====================================================== WARNING: possible circular locking dependency detected 6.1.0-rc4-syzkaller-31872-g1621b6eaebf7 #0 Not tainted ------------------------------------------------------ syz-executor.1/14932 is trying to acquire lock: ffff0000c0c287b8 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x20c/0xdfc mm/hugetlb.c:5848 but task is already holding lock: ffff00015e9ca778 (&vma_lock->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read mm/hugetlb.c:6816 [inline] ffff00015e9ca778 (&vma_lock->rw_sema){++++}-{3:3}, at: hugetlb_fault+0x23c/0xdfc mm/hugetlb.c:5859 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&vma_lock->rw_sema){++++}-{3:3}: down_read+0x5c/0x78 kernel/locking/rwsem.c:1509 hugetlb_vma_lock_read mm/hugetlb.c:6816 [inline] hugetlb_fault+0x23c/0xdfc mm/hugetlb.c:5859 follow_hugetlb_page+0x368/0xce0 mm/hugetlb.c:6301 __get_user_pages+0x310/0x5e4 mm/gup.c:1202 populate_vma_page_range+0x158/0x1d4 mm/gup.c:1587 __mm_populate+0x188/0x280 mm/gup.c:1701 do_mlock+0x2a8/0x368 mm/mlock.c:608 __do_sys_mlock mm/mlock.c:616 [inline] __se_sys_mlock mm/mlock.c:614 [inline] __arm64_sys_mlock+0x24/0x38 mm/mlock.c:614 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 -> #0 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __mutex_lock_common+0xd4/0xca8 kernel/locking/mutex.c:603 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 hugetlb_fault+0x20c/0xdfc mm/hugetlb.c:5848 handle_mm_fault+0x904/0xa48 mm/memory.c:5216 __do_page_fault arch/arm64/mm/fault.c:506 [inline] do_page_fault+0x428/0x79c arch/arm64/mm/fault.c:606 do_translation_fault+0x78/0x194 arch/arm64/mm/fault.c:689 do_mem_abort+0x54/0x130 arch/arm64/mm/fault.c:825 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:579 __arch_copy_from_user+0x1bc/0x1f4 arch/arm64/lib/copy_from_user.S:214 __import_iovec+0x60/0x248 lib/iov_iter.c:1773 import_iovec+0x6c/0x88 lib/iov_iter.c:1838 vfs_writev fs/read_write.c:931 [inline] do_writev+0xf8/0x234 fs/read_write.c:977 __do_sys_writev fs/read_write.c:1050 [inline] __se_sys_writev fs/read_write.c:1047 [inline] __arm64_sys_writev+0x28/0x38 fs/read_write.c:1047 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&vma_lock->rw_sema); lock(&hugetlb_fault_mutex_table[i]); lock(&vma_lock->rw_sema); lock(&hugetlb_fault_mutex_table[i]); *** DEADLOCK *** 2 locks held by syz-executor.1/14932: #0: ffff00015e9ca778 (&vma_lock->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read mm/hugetlb.c:6816 [inline] #0: ffff00015e9ca778 (&vma_lock->rw_sema){++++}-{3:3}, at: hugetlb_fault+0x23c/0xdfc mm/hugetlb.c:5859 #1: ffff00011293a608 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #1: ffff00011293a608 (&mm->mmap_lock){++++}-{3:3}, at: do_page_fault+0x1ec/0x79c arch/arm64/mm/fault.c:587 stack backtrace: CPU: 0 PID: 14932 Comm: syz-executor.1 Not tainted 6.1.0-rc4-syzkaller-31872-g1621b6eaebf7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2055 check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2177 check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __mutex_lock_common+0xd4/0xca8 kernel/locking/mutex.c:603 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 hugetlb_fault+0x20c/0xdfc mm/hugetlb.c:5848 handle_mm_fault+0x904/0xa48 mm/memory.c:5216 __do_page_fault arch/arm64/mm/fault.c:506 [inline] do_page_fault+0x428/0x79c arch/arm64/mm/fault.c:606 do_translation_fault+0x78/0x194 arch/arm64/mm/fault.c:689 do_mem_abort+0x54/0x130 arch/arm64/mm/fault.c:825 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:579 __arch_copy_from_user+0x1bc/0x1f4 arch/arm64/lib/copy_from_user.S:214 __import_iovec+0x60/0x248 lib/iov_iter.c:1773 import_iovec+0x6c/0x88 lib/iov_iter.c:1838 vfs_writev fs/read_write.c:931 [inline] do_writev+0xf8/0x234 fs/read_write.c:977 __do_sys_writev fs/read_write.c:1050 [inline] __se_sys_writev fs/read_write.c:1047 [inline] __arm64_sys_writev+0x28/0x38 fs/read_write.c:1047 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584