====================================================== WARNING: possible circular locking dependency detected 5.15.182-syzkaller #0 Not tainted ------------------------------------------------------ syz.5.1134/8644 is trying to acquire lock: ffff0000e92067e0 (mapping.invalidate_lock#6){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline] ffff0000e92067e0 (mapping.invalidate_lock#6){.+.+}-{3:3}, at: filemap_fault+0x4b0/0xeac mm/filemap.c:3081 but task is already holding lock: ffff0000c8c8f418 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] ffff0000c8c8f418 (&mm->mmap_lock){++++}-{3:3}, at: do_page_fault+0x364/0xad4 arch/arm64/mm/fault.c:586 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&mm->mmap_lock){++++}-{3:3}: __might_fault+0xc8/0x128 mm/memory.c:5357 reiserfs_ioctl+0x144/0x4b4 fs/reiserfs/ioctl.c:96 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #1 (&sbi->lock){+.+.}-{3:3}: __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_get_block+0x1d0/0x34b0 fs/reiserfs/inode.c:688 do_mpage_readpage+0x7b0/0x1ab4 fs/mpage.c:231 mpage_readahead+0x2f8/0x774 fs/mpage.c:389 reiserfs_readahead+0x28/0x38 fs/reiserfs/inode.c:1165 read_pages+0x138/0x424 mm/readahead.c:130 page_cache_ra_unbounded+0x4fc/0x5dc mm/readahead.c:239 do_page_cache_ra mm/readahead.c:269 [inline] ondemand_readahead+0x63c/0xce0 mm/readahead.c:552 page_cache_async_ra+0x254/0x2f4 mm/readahead.c:609 page_cache_async_readahead include/linux/pagemap.h:856 [inline] do_async_mmap_readahead mm/filemap.c:3023 [inline] filemap_fault+0x448/0xeac mm/filemap.c:3079 __do_fault+0x120/0x5d0 mm/memory.c:3928 do_shared_fault mm/memory.c:4318 [inline] do_fault mm/memory.c:4396 [inline] handle_pte_fault mm/memory.c:4650 [inline] __handle_mm_fault mm/memory.c:4785 [inline] handle_mm_fault+0x15b8/0x2950 mm/memory.c:4883 __do_page_fault arch/arm64/mm/fault.c:505 [inline] do_page_fault+0x694/0xad4 arch/arm64/mm/fault.c:605 do_translation_fault+0xe0/0x130 arch/arm64/mm/fault.c:686 do_mem_abort+0x6c/0x1ac arch/arm64/mm/fault.c:819 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358 el1h_64_sync_handler+0x80/0xcc arch/arm64/kernel/entry-common.c:418 el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:522 __arch_copy_to_user+0x104/0x218 arch/arm64/lib/copy_template.S:135 copy_to_iter include/linux/uio.h:155 [inline] get_random_bytes_user+0x188/0x31c drivers/char/random.c:474 __do_sys_getrandom drivers/char/random.c:1242 [inline] __se_sys_getrandom drivers/char/random.c:1215 [inline] __arm64_sys_getrandom+0x180/0x24c drivers/char/random.c:1215 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #0 (mapping.invalidate_lock#6){.+.+}-{3:3}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012 lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623 down_read+0xc0/0x390 kernel/locking/rwsem.c:1498 filemap_invalidate_lock_shared include/linux/fs.h:842 [inline] filemap_fault+0x4b0/0xeac mm/filemap.c:3081 __do_fault+0x120/0x5d0 mm/memory.c:3928 do_shared_fault mm/memory.c:4318 [inline] do_fault mm/memory.c:4396 [inline] handle_pte_fault mm/memory.c:4650 [inline] __handle_mm_fault mm/memory.c:4785 [inline] handle_mm_fault+0x15b8/0x2950 mm/memory.c:4883 __do_page_fault arch/arm64/mm/fault.c:505 [inline] do_page_fault+0x694/0xad4 arch/arm64/mm/fault.c:605 do_translation_fault+0xe0/0x130 arch/arm64/mm/fault.c:686 do_mem_abort+0x6c/0x1ac arch/arm64/mm/fault.c:819 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358 el1h_64_sync_handler+0x80/0xcc arch/arm64/kernel/entry-common.c:418 el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:522 __arch_copy_to_user+0x104/0x218 arch/arm64/lib/copy_template.S:135 copy_to_iter include/linux/uio.h:155 [inline] get_random_bytes_user+0x188/0x31c drivers/char/random.c:474 __do_sys_getrandom drivers/char/random.c:1242 [inline] __se_sys_getrandom drivers/char/random.c:1215 [inline] __arm64_sys_getrandom+0x180/0x24c drivers/char/random.c:1215 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: mapping.invalidate_lock#6 --> &sbi->lock --> &mm->mmap_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&mm->mmap_lock); lock(&sbi->lock); lock(&mm->mmap_lock); lock(mapping.invalidate_lock#6); *** DEADLOCK *** 1 lock held by syz.5.1134/8644: #0: ffff0000c8c8f418 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff0000c8c8f418 (&mm->mmap_lock){++++}-{3:3}, at: do_page_fault+0x364/0xad4 arch/arm64/mm/fault.c:586 stack backtrace: CPU: 0 PID: 8644 Comm: syz.5.1134 Not tainted 5.15.182-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2011 check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012 lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623 down_read+0xc0/0x390 kernel/locking/rwsem.c:1498 filemap_invalidate_lock_shared include/linux/fs.h:842 [inline] filemap_fault+0x4b0/0xeac mm/filemap.c:3081 __do_fault+0x120/0x5d0 mm/memory.c:3928 do_shared_fault mm/memory.c:4318 [inline] do_fault mm/memory.c:4396 [inline] handle_pte_fault mm/memory.c:4650 [inline] __handle_mm_fault mm/memory.c:4785 [inline] handle_mm_fault+0x15b8/0x2950 mm/memory.c:4883 __do_page_fault arch/arm64/mm/fault.c:505 [inline] do_page_fault+0x694/0xad4 arch/arm64/mm/fault.c:605 do_translation_fault+0xe0/0x130 arch/arm64/mm/fault.c:686 do_mem_abort+0x6c/0x1ac arch/arm64/mm/fault.c:819 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358 el1h_64_sync_handler+0x80/0xcc arch/arm64/kernel/entry-common.c:418 el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:522 __arch_copy_to_user+0x104/0x218 arch/arm64/lib/copy_template.S:135 copy_to_iter include/linux/uio.h:155 [inline] get_random_bytes_user+0x188/0x31c drivers/char/random.c:474 __do_sys_getrandom drivers/char/random.c:1242 [inline] __se_sys_getrandom drivers/char/random.c:1215 [inline] __arm64_sys_getrandom+0x180/0x24c drivers/char/random.c:1215 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584