====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc5-next-20241101-syzkaller #0 Not tainted ------------------------------------------------------ syz.5.5984/26580 is trying to acquire lock: ffff88803575bde0 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0xaa/0x120 mm/memory.c:6751 but task is already holding lock: ffff888143bf0900 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&q->debugfs_mutex){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 blk_mq_init_sched+0x3fa/0x830 block/blk-mq-sched.c:473 elevator_init_mq+0x1d8/0x2d0 block/elevator.c:605 add_disk_fwnode+0x10d/0xf80 block/genhd.c:413 sd_probe+0xba6/0x1100 drivers/scsi/sd.c:4024 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach_async_helper+0x22d/0x300 drivers/base/dd.c:987 async_run_entry_fn+0xa8/0x420 kernel/async.c:129 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #1 (&q->q_usage_counter(io)#66){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 bio_queue_enter block/blk.h:75 [inline] blk_mq_submit_bio+0x1510/0x2490 block/blk-mq.c:3069 __submit_bio+0x2c2/0x560 block/blk-core.c:629 __submit_bio_noacct_mq block/blk-core.c:710 [inline] submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739 swap_writepage_bdev_async mm/page_io.c:443 [inline] __swap_writepage+0x5fc/0x1400 mm/page_io.c:466 swap_writepage+0x8f4/0xf70 mm/page_io.c:281 pageout mm/vmscan.c:689 [inline] shrink_folio_list+0x3c0e/0x8cc0 mm/vmscan.c:1367 reclaim_folio_list+0x13c/0x600 mm/vmscan.c:2143 reclaim_pages+0x5b8/0x700 mm/vmscan.c:2180 madvise_cold_or_pageout_pte_range+0x295a/0x32a0 mm/madvise.c:558 walk_pmd_range mm/pagewalk.c:130 [inline] walk_pud_range mm/pagewalk.c:226 [inline] walk_p4d_range mm/pagewalk.c:264 [inline] walk_pgd_range+0xc3d/0x17e0 mm/pagewalk.c:305 __walk_page_range+0x15f/0x700 mm/pagewalk.c:412 walk_page_range_mm+0x58f/0x7c0 mm/pagewalk.c:505 madvise_pageout_page_range mm/madvise.c:617 [inline] madvise_pageout mm/madvise.c:644 [inline] madvise_vma_behavior mm/madvise.c:1261 [inline] madvise_walk_vmas mm/madvise.c:1497 [inline] do_madvise+0x392b/0x4d80 mm/madvise.c:1684 __do_sys_madvise mm/madvise.c:1700 [inline] __se_sys_madvise mm/madvise.c:1698 [inline] __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:1698 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &mm->mmap_lock --> &q->q_usage_counter(io)#66 --> &q->debugfs_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->debugfs_mutex); lock(&q->q_usage_counter(io)#66); lock(&q->debugfs_mutex); rlock(&mm->mmap_lock); *** DEADLOCK *** 1 lock held by syz.5.5984/26580: #0: ffff888143bf0900 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 stack backtrace: CPU: 0 UID: 0 PID: 26580 Comm: syz.5.5984 Not tainted 6.12.0-rc5-next-20241101-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f61f9d7e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f61f81f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f61f9f35f80 RCX: 00007f61f9d7e719 RDX: 0000000020001100 RSI: 00000000c0481273 RDI: 0000000000000003 RBP: 00007f61f9df132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f61f9f35f80 R15: 00007ffd20dab478