====================================================== WARNING: possible circular locking dependency detected 6.1.91-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/26962 is trying to acquire lock: ffff88804c40cf00 (mapping.invalidate_lock#11){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:813 [inline] ffff88804c40cf00 (mapping.invalidate_lock#11){++++}-{3:3}, at: filemap_fault+0x640/0x17e0 mm/filemap.c:3191 but task is already holding lock: ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5304 [inline] ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x2e/0x2e0 mm/memory.c:5366 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&mm->mmap_lock){++++}-{3:3}: lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 __might_fault+0xbd/0x110 mm/memory.c:5835 _copy_to_user+0x26/0x130 lib/usercopy.c:36 copy_to_user include/linux/uaccess.h:169 [inline] fiemap_fill_next_extent+0x231/0x410 fs/ioctl.c:144 ni_fiemap+0xa5a/0x1230 fs/ntfs3/frecord.c:2066 ntfs_fiemap+0x12e/0x170 fs/ntfs3/file.c:1247 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x18e9/0x2a90 fs/ioctl.c:810 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl+0x81/0x160 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #2 (&ni->file.run_lock#3){++++}-{3:3}: lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 down_write+0x36/0x60 kernel/locking/rwsem.c:1573 ntfs_file_release+0x139/0x200 fs/ntfs3/file.c:1221 __fput+0x3b7/0x890 fs/file_table.c:320 task_work_run+0x246/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xde/0x100 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #1 (&ni->ni_lock/4){+.+.}-{3:3}: lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747 ni_lock fs/ntfs3/ntfs_fs.h:1099 [inline] ntfs_fallocate+0x7e9/0x1020 fs/ntfs3/file.c:666 vfs_fallocate+0x547/0x6b0 fs/open.c:323 ksys_fallocate fs/open.c:346 [inline] __do_sys_fallocate fs/open.c:354 [inline] __se_sys_fallocate fs/open.c:352 [inline] __x64_sys_fallocate+0xb9/0x100 fs/open.c:352 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #0 (mapping.invalidate_lock#11){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 down_read+0xad/0xa30 kernel/locking/rwsem.c:1520 filemap_invalidate_lock_shared include/linux/fs.h:813 [inline] filemap_fault+0x640/0x17e0 mm/filemap.c:3191 __do_fault+0x136/0x4f0 mm/memory.c:4261 do_read_fault mm/memory.c:4612 [inline] do_fault mm/memory.c:4741 [inline] handle_pte_fault mm/memory.c:5013 [inline] __handle_mm_fault mm/memory.c:5155 [inline] handle_mm_fault+0x3412/0x5340 mm/memory.c:5276 do_user_addr_fault arch/x86/mm/fault.c:1371 [inline] handle_page_fault arch/x86/mm/fault.c:1462 [inline] exc_page_fault+0x26f/0x660 arch/x86/mm/fault.c:1518 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 strncpy_from_user+0x159/0x360 lib/strncpy_from_user.c:139 getname_flags+0xf5/0x4f0 fs/namei.c:150 do_sys_openat2+0xd2/0x500 fs/open.c:1312 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 other info that might help us debug this: Chain exists of: mapping.invalidate_lock#11 --> &ni->file.run_lock#3 --> &mm->mmap_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&mm->mmap_lock); lock(&ni->file.run_lock#3); lock(&mm->mmap_lock); lock(mapping.invalidate_lock#11); *** DEADLOCK *** 1 lock held by syz-executor.0/26962: #0: ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5304 [inline] #0: ffff888019709058 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x2e/0x2e0 mm/memory.c:5366 stack backtrace: CPU: 0 PID: 26962 Comm: syz-executor.0 Not tainted 6.1.91-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170 check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 down_read+0xad/0xa30 kernel/locking/rwsem.c:1520 filemap_invalidate_lock_shared include/linux/fs.h:813 [inline] filemap_fault+0x640/0x17e0 mm/filemap.c:3191 __do_fault+0x136/0x4f0 mm/memory.c:4261 do_read_fault mm/memory.c:4612 [inline] do_fault mm/memory.c:4741 [inline] handle_pte_fault mm/memory.c:5013 [inline] __handle_mm_fault mm/memory.c:5155 [inline] handle_mm_fault+0x3412/0x5340 mm/memory.c:5276 do_user_addr_fault arch/x86/mm/fault.c:1371 [inline] handle_page_fault arch/x86/mm/fault.c:1462 [inline] exc_page_fault+0x26f/0x660 arch/x86/mm/fault.c:1518 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:do_strncpy_from_user lib/strncpy_from_user.c:41 [inline] RIP: 0010:strncpy_from_user+0x159/0x360 lib/strncpy_from_user.c:139 Code: 27 fd 48 83 fd 07 0f 86 af 00 00 00 4c 89 64 24 08 4c 89 7c 24 10 48 c7 44 24 18 f8 ff ff ff 45 31 ed 4d 89 f4 48 8b 44 24 08 <4e> 8b 3c 28 48 b8 ff fe fe fe fe fe fe fe 49 8d 1c 07 4d 89 fe 49 RSP: 0018:ffffc9000329fc90 EFLAGS: 00050246 RAX: 00000000200000c0 RBX: 00007fffffffe020 RCX: ffff888055cb9dc0 RDX: ffffc9000c692000 RSI: 0000000000000fe0 RDI: 0000000000000007 RBP: 0000000000000fe0 R08: ffffffff8462f551 R09: fffff940002cfd41 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888059fad520 R13: 0000000000000000 R14: ffff888059fad520 R15: 0000000000000fe0 getname_flags+0xf5/0x4f0 fs/namei.c:150 do_sys_openat2+0xd2/0x500 fs/open.c:1312 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f243927cee9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2439f0d0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f24393abf80 RCX: 00007f243927cee9 RDX: 000000000000275a RSI: 00000000200000c0 RDI: ffffffffffffff9c RBP: 00007f24392c949e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f24393abf80 R15: 00007fffde2c7928 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: fd std 1: 48 83 fd 07 cmp $0x7,%rbp 5: 0f 86 af 00 00 00 jbe 0xba b: 4c 89 64 24 08 mov %r12,0x8(%rsp) 10: 4c 89 7c 24 10 mov %r15,0x10(%rsp) 15: 48 c7 44 24 18 f8 ff movq $0xfffffffffffffff8,0x18(%rsp) 1c: ff ff 1e: 45 31 ed xor %r13d,%r13d 21: 4d 89 f4 mov %r14,%r12 24: 48 8b 44 24 08 mov 0x8(%rsp),%rax * 29: 4e 8b 3c 28 mov (%rax,%r13,1),%r15 <-- trapping instruction 2d: 48 b8 ff fe fe fe fe movabs $0xfefefefefefefeff,%rax 34: fe fe fe 37: 49 8d 1c 07 lea (%r15,%rax,1),%rbx 3b: 4d 89 fe mov %r15,%r14 3e: 49 rex.WB