0x360 arch/x86/kvm/emulate.c:1429
emulate_pop+0x239/0x3c0 arch/x86/kvm/emulate.c:1860
? 0xffffffff81000000
em_pop_sreg+0xa8/0x260 arch/x86/kvm/emulate.c:1971
x86_emulate_insn+0x6b2/0x5020 arch/x86/kvm/emulate.c:5592
x86_emulate_instruction+0xd45/0x1fc0 arch/x86/kvm/x86.c:6224
kvm_mmu_page_fault+0x396/0x1b30 arch/x86/kvm/mmu.c:5280
handle_ept_violation+0x29e/0x6a0 arch/x86/kvm/vmx.c:7679
vmx_handle_exit+0x2f7/0x17e0 arch/x86/kvm/vmx.c:10115
vcpu_enter_guest+0x14a9/0x62e0 arch/x86/kvm/x86.c:7648
vcpu_run arch/x86/kvm/x86.c:7711 [inline]
kvm_arch_vcpu_ioctl_run+0x375/0x16e0 arch/x86/kvm/x86.c:7888
kvm_vcpu_ioctl+0x72b/0x1150 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2590
kvm_vcpu_compat_ioctl+0x210/0x4a0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2785
__do_compat_sys_ioctl fs/compat_ioctl.c:1419 [inline]
__se_compat_sys_ioctl fs/compat_ioctl.c:1365 [inline]
__ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:1365
do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f29ca9
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90
90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90
90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5f250cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.