[v6.1] BUG: soft lockup in sock_setsockopt

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 29f02ec58a94 Linux 6.1.121
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1484f4c4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f738f3c37768d3ef
dashboard link: https://syzkaller.appspot.com/bug?extid=85ef51f4fe187af99a06
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11260018580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f0e977ac21f4/disk-29f02ec5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2114c6ce7c93/vmlinux-29f02ec5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3ec83a920b74/Image-29f02ec5.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85ef51...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz.3.1488:8982]
Modules linked in:
irq event stamp: 21113863
hardirqs last enabled at (21113862): [<ffff8000081c24a8>] __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401
hardirqs last disabled at (21113863): [<ffff8000123280c4>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (21113863): [<ffff8000123280c4>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (60): [<ffff800011e0e798>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (60): [<ffff800011e0e798>] tipc_skb_peek_port net/tipc/msg.h:1235 [inline]
softirqs last enabled at (60): [<ffff800011e0e798>] tipc_sk_rcv+0x35c/0x1940 net/tipc/socket.c:2491
softirqs last disabled at (62): [<ffff800011e0e7b8>] spin_trylock_bh include/linux/spinlock.h:411 [inline]
softirqs last disabled at (62): [<ffff800011e0e7b8>] tipc_sk_rcv+0x37c/0x1940 net/tipc/socket.c:2496
CPU: 0 PID: 8982 Comm: syz.3.1488 Tainted: G W 6.1.121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:131
lr : lock_is_held_type+0x150/0x1a8 kernel/locking/lockdep.c:5707
sp : ffff800024eb6020
x29: ffff800024eb6020 x28: dfff800000000000 x27: ffff800024eb6480
x26: ffff0000f1ea9bc0 x25: ffff8000159e3cc0 x24: ffff800015b35640
x23: 0000000000000002 x22: ffff0000f1eaa688 x21: ffff800015c653a0
x20: 0000000000000001 x19: 0000000000000000 x18: ffff800024eb61c0
x17: ffff800018b7b000 x16: ffff8000082ffa8c x15: ffff8000105773d4
x14: 1ffff00002b520b2 x13: dfff800000000000 x12: 0000000084b85af6
x11: 0000000000ff0100 x10: 0000000000000003 x9 : 0000000000000000
x8 : 00000000000000c0 x7 : ffff800011e1b66c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : ffff80001248d700 x0 : 0000000000000000
Call trace:
arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122
lock_is_held include/linux/lockdep.h:283 [inline]
rcu_read_lock_held+0x34/0x50 kernel/rcu/update.c:311
__rhashtable_lookup include/linux/rhashtable.h:594 [inline]
rhashtable_lookup include/linux/rhashtable.h:638 [inline]
tipc_sk_lookup+0x1bc/0x8b4 net/tipc/socket.c:3001
tipc_sk_rcv+0x368/0x1940 net/tipc/socket.c:2492
tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703
tipc_node_xmit_skb net/tipc/node.c:1768 [inline]
tipc_node_distr_xmit+0x28c/0x3a4 net/tipc/node.c:1783
tipc_sk_rcv+0x1338/0x1940 net/tipc/socket.c:2501
tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703
tipc_sk_push_backlog+0x3a8/0x744 net/tipc/socket.c:1316
tipc_sk_conn_proto_rcv net/tipc/socket.c:1370 [inline]
tipc_sk_proto_rcv+0x81c/0x1500 net/tipc/socket.c:2158
tipc_sk_filter_rcv+0x29d4/0x2d34 net/tipc/socket.c:2352
tipc_sk_enqueue net/tipc/socket.c:2445 [inline]
tipc_sk_rcv+0x6e0/0x1940 net/tipc/socket.c:2497
tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703
tipc_node_xmit_skb net/tipc/node.c:1768 [inline]
tipc_node_distr_xmit+0x28c/0x3a4 net/tipc/node.c:1783
tipc_sk_backlog_rcv+0x160/0x210 net/tipc/socket.c:2412
sk_backlog_rcv include/net/sock.h:1119 [inline]
__release_sock+0x1a8/0x408 net/core/sock.c:2936
release_sock+0x68/0x1cc net/core/sock.c:3500
sk_setsockopt+0x25c4/0x3240
sock_setsockopt+0x68/0x80 net/core/sock.c:1547
__sys_setsockopt+0x3f8/0x70c net/socket.c:2284
__do_sys_setsockopt net/socket.c:2299 [inline]
__se_sys_setsockopt net/socket.c:2296 [inline]
__arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2296
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 29f02ec58a94 Linux 6.1.121
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=10b580b0580000

kernel config: https://syzkaller.appspot.com/x/.config?x=f738f3c37768d3ef
dashboard link: https://syzkaller.appspot.com/bug?extid=85ef51f4fe187af99a06
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172df4c4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14b580b0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f0e977ac21f4/disk-29f02ec5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2114c6ce7c93/vmlinux-29f02ec5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3ec83a920b74/Image-29f02ec5.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85ef51...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor393:7116]
Modules linked in:
irq event stamp: 20850037
hardirqs last enabled at (20850036): [<ffff8000081c24a8>] __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401
hardirqs last disabled at (20850037): [<ffff8000123280c4>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (20850037): [<ffff8000123280c4>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (410): [<ffff800011e0e798>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (410): [<ffff800011e0e798>] tipc_skb_peek_port net/tipc/msg.h:1235 [inline]
softirqs last enabled at (410): [<ffff800011e0e798>] tipc_sk_rcv+0x35c/0x1940 net/tipc/socket.c:2491
softirqs last disabled at (412): [<ffff800011e0e7b8>] spin_trylock_bh include/linux/spinlock.h:411 [inline]
softirqs last disabled at (412): [<ffff800011e0e7b8>] tipc_sk_rcv+0x37c/0x1940 net/tipc/socket.c:2496
CPU: 0 PID: 7116 Comm: syz-executor393 Tainted: G W 6.1.121-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline]
pc : __local_bh_enable_ip+0x238/0x470 kernel/softirq.c:403
lr : __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401
sp : ffff800025bb62f0
x29: ffff800025bb6300 x28: dfff800000000000 x27: ffff800025bb6660
x26: ffff80001d0979c0 x25: 00000000af79a92a x24: 0000000000000001
x23: 1fffe0001892ea69 x22: dfff800000000000 x21: ffff800011e0e7b8
x20: 0000000000000202 x19: ffff0000c4975348 x18: ffff800025bb63a0
x17: ffff800018b7b000 x16: ffff80000830158c x15: ffff8000105773d4
x14: 1ffff00002b520b2 x13: dfff800000000000 x12: 0000000000000003

x11: 0000000000ff0100 x10: 0000000000000003 x9 : 0000000000000000

x8 : 00000000000000e0 x7 : ffff800011e1b66c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff80001248c5c0 x0 : ffff80019e2fc000
Call trace:
arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline]
__local_bh_enable_ip+0x238/0x470 kernel/softirq.c:401
__raw_spin_trylock_bh include/linux/spinlock_api_smp.h:177 [inline]
_raw_spin_trylock_bh+0x74/0x8c kernel/locking/spinlock.c:146
spin_trylock_bh include/linux/spinlock.h:411 [inline]
tipc_sk_rcv+0x37c/0x1940 net/tipc/socket.c:2496

tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703
tipc_node_xmit_skb net/tipc/node.c:1768 [inline]
tipc_node_distr_xmit+0x28c/0x3a4 net/tipc/node.c:1783
tipc_sk_rcv+0x1338/0x1940 net/tipc/socket.c:2501
tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703

tipc_sk_push_backlog net/tipc/socket.c:1316 [inline]
tipc_sk_filter_connect net/tipc/socket.c:2255 [inline]
tipc_sk_filter_rcv+0x1714/0x2d34 net/tipc/socket.c:2364

tipc_sk_enqueue net/tipc/socket.c:2445 [inline]
tipc_sk_rcv+0x6e0/0x1940 net/tipc/socket.c:2497
tipc_node_xmit+0x1b0/0xdac net/tipc/node.c:1703
tipc_node_xmit_skb net/tipc/node.c:1768 [inline]
tipc_node_distr_xmit+0x28c/0x3a4 net/tipc/node.c:1783
tipc_sk_backlog_rcv+0x160/0x210 net/tipc/socket.c:2412
sk_backlog_rcv include/net/sock.h:1119 [inline]
__release_sock+0x1a8/0x408 net/core/sock.c:2936
release_sock+0x68/0x1cc net/core/sock.c:3500
sk_setsockopt+0x25c4/0x3240
sock_setsockopt+0x68/0x80 net/core/sock.c:1547
__sys_setsockopt+0x3f8/0x70c net/socket.c:2284
__do_sys_setsockopt net/socket.c:2299 [inline]
__se_sys_setsockopt net/socket.c:2296 [inline]
__arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2296
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---