syzbot

======================================================
WARNING: possible circular locking dependency detected
4.14.156-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.3/13253 is trying to acquire lock:
 (&mm->mmap_sem){++++}, at: [<0000000055f27dfb>] __might_fault+0xd4/0x1b0 mm/memory.c:4583

but task is already holding lock:
 (&cpuctx_mutex){+.+.}, at: [<00000000b7077004>] perf_event_ctx_lock_nested+0x15a/0x2d0 kernel/events/core.c:1241

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #5 (&cpuctx_mutex){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
       perf_event_init_cpu+0xa8/0x150 kernel/events/core.c:11261
       perf_event_init+0x289/0x2c5 kernel/events/core.c:11308
       start_kernel+0x583/0x890 init/main.c:645
       secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240

-> #4 (pmus_lock){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
       perf_event_init_cpu+0x2c/0x150 kernel/events/core.c:11255
       cpuhp_invoke_callback+0x207/0x1a30 kernel/cpu.c:184
       cpuhp_up_callbacks kernel/cpu.c:573 [inline]
       _cpu_up+0x20b/0x500 kernel/cpu.c:1135
       do_cpu_up+0x64/0x120 kernel/cpu.c:1170
       smp_init+0x142/0x154 kernel/smp.c:578
       kernel_init_freeable+0x196/0x3b0 init/main.c:1091
       kernel_init+0xd/0x164 init/main.c:1023
       ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404

-> #3 (cpu_hotplug_lock.rw_sem){++++}:
       percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
       cpus_read_lock+0x39/0xc0 kernel/cpu.c:295
       get_online_cpus include/linux/cpu.h:145 [inline]
       lru_add_drain_all+0xa/0x20 mm/swap.c:729
       shmem_wait_for_pins mm/shmem.c:2734 [inline]
       shmem_add_seals+0x632/0xf90 mm/shmem.c:2843
       shmem_fcntl+0xea/0x120 mm/shmem.c:2878
       do_fcntl+0x5c8/0xd20 fs/fcntl.c:421
       SYSC_fcntl fs/fcntl.c:463 [inline]
       SyS_fcntl+0xc6/0x100 fs/fcntl.c:448
       do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x42/0xb7

-> #2 (&sb->s_type->i_mutex_key#10){+.+.}:
       down_write+0x34/0x90 kernel/locking/rwsem.c:54
       inode_lock include/linux/fs.h:724 [inline]
       shmem_fallocate+0x150/0xae0 mm/shmem.c:2904
       ashmem_shrink_scan drivers/staging/android/ashmem.c:453 [inline]
       ashmem_shrink_scan+0x1ca/0x4f0 drivers/staging/android/ashmem.c:437
       ashmem_ioctl+0x2b4/0xd20 drivers/staging/android/ashmem.c:795
       vfs_ioctl fs/ioctl.c:46 [inline]
       file_ioctl fs/ioctl.c:500 [inline]
       do_vfs_ioctl+0xabe/0x1040 fs/ioctl.c:684
       SYSC_ioctl fs/ioctl.c:701 [inline]
       SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
       do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x42/0xb7

-> #1 (ashmem_mutex){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
       ashmem_mmap+0x4c/0x450 drivers/staging/android/ashmem.c:369
       call_mmap include/linux/fs.h:1803 [inline]
       mmap_region+0x7d9/0xfb0 mm/mmap.c:1736
       do_mmap+0x548/0xb80 mm/mmap.c:1512
       do_mmap_pgoff include/linux/mm.h:2215 [inline]
       vm_mmap_pgoff+0x177/0x1c0 mm/util.c:333
       SYSC_mmap_pgoff mm/mmap.c:1564 [inline]
       SyS_mmap_pgoff+0xf4/0x1b0 mm/mmap.c:1520
       do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x42/0xb7

-> #0 (&mm->mmap_sem){++++}:
       lock_acquire+0x12b/0x360 kernel/locking/lockdep.c:3994
       __might_fault mm/memory.c:4584 [inline]
       __might_fault+0x137/0x1b0 mm/memory.c:4569
       _copy_to_user+0x27/0xd0 lib/usercopy.c:25
       copy_to_user include/linux/uaccess.h:155 [inline]
       perf_read_one kernel/events/core.c:4583 [inline]
       __perf_read kernel/events/core.c:4626 [inline]
       perf_read+0x579/0x7f0 kernel/events/core.c:4639
       __vfs_read+0xf9/0x590 fs/read_write.c:411
       vfs_read+0x131/0x330 fs/read_write.c:447
       SYSC_read fs/read_write.c:578 [inline]
       SyS_read+0x102/0x250 fs/read_write.c:571
       do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x42/0xb7

other info that might help us debug this:

Chain exists of:
  &mm->mmap_sem --> pmus_lock --> &cpuctx_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&cpuctx_mutex);
                               lock(pmus_lock);
                               lock(&cpuctx_mutex);
  lock(&mm->mmap_sem);

 *** DEADLOCK ***

1 lock held by syz-executor.3/13253:
 #0:  (&cpuctx_mutex){+.+.}, at: [<00000000b7077004>] perf_event_ctx_lock_nested+0x15a/0x2d0 kernel/events/core.c:1241

stack backtrace:
CPU: 1 PID: 13253 Comm: syz-executor.3 Not tainted 4.14.156-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xe5/0x154 lib/dump_stack.c:58
 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258
 check_prev_add kernel/locking/lockdep.c:1901 [inline]
 check_prevs_add kernel/locking/lockdep.c:2018 [inline]
 validate_chain kernel/locking/lockdep.c:2460 [inline]
 __lock_acquire+0x2f5f/0x4320 kernel/locking/lockdep.c:3487
 lock_acquire+0x12b/0x360 kernel/locking/lockdep.c:3994
 __might_fault mm/memory.c:4584 [inline]
 __might_fault+0x137/0x1b0 mm/memory.c:4569
 _copy_to_user+0x27/0xd0 lib/usercopy.c:25
 copy_to_user include/linux/uaccess.h:155 [inline]
 perf_read_one kernel/events/core.c:4583 [inline]
 __perf_read kernel/events/core.c:4626 [inline]
 perf_read+0x579/0x7f0 kernel/events/core.c:4639
 __vfs_read+0xf9/0x590 fs/read_write.c:411
 vfs_read+0x131/0x330 fs/read_write.c:447
 SYSC_read fs/read_write.c:578 [inline]
 SyS_read+0x102/0x250 fs/read_write.c:571
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a639
RSP: 002b:00007f6841e8dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a639
RDX: 0000000000000275 RSI: 0000000020367fe4 RDI: 000000000000000d
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6841e8e6d4
R13: 00000000004c6e53 R14: 00000000004de3f8 R15: 00000000ffffffff
ip6_tunnel: W xmit: Local address not yet configured!