======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc3-syzkaller-g573067a5a685 #0 Not tainted
------------------------------------------------------
syz.4.223/7666 is trying to acquire lock:
ffff0000d9570128 (bcachefs_btree){+.+.}-{0:0}, at: trans_set_locked+0x5c/0x1a4 fs/bcachefs/btree_locking.h:193

but task is already holding lock:
ffff0000dd2ba868 (mapping.invalidate_lock#8){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
ffff0000dd2ba868 (mapping.invalidate_lock#8){.+.+}-{4:4}, at: page_cache_ra_order+0x354/0xa58 mm/readahead.c:488

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #7 (mapping.invalidate_lock#8){.+.+}-{4:4}:
       down_read+0x58/0x2fc kernel/locking/rwsem.c:1524
       filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
       filemap_fault+0x5c0/0x1310 mm/filemap.c:3332
       bch2_page_fault+0x34c/0x808 fs/bcachefs/fs-io-pagecache.c:594
       __do_fault+0x11c/0x374 mm/memory.c:4907
       do_shared_fault mm/memory.c:5386 [inline]
       do_fault mm/memory.c:5460 [inline]
       do_pte_missing mm/memory.c:3979 [inline]
       handle_pte_fault+0x1348/0x5890 mm/memory.c:5801
       __handle_mm_fault mm/memory.c:5944 [inline]
       handle_mm_fault+0xf0c/0x17b0 mm/memory.c:6112
       do_page_fault+0x404/0x10a8 arch/arm64/mm/fault.c:647
       do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:783
       do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:919
       el0_da+0x60/0x178 arch/arm64/kernel/entry-common.c:604
       el0t_64_sync_handler+0xcc/0x108 arch/arm64/kernel/entry-common.c:765
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

-> #6 (&vma->vm_lock->lock){++++}-{4:4}:
       down_write+0x50/0xc0 kernel/locking/rwsem.c:1577
       vma_start_write include/linux/mm.h:769 [inline]
       vma_link+0x248/0x49c mm/vma.c:1691
       insert_vm_struct+0x284/0x378 mm/mmap.c:1740
       __bprm_mm_init fs/exec.c:289 [inline]
       bprm_mm_init fs/exec.c:393 [inline]
       alloc_bprm+0x4e8/0x940 fs/exec.c:1544
       kernel_execve+0xa4/0x820 fs/exec.c:1974
       run_init_process+0x1bc/0x1ec init/main.c:1387
       try_to_run_init_process init/main.c:1394 [inline]
       kernel_init+0xdc/0x2a0 init/main.c:1522
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

-> #5 (&mm->mmap_lock){++++}-{4:4}:
       __might_fault+0xc4/0x124 mm/memory.c:6751
       drm_mode_get_lease_ioctl+0x318/0x63c drivers/gpu/drm/drm_lease.c:673
       drm_ioctl_kernel+0x26c/0x368 drivers/gpu/drm/drm_ioctl.c:796
       drm_ioctl+0x624/0xb14 drivers/gpu/drm/drm_ioctl.c:893
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl fs/ioctl.c:892 [inline]
       __arm64_sys_ioctl+0x14c/0x1cc fs/ioctl.c:892
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
       do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
       el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
       el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

-> #4 (&dev->mode_config.idr_mutex){+.+.}-{4:4}:
       __mutex_lock_common+0x218/0x28f4 kernel/locking/mutex.c:585
       __mutex_lock kernel/locking/mutex.c:735 [inline]
       mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:787
       __drm_mode_object_add+0xb8/0x204 drivers/gpu/drm/drm_mode_object.c:47
       drm_framebuffer_init+0x108/0x250 drivers/gpu/drm/drm_framebuffer.c:875
       drm_gem_fb_init drivers/gpu/drm/drm_gem_framebuffer_helper.c:82 [inline]
       drm_gem_fb_init_with_funcs+0x9bc/0xd64 drivers/gpu/drm/drm_gem_framebuffer_helper.c:202
       drm_gem_fb_create_with_funcs drivers/gpu/drm/drm_gem_framebuffer_helper.c:245 [inline]
       drm_gem_fb_create+0x84/0xd4 drivers/gpu/drm/drm_gem_framebuffer_helper.c:286
       drm_internal_framebuffer_create+0x100c/0x1408 drivers/gpu/drm/drm_framebuffer.c:304
       drm_mode_addfb2+0xb4/0x2a8 drivers/gpu/drm/drm_framebuffer.c:338
       drm_client_buffer_addfb drivers/gpu/drm/drm_client.c:386 [inline]
       drm_client_framebuffer_create+0x38c/0x6cc drivers/gpu/drm/drm_client.c:428
       drm_fbdev_shmem_driver_fbdev_probe+0x1a8/0x744 drivers/gpu/drm/drm_fbdev_shmem.c:151
       __drm_fb_helper_initial_config_and_unlock+0x1280/0x1910 drivers/gpu/drm/drm_fb_helper.c:1819
       drm_fb_helper_initial_config+0x48/0x64 drivers/gpu/drm/drm_fb_helper.c:1906
       drm_fbdev_client_hotplug+0x158/0x22c drivers/gpu/drm/drm_fbdev_client.c:51
       drm_client_register+0x144/0x1e0 drivers/gpu/drm/drm_client.c:140
       drm_fbdev_client_setup+0x1a4/0x39c drivers/gpu/drm/drm_fbdev_client.c:158
       drm_client_setup+0x28/0x9c drivers/gpu/drm/drm_client_setup.c:29
       vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
       vkms_init+0x4f0/0x600 drivers/gpu/drm/vkms/vkms_drv.c:256
       do_one_initcall+0x254/0x9f8 init/main.c:1266
       do_initcall_level+0x154/0x214 init/main.c:1328
       do_initcalls+0x58/0xac init/main.c:1344
       do_basic_setup+0x8c/0xa0 init/main.c:1363
       kernel_init_freeable+0x324/0x478 init/main.c:1577
       kernel_init+0x24/0x2a0 init/main.c:1466
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

-> #3 (&helper->lock){+.+.}-{4:4}:
       __mutex_lock_common+0x218/0x28f4 kernel/locking/mutex.c:585
       __mutex_lock kernel/locking/mutex.c:735 [inline]
       mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:787
       __drm_fb_helper_restore_fbdev_mode_unlocked+0xb4/0x178 drivers/gpu/drm/drm_fb_helper.c:228
       drm_fb_helper_set_par+0xc4/0x110 drivers/gpu/drm/drm_fb_helper.c:1351
       fbcon_init+0xf34/0x1eb8 drivers/video/fbdev/core/fbcon.c:1113
       visual_init+0x27c/0x548 drivers/tty/vt/vt.c:1011
       do_bind_con_driver+0x7dc/0xe04 drivers/tty/vt/vt.c:3833
       do_take_over_console+0x4ac/0x5f0 drivers/tty/vt/vt.c:4399
       do_fbcon_takeover+0x158/0x260 drivers/video/fbdev/core/fbcon.c:549
       do_fb_registered drivers/video/fbdev/core/fbcon.c:2988 [inline]
       fbcon_fb_registered+0x370/0x4ec drivers/video/fbdev/core/fbcon.c:3008
       do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
       register_framebuffer+0x470/0x610 drivers/video/fbdev/core/fbmem.c:515
       __drm_fb_helper_initial_config_and_unlock+0x137c/0x1910 drivers/gpu/drm/drm_fb_helper.c:1841
       drm_fb_helper_initial_config+0x48/0x64 drivers/gpu/drm/drm_fb_helper.c:1906
       drm_fbdev_client_hotplug+0x158/0x22c drivers/gpu/drm/drm_fbdev_client.c:51
       drm_client_register+0x144/0x1e0 drivers/gpu/drm/drm_client.c:140
       drm_fbdev_client_setup+0x1a4/0x39c drivers/gpu/drm/drm_fbdev_client.c:158
       drm_client_setup+0x28/0x9c drivers/gpu/drm/drm_client_setup.c:29
       vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
       vkms_init+0x4f0/0x600 drivers/gpu/drm/vkms/vkms_drv.c:256
       do_one_initcall+0x254/0x9f8 init/main.c:1266
       do_initcall_level+0x154/0x214 init/main.c:1328
       do_initcalls+0x58/0xac init/main.c:1344
       do_basic_setup+0x8c/0xa0 init/main.c:1363
       kernel_init_freeable+0x324/0x478 init/main.c:1577
       kernel_init+0x24/0x2a0 init/main.c:1466
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

-> #2 (console_lock){+.+.}-{0:0}:
       console_lock+0x19c/0x1f4 kernel/printk/printk.c:2833
       __bch2_print_string_as_lines fs/bcachefs/util.c:267 [inline]
       bch2_print_string_as_lines+0x2c/0xd4 fs/bcachefs/util.c:286
       __bch2_fsck_err+0x1864/0x2544 fs/bcachefs/error.c:411
       bch2_bucket_ref_update+0x720/0xfac fs/bcachefs/buckets.c:469
       __mark_pointer fs/bcachefs/buckets.c:551 [inline]
       bch2_trigger_pointer fs/bcachefs/buckets.c:590 [inline]
       __trigger_extent+0x129c/0x4720 fs/bcachefs/buckets.c:740
       bch2_trigger_extent+0x474/0x814 fs/bcachefs/buckets.c:869
       bch2_key_trigger fs/bcachefs/bkey_methods.h:87 [inline]
       run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:507 [inline]
       run_btree_triggers+0x7d8/0xb60 fs/bcachefs/btree_trans_commit.c:540
       bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:572 [inline]
       __bch2_trans_commit+0x298/0x6604 fs/bcachefs/btree_trans_commit.c:1057
       bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
       bch2_extent_update+0x3d0/0x9b4 fs/bcachefs/io_write.c:325
       bch2_write_index_default fs/bcachefs/io_write.c:373 [inline]
       __bch2_write_index+0x6b0/0x1320 fs/bcachefs/io_write.c:526
       bch2_write_point_do_index_updates+0x288/0x560 fs/bcachefs/io_write.c:635
       process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
       process_scheduled_works kernel/workqueue.c:3310 [inline]
       worker_thread+0x97c/0xeec kernel/workqueue.c:3391
       kthread+0x288/0x310 kernel/kthread.c:389
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

-> #1 (&c->fsck_error_msgs_lock){+.+.}-{4:4}:
       __mutex_lock_common+0x218/0x28f4 kernel/locking/mutex.c:585
       __mutex_lock kernel/locking/mutex.c:735 [inline]
       mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:787
       __bch2_fsck_err+0x344/0x2544 fs/bcachefs/error.c:282
       bch2_bucket_ref_update+0x720/0xfac fs/bcachefs/buckets.c:469
       __mark_pointer fs/bcachefs/buckets.c:551 [inline]
       bch2_trigger_pointer fs/bcachefs/buckets.c:590 [inline]
       __trigger_extent+0x129c/0x4720 fs/bcachefs/buckets.c:740
       bch2_trigger_extent+0x474/0x814 fs/bcachefs/buckets.c:869
       bch2_key_trigger fs/bcachefs/bkey_methods.h:87 [inline]
       run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:507 [inline]
       run_btree_triggers+0x7d8/0xb60 fs/bcachefs/btree_trans_commit.c:540
       bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:572 [inline]
       __bch2_trans_commit+0x298/0x6604 fs/bcachefs/btree_trans_commit.c:1057
       bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
       bch2_extent_update+0x3d0/0x9b4 fs/bcachefs/io_write.c:325
       bch2_write_index_default fs/bcachefs/io_write.c:373 [inline]
       __bch2_write_index+0x6b0/0x1320 fs/bcachefs/io_write.c:526
       bch2_write_point_do_index_updates+0x288/0x560 fs/bcachefs/io_write.c:635
       process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
       process_scheduled_works kernel/workqueue.c:3310 [inline]
       worker_thread+0x97c/0xeec kernel/workqueue.c:3391
       kthread+0x288/0x310 kernel/kthread.c:389
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

-> #0 (bcachefs_btree){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain kernel/locking/lockdep.c:3904 [inline]
       __lock_acquire+0x34f0/0x7904 kernel/locking/lockdep.c:5226
       lock_acquire+0x23c/0x724 kernel/locking/lockdep.c:5849
       trans_set_locked+0x88/0x1a4 fs/bcachefs/btree_locking.h:194
       bch2_trans_begin+0x700/0x950 fs/bcachefs/btree_iter.c:3125
       bchfs_read+0x1c4/0x1b38 fs/bcachefs/fs-io-buffered.c:161
       bch2_readahead+0xad8/0xea8 fs/bcachefs/fs-io-buffered.c:277
       read_pages+0x158/0x688 mm/readahead.c:160
       page_cache_ra_order+0x7ec/0xa58 mm/readahead.c:512
       do_sync_mmap_readahead+0x39c/0x818
       filemap_fault+0x654/0x1310 mm/filemap.c:3344
       bch2_page_fault+0x34c/0x808 fs/bcachefs/fs-io-pagecache.c:594
       __do_fault+0x11c/0x374 mm/memory.c:4907
       do_read_fault mm/memory.c:5322 [inline]
       do_fault mm/memory.c:5456 [inline]
       do_pte_missing mm/memory.c:3979 [inline]
       handle_pte_fault+0x2e68/0x5890 mm/memory.c:5801
       __handle_mm_fault mm/memory.c:5944 [inline]
       handle_mm_fault+0xf0c/0x17b0 mm/memory.c:6112
       faultin_page mm/gup.c:1196 [inline]
       __get_user_pages+0x15e4/0x3134 mm/gup.c:1494
       populate_vma_page_range+0x220/0x2f0 mm/gup.c:1932
       __mm_populate+0x240/0x3d8 mm/gup.c:2035
       mm_populate include/linux/mm.h:3386 [inline]
       vm_mmap_pgoff+0x284/0x38c mm/util.c:585
       ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:542
       __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
       __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
       __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
       do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
       el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
       el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

other info that might help us debug this:

Chain exists of:
  bcachefs_btree --> &vma->vm_lock->lock --> mapping.invalidate_lock#8

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(mapping.invalidate_lock#8);
                               lock(&vma->vm_lock->lock);
                               lock(mapping.invalidate_lock#8);
  lock(bcachefs_btree);

 *** DEADLOCK ***

1 lock held by syz.4.223/7666:
 #0: ffff0000dd2ba868 (mapping.invalidate_lock#8){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
 #0: ffff0000dd2ba868 (mapping.invalidate_lock#8){.+.+}-{4:4}, at: page_cache_ra_order+0x354/0xa58 mm/readahead.c:488

stack backtrace:
CPU: 1 UID: 0 PID: 7666 Comm: syz.4.223 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_circular_bug+0x154/0x1c0 kernel/locking/lockdep.c:2074
 check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain kernel/locking/lockdep.c:3904 [inline]
 __lock_acquire+0x34f0/0x7904 kernel/locking/lockdep.c:5226
 lock_acquire+0x23c/0x724 kernel/locking/lockdep.c:5849
 trans_set_locked+0x88/0x1a4 fs/bcachefs/btree_locking.h:194
 bch2_trans_begin+0x700/0x950 fs/bcachefs/btree_iter.c:3125
 bchfs_read+0x1c4/0x1b38 fs/bcachefs/fs-io-buffered.c:161
 bch2_readahead+0xad8/0xea8 fs/bcachefs/fs-io-buffered.c:277
 read_pages+0x158/0x688 mm/readahead.c:160
 page_cache_ra_order+0x7ec/0xa58 mm/readahead.c:512
 do_sync_mmap_readahead+0x39c/0x818
 filemap_fault+0x654/0x1310 mm/filemap.c:3344
 bch2_page_fault+0x34c/0x808 fs/bcachefs/fs-io-pagecache.c:594
 __do_fault+0x11c/0x374 mm/memory.c:4907
 do_read_fault mm/memory.c:5322 [inline]
 do_fault mm/memory.c:5456 [inline]
 do_pte_missing mm/memory.c:3979 [inline]
 handle_pte_fault+0x2e68/0x5890 mm/memory.c:5801
 __handle_mm_fault mm/memory.c:5944 [inline]
 handle_mm_fault+0xf0c/0x17b0 mm/memory.c:6112
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x15e4/0x3134 mm/gup.c:1494
 populate_vma_page_range+0x220/0x2f0 mm/gup.c:1932
 __mm_populate+0x240/0x3d8 mm/gup.c:2035
 mm_populate include/linux/mm.h:3386 [inline]
 vm_mmap_pgoff+0x284/0x38c mm/util.c:585
 ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:542
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600