======================================================
WARNING: possible circular locking dependency detected
6.1.145-syzkaller #0 Not tainted
------------------------------------------------------
syz.0.2221/13803 is trying to acquire lock:
ffff888054f9ec80 (mapping.invalidate_lock#12){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:813 [inline]
ffff888054f9ec80 (mapping.invalidate_lock#12){++++}-{3:3}, at: page_cache_ra_unbounded+0xd8/0x770 mm/readahead.c:226
but task is already holding lock:
ffff888054f9e840 (&ni->ni_lock/5){+.+.}-{3:3}, at: ni_lock fs/ntfs3/ntfs_fs.h:1102 [inline]
ffff888054f9e840 (&ni->ni_lock/5){+.+.}-{3:3}, at: ntfs_fiemap+0xc4/0x130 fs/ntfs3/file.c:1168
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ni->ni_lock/5){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x120/0xaf0 kernel/locking/mutex.c:747
ni_lock fs/ntfs3/ntfs_fs.h:1102 [inline]
ntfs_fallocate+0x4c7/0xf20 fs/ntfs3/file.c:518
vfs_fallocate+0x584/0x6f0 fs/open.c:323
ioctl_preallocate fs/ioctl.c:290 [inline]
file_ioctl fs/ioctl.c:-1 [inline]
do_vfs_ioctl+0x1a9d/0x1d10 fs/ioctl.c:849
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl+0x83/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #0 (mapping.invalidate_lock#12){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
down_read+0x42/0x2d0 kernel/locking/rwsem.c:1520
filemap_invalidate_lock_shared include/linux/fs.h:813 [inline]
page_cache_ra_unbounded+0xd8/0x770 mm/readahead.c:226
do_sync_mmap_readahead+0x5ea/0x780 mm/filemap.c:3136
filemap_fault+0x6d7/0x1670 mm/filemap.c:3228
__do_fault+0x13b/0x4e0 mm/memory.c:4280
do_shared_fault mm/memory.c:4686 [inline]
do_fault mm/memory.c:4764 [inline]
handle_pte_fault mm/memory.c:5031 [inline]
__handle_mm_fault mm/memory.c:5173 [inline]
handle_mm_fault+0x1a93/0x3e70 mm/memory.c:5294
do_user_addr_fault+0x51f/0xb10 arch/x86/mm/fault.c:1340
handle_page_fault arch/x86/mm/fault.c:1431 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1487
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
copy_user_enhanced_fast_string+0xa/0x40 arch/x86/lib/copy_user_64.S:165
copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
_copy_to_user+0xea/0x130 lib/usercopy.c:41
copy_to_user include/linux/uaccess.h:169 [inline]
ni_fiemap+0x4ec/0x1300 fs/ntfs3/frecord.c:2140
ntfs_fiemap+0xd7/0x130 fs/ntfs3/file.c:1170
ioctl_fiemap fs/ioctl.c:219 [inline]
do_vfs_ioctl+0x1425/0x1d10 fs/ioctl.c:810
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl+0x83/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ni->ni_lock/5);
lock(mapping.invalidate_lock#12);
lock(&ni->ni_lock/5);
lock(mapping.invalidate_lock#12);
*** DEADLOCK ***
1 lock held by syz.0.2221/13803:
#0: ffff888054f9e840 (&ni->ni_lock/5){+.+.}-{3:3}, at: ni_lock fs/ntfs3/ntfs_fs.h:1102 [inline]
#0: ffff888054f9e840 (&ni->ni_lock/5){+.+.}-{3:3}, at: ntfs_fiemap+0xc4/0x130 fs/ntfs3/file.c:1168
stack backtrace:
CPU: 0 PID: 13803 Comm: syz.0.2221 Not tainted 6.1.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
down_read+0x42/0x2d0 kernel/locking/rwsem.c:1520
filemap_invalidate_lock_shared include/linux/fs.h:813 [inline]
page_cache_ra_unbounded+0xd8/0x770 mm/readahead.c:226
do_sync_mmap_readahead+0x5ea/0x780 mm/filemap.c:3136
filemap_fault+0x6d7/0x1670 mm/filemap.c:3228
__do_fault+0x13b/0x4e0 mm/memory.c:4280
do_shared_fault mm/memory.c:4686 [inline]
do_fault mm/memory.c:4764 [inline]
handle_pte_fault mm/memory.c:5031 [inline]
__handle_mm_fault mm/memory.c:5173 [inline]
handle_mm_fault+0x1a93/0x3e70 mm/memory.c:5294
do_user_addr_fault+0x51f/0xb10 arch/x86/mm/fault.c:1340
handle_page_fault arch/x86/mm/fault.c:1431 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1487
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0010:copy_user_enhanced_fast_string+0xa/0x40 arch/x86/lib/copy_user_64.S:166
Code: ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 8d 0c ca 89 ca eb 20 0f 01 cb 83 fa 40 72 38 89 d1 <f3> a4 31 c0 0f 01 ca c3 89 ca eb 0a 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003667828 EFLAGS: 00050202
RAX: ffffffff8407df01 RBX: 00000000000034f0 RCX: 0000000000002890
RDX: 00000000000034f0 RSI: ffff888061b28c60 RDI: 0000200000001000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed100c36569e
R10: 0000000000000000 R11: 0000000000000698 R12: 00007fffffffbb10
R13: ffff888054f9e880 R14: 00002000000003a0 R15: ffff888061b28000
copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
_copy_to_user+0xea/0x130 lib/usercopy.c:41
copy_to_user include/linux/uaccess.h:169 [inline]
ni_fiemap+0x4ec/0x1300 fs/ntfs3/frecord.c:2140
ntfs_fiemap+0xd7/0x130 fs/ntfs3/file.c:1170
ioctl_fiemap fs/ioctl.c:219 [inline]
do_vfs_ioctl+0x1425/0x1d10 fs/ioctl.c:810
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl+0x83/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd0b238e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd0b319f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd0b25b5fa0 RCX: 00007fd0b238e929
RDX: 0000200000000380 RSI: 00000000c020660b RDI: 0000000000000004
RBP: 00007fd0b2410ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd0b25b5fa0 R15: 00007ffe211ba5e8
</TASK>
----------------
Code disassembly (best guess):
0: ff c9 dec %ecx
2: 75 f2 jne 0xfffffff6
4: 89 d1 mov %edx,%ecx
6: c1 e9 03 shr $0x3,%ecx
9: 83 e2 07 and $0x7,%edx
c: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi)
f: 89 d1 mov %edx,%ecx
11: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi)
13: 31 c0 xor %eax,%eax
15: 0f 01 ca clac
18: c3 ret
19: 8d 0c ca lea (%rdx,%rcx,8),%ecx
1c: 89 ca mov %ecx,%edx
1e: eb 20 jmp 0x40
20: 0f 01 cb stac
23: 83 fa 40 cmp $0x40,%edx
26: 72 38 jb 0x60
28: 89 d1 mov %edx,%ecx
* 2a: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) <-- trapping instruction
2c: 31 c0 xor %eax,%eax
2e: 0f 01 ca clac
31: c3 ret
32: 89 ca mov %ecx,%edx
34: eb 0a jmp 0x40
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop