BUG: soft lockup in commit_echoes

[syzbot <syzbot+995c889cef82be5ccddf@syzkaller.appspotmail.com>]

Hello,

syzbot found the following crash on:

HEAD commit:    c1c07416cdd4 Merge tag 'kbuild-fixes-v4.17' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=138afde7800000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5a1dc06635c10d27
dashboard link: https://syzkaller.appspot.com/bug?extid=995c889cef82be5ccddf
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1355fc37800000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1033f657800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+995c889cef82be5ccddf@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 135s! [kworker/u4:3:4495]
Modules linked in:
irq event stamp: 916736
hardirqs last  enabled at (916735): [<ffffffff878009d5>]  
restore_regs_and_return_to_kernel+0x0/0x2b
hardirqs last disabled at (916736): [<ffffffff87800905>]  
interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (746274): [<ffffffff87a00778>]  
__do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (746209): [<ffffffff81475281>] invoke_softirq  
kernel/softirq.c:365 [inline]
softirqs last disabled at (746209): [<ffffffff81475281>]  
irq_exit+0x1d1/0x200 kernel/softirq.c:405
CPU: 0 PID: 4495 Comm: kworker/u4:3 Not tainted 4.17.0-rc3+ #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:echo_buf drivers/tty/n_tty.c:144 [inline]
RIP: 0010:__process_echoes+0x1fd/0x8d0 drivers/tty/n_tty.c:733
RSP: 0018:ffff8801adbc7268 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff8801ad126280 RBX: 00000001fda8cfee RCX: ffffffff8397b54c
RDX: 0000000000000000 RSI: ffffffff8397b46d RDI: 0000000000000001
RBP: ffff8801adbc72d0 R08: ffff8801ad126280 R09: 0000000000000006
R10: ffff8801ad126280 R11: 0000000000000000 R12: ffffc90001eec000
R13: 0000000000001a02 R14: 00000001fda8cfef R15: 00000000000000ff
FS:  0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000021000000 CR3: 00000001ada40000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  commit_echoes+0x163/0x1d0 drivers/tty/n_tty.c:764
  n_tty_receive_char_fast drivers/tty/n_tty.c:1416 [inline]
  n_tty_receive_buf_fast drivers/tty/n_tty.c:1576 [inline]
  __receive_buf drivers/tty/n_tty.c:1611 [inline]
  n_tty_receive_buf_common+0x2048/0x2c50 drivers/tty/n_tty.c:1709
  n_tty_receive_buf2+0x33/0x40 drivers/tty/n_tty.c:1744
  tty_ldisc_receive_buf+0xb0/0x190 drivers/tty/tty_buffer.c:456
  tty_port_default_receive_buf+0x110/0x170 drivers/tty/tty_port.c:38
  receive_buf drivers/tty/tty_buffer.c:475 [inline]
  flush_to_ldisc+0x3e9/0x560 drivers/tty/tty_buffer.c:524
  process_one_work+0xc1e/0x1b50 kernel/workqueue.c:2145
  worker_thread+0x1cc/0x1440 kernel/workqueue.c:2279
  kthread+0x345/0x410 kernel/kthread.c:238
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 48 83 c3 01 48 b9 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 08 00 0f  
85 17 06 00 00 4d 8b 6c 24 20 e9 db fe ff ff e8 73 7b e1 fd <41> 81 e6 ff  
0f 00 00 48 b9 00 00 00 00 00 fc ff df 4b 8d bc 34


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.