====================================================== WARNING: possible circular locking dependency detected 5.7.0-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/17080 is trying to acquire lock: ffff8880549d30f0 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] ffff8880549d30f0 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: shmem_fallocate+0xef/0xdb0 mm/shmem.c:2708 but task is already holding lock: ffffffff89318810 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x30 mm/page_alloc.c:3838 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}-{0:0}: lock_acquire+0x169/0x480 kernel/locking/lockdep.c:4959 __fs_reclaim_acquire+0x20/0x30 mm/page_alloc.c:4183 fs_reclaim_acquire mm/page_alloc.c:4194 [inline] prepare_alloc_pages+0x21d/0x4a0 mm/page_alloc.c:4780 __alloc_pages_nodemask+0xbc/0x5e0 mm/page_alloc.c:4832 alloc_pages_vma+0x4dd/0xd10 mm/mempolicy.c:2255 shmem_alloc_page mm/shmem.c:1503 [inline] shmem_alloc_and_acct_page+0x40e/0xbe0 mm/shmem.c:1528 shmem_getpage_gfp+0x203e/0x2c60 mm/shmem.c:1824 shmem_getpage mm/shmem.c:154 [inline] shmem_write_begin+0xcd/0x1a0 mm/shmem.c:2460 generic_perform_write+0x23b/0x4e0 mm/filemap.c:3299 __generic_file_write_iter+0x22b/0x4e0 mm/filemap.c:3428 generic_file_write_iter+0x4a6/0x650 mm/filemap.c:3460 call_write_iter include/linux/fs.h:1917 [inline] new_sync_write fs/read_write.c:484 [inline] __vfs_write+0x52f/0x6e0 fs/read_write.c:497 vfs_write+0x274/0x580 fs/read_write.c:559 ksys_write+0x11b/0x220 fs/read_write.c:612 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 -> #0 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:2496 [inline] check_prevs_add kernel/locking/lockdep.c:2601 [inline] validate_chain+0x1b09/0x8920 kernel/locking/lockdep.c:3218 __lock_acquire+0x116c/0x2c30 kernel/locking/lockdep.c:4380 lock_acquire+0x169/0x480 kernel/locking/lockdep.c:4959 down_write+0x55/0x130 kernel/locking/rwsem.c:1531 inode_lock include/linux/fs.h:799 [inline] shmem_fallocate+0xef/0xdb0 mm/shmem.c:2708 ashmem_shrink_scan+0x367/0x4a0 drivers/staging/android/ashmem.c:490 do_shrink_slab+0x36f/0x5c0 mm/vmscan.c:518 shrink_slab+0x188/0x2b0 mm/vmscan.c:679 shrink_node_memcgs+0x2c1/0x5d0 mm/vmscan.c:2655 shrink_node+0xc91/0x1b30 mm/vmscan.c:2767 shrink_zones+0x27c/0x8d0 mm/vmscan.c:2970 do_try_to_free_pages+0x229/0xc20 mm/vmscan.c:3023 try_to_free_pages+0x318/0xb50 mm/vmscan.c:3262 __perform_reclaim mm/page_alloc.c:4223 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4244 [inline] __alloc_pages_slowpath+0xe0c/0x2070 mm/page_alloc.c:4650 __alloc_pages_nodemask+0x3c2/0x5e0 mm/page_alloc.c:4863 alloc_pages include/linux/gfp.h:545 [inline] alloc_mmu_pages arch/x86/kvm/mmu/mmu.c:5671 [inline] kvm_mmu_create+0x1f6/0x500 arch/x86/kvm/mmu/mmu.c:5704 kvm_arch_vcpu_create+0x102/0x960 arch/x86/kvm/x86.c:9438 kvm_vm_ioctl_create_vcpu arch/x86/kvm/../../../virt/kvm/kvm_main.c:3057 [inline] kvm_vm_ioctl+0xeeb/0x2680 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3617 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:771 [inline] __do_sys_ioctl fs/ioctl.c:780 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:778 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&sb->s_type->i_mutex_key#16); lock(fs_reclaim); lock(&sb->s_type->i_mutex_key#16); *** DEADLOCK *** 2 locks held by syz-executor.0/17080: #0: ffffffff89318810 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x30 mm/page_alloc.c:3838 #1: ffffffff89310730 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0xa8/0x2b0 mm/vmscan.c:669 stack backtrace: CPU: 0 PID: 17080 Comm: syz-executor.0 Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1e9/0x30e lib/dump_stack.c:118 print_circular_bug+0xc72/0xea0 kernel/locking/lockdep.c:1703 check_noncircular+0x1fb/0x3a0 kernel/locking/lockdep.c:1827 check_prev_add kernel/locking/lockdep.c:2496 [inline] check_prevs_add kernel/locking/lockdep.c:2601 [inline] validate_chain+0x1b09/0x8920 kernel/locking/lockdep.c:3218 __lock_acquire+0x116c/0x2c30 kernel/locking/lockdep.c:4380 lock_acquire+0x169/0x480 kernel/locking/lockdep.c:4959 down_write+0x55/0x130 kernel/locking/rwsem.c:1531 inode_lock include/linux/fs.h:799 [inline] shmem_fallocate+0xef/0xdb0 mm/shmem.c:2708 ashmem_shrink_scan+0x367/0x4a0 drivers/staging/android/ashmem.c:490 do_shrink_slab+0x36f/0x5c0 mm/vmscan.c:518 shrink_slab+0x188/0x2b0 mm/vmscan.c:679 shrink_node_memcgs+0x2c1/0x5d0 mm/vmscan.c:2655 shrink_node+0xc91/0x1b30 mm/vmscan.c:2767 shrink_zones+0x27c/0x8d0 mm/vmscan.c:2970 do_try_to_free_pages+0x229/0xc20 mm/vmscan.c:3023 try_to_free_pages+0x318/0xb50 mm/vmscan.c:3262 __perform_reclaim mm/page_alloc.c:4223 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4244 [inline] __alloc_pages_slowpath+0xe0c/0x2070 mm/page_alloc.c:4650 __alloc_pages_nodemask+0x3c2/0x5e0 mm/page_alloc.c:4863 alloc_pages include/linux/gfp.h:545 [inline] alloc_mmu_pages arch/x86/kvm/mmu/mmu.c:5671 [inline] kvm_mmu_create+0x1f6/0x500 arch/x86/kvm/mmu/mmu.c:5704 kvm_arch_vcpu_create+0x102/0x960 arch/x86/kvm/x86.c:9438 kvm_vm_ioctl_create_vcpu arch/x86/kvm/../../../virt/kvm/kvm_main.c:3057 [inline] kvm_vm_ioctl+0xeeb/0x2680 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3617 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:771 [inline] __do_sys_ioctl fs/ioctl.c:780 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:778 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45ca69 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f8373324c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004e7900 RCX: 000000000045ca69 RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000007 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000039c R14: 00000000004c637a R15: 00007f83733256d4