====================================================== WARNING: possible circular locking dependency detected 4.19.211-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.2/27435 is trying to acquire lock: 00000000266dab89 (&mm->mmap_sem){++++}, at: __might_fault+0xef/0x1d0 mm/memory.c:4771 but task is already holding lock: 00000000e883822c (&cpuctx_mutex){+.+.}, at: perf_event_ctx_lock_nested+0x237/0x430 kernel/events/core.c:1283 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #8 (&cpuctx_mutex){+.+.}: perf_event_init_cpu+0xc4/0x170 kernel/events/core.c:11828 perf_event_init+0x309/0x34e kernel/events/core.c:11875 start_kernel+0x5b1/0x911 init/main.c:644 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 -> #7 (pmus_lock){+.+.}: perf_event_init_cpu+0x2c/0x170 kernel/events/core.c:11822 cpuhp_invoke_callback+0x201/0x1b80 kernel/cpu.c:170 cpuhp_up_callbacks kernel/cpu.c:584 [inline] _cpu_up+0x25c/0x540 kernel/cpu.c:1192 do_cpu_up+0xdd/0x1b0 kernel/cpu.c:1228 smp_init+0x1ed/0x202 kernel/smp.c:578 kernel_init_freeable+0x62b/0xab7 init/main.c:1138 kernel_init+0xd/0x1ba init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 -> #6 (cpu_hotplug_lock.rw_sem){++++}: get_online_cpus include/linux/cpu.h:137 [inline] kmem_cache_create_usercopy+0x24/0x240 mm/slab_common.c:447 kmem_cache_create+0xd/0x10 mm/slab_common.c:522 bio_find_or_create_slab block/bio.c:117 [inline] bioset_init+0x473/0x810 block/bio.c:1920 init_bio+0x184/0x1e0 block/bio.c:2094 do_one_initcall+0xf1/0x740 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x9c5/0xab7 init/main.c:1145 kernel_init+0xd/0x1ba init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 -> #5 (bio_slab_lock){+.+.}: bio_find_or_create_slab block/bio.c:82 [inline] bioset_init+0x1ab/0x810 block/bio.c:1920 blk_alloc_queue_node+0x189/0xbf0 block/blk-core.c:1025 blk_mq_init_queue+0x44/0xa0 block/blk-mq.c:2500 loop_add+0x2cb/0x8a0 drivers/block/loop.c:1996 loop_init+0x1ef/0x24a drivers/block/loop.c:2259 do_one_initcall+0xf1/0x740 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x9c5/0xab7 init/main.c:1145 kernel_init+0xd/0x1ba init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 -> #4 (loop_ctl_mutex){+.+.}: lo_open+0x19/0xd0 drivers/block/loop.c:1771 __blkdev_get+0x372/0x1480 fs/block_dev.c:1494 blkdev_get+0xb0/0x940 fs/block_dev.c:1627 blkdev_open+0x202/0x290 fs/block_dev.c:1788 do_dentry_open+0x4aa/0x1160 fs/open.c:796 do_last fs/namei.c:3421 [inline] path_openat+0x793/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #3 (&bdev->bd_mutex){+.+.}: blkdev_put+0x30/0x520 fs/block_dev.c:1839 btrfs_close_bdev fs/btrfs/volumes.c:1033 [inline] btrfs_close_one_device fs/btrfs/volumes.c:1057 [inline] close_fs_devices.part.0+0x24d/0x8e0 fs/btrfs/volumes.c:1085 close_fs_devices fs/btrfs/volumes.c:1117 [inline] btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1103 close_ctree+0x3c8/0x850 fs/btrfs/disk-io.c:4047 generic_shutdown_super+0x144/0x370 fs/super.c:456 kill_anon_super+0x36/0x60 fs/super.c:1032 btrfs_kill_super+0x49/0x550 fs/btrfs/super.c:2221 deactivate_locked_super+0x94/0x160 fs/super.c:329 deactivate_super+0x174/0x1a0 fs/super.c:360 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098 task_work_run+0x148/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #2 (&fs_devs->device_list_mutex){+.+.}: btrfs_finish_chunk_alloc+0x27b/0xf90 fs/btrfs/volumes.c:4938 btrfs_create_pending_block_groups+0x242/0x590 fs/btrfs/extent-tree.c:10134 __btrfs_end_transaction+0x21a/0xb00 fs/btrfs/transaction.c:855 flush_space+0xa41/0xee0 fs/btrfs/extent-tree.c:4861 btrfs_async_reclaim_metadata_space+0x466/0x1050 fs/btrfs/extent-tree.c:4977 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 -> #1 (sb_internal#2){.+.+}: sb_start_intwrite include/linux/fs.h:1626 [inline] start_transaction+0xa37/0xf90 fs/btrfs/transaction.c:528 btrfs_dirty_inode+0xe3/0x210 fs/btrfs/inode.c:6165 btrfs_update_time+0x33b/0x3d0 fs/btrfs/inode.c:6207 update_time fs/inode.c:1675 [inline] touch_atime+0x23c/0x2a0 fs/inode.c:1746 file_accessed include/linux/fs.h:2123 [inline] btrfs_file_mmap+0x11b/0x160 fs/btrfs/file.c:2274 call_mmap include/linux/fs.h:1826 [inline] mmap_region+0xc94/0x16b0 mm/mmap.c:1757 do_mmap+0x8e8/0x1080 mm/mmap.c:1530 do_mmap_pgoff include/linux/mm.h:2329 [inline] vm_mmap_pgoff+0x197/0x200 mm/util.c:357 ksys_mmap_pgoff+0x298/0x5a0 mm/mmap.c:1580 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (&mm->mmap_sem){++++}: __might_fault mm/memory.c:4772 [inline] __might_fault+0x152/0x1d0 mm/memory.c:4757 perf_copy_attr+0xab/0x7a0 kernel/events/core.c:10275 _perf_ioctl+0x6aa/0x2300 kernel/events/core.c:5150 perf_ioctl+0x55/0x80 kernel/events/core.c:5177 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: &mm->mmap_sem --> pmus_lock --> &cpuctx_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&cpuctx_mutex); lock(pmus_lock); lock(&cpuctx_mutex); lock(&mm->mmap_sem); *** DEADLOCK *** 1 lock held by syz-executor.2/27435: #0: 00000000e883822c (&cpuctx_mutex){+.+.}, at: perf_event_ctx_lock_nested+0x237/0x430 kernel/events/core.c:1283 stack backtrace: CPU: 0 PID: 27435 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222 check_prev_add kernel/locking/lockdep.c:1866 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2420 [inline] __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __might_fault mm/memory.c:4772 [inline] __might_fault+0x152/0x1d0 mm/memory.c:4757 perf_copy_attr+0xab/0x7a0 kernel/events/core.c:10275 _perf_ioctl+0x6aa/0x2300 kernel/events/core.c:5150 perf_ioctl+0x55/0x80 kernel/events/core.c:5177 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fa14e1720a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa14c6c3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fa14e292050 RCX: 00007fa14e1720a9 RDX: 00000000200001c0 RSI: 000000004008240b RDI: 0000000000000004 RBP: 00007fa14e1cdae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffc67ddeff R14: 00007fa14c6c3300 R15: 0000000000022000 Cannot find add_set index 0 as target Cannot find add_set index 0 as target new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored tmpfs: No value for mount option './bus' new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored