============================================
WARNING: possible recursive locking detected
5.10.0-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.3/21887 is trying to acquire lock:
ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: i_mmap_lock_write include/linux/fs.h:493 [inline]
ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: unmap_ref_private mm/hugetlb.c:4019 [inline]
ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: hugetlb_cow+0xf55/0x16c0 mm/hugetlb.c:4110

but task is already holding lock:
ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:508 [inline]
ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: hugetlb_fault+0x2c1/0x24f0 mm/hugetlb.c:4485

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hugetlbfs_i_mmap_rwsem_key);
  lock(&hugetlbfs_i_mmap_rwsem_key);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor.3/21887:
 #0: ffff88801d49cf58 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
 #0: ffff88801d49cf58 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x25f/0xc60 arch/x86/mm/fault.c:1334
 #1: ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:508 [inline]
 #1: ffff888142805698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: hugetlb_fault+0x2c1/0x24f0 mm/hugetlb.c:4485
 #2: ffff8881412d6728 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x433/0x24f0 mm/hugetlb.c:4499

stack backtrace:
CPU: 0 PID: 21887 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_deadlock_bug kernel/locking/lockdep.c:2761 [inline]
 check_deadlock kernel/locking/lockdep.c:2804 [inline]
 validate_chain kernel/locking/lockdep.c:3595 [inline]
 __lock_acquire.cold+0x115/0x3e6 kernel/locking/lockdep.c:4832
 lock_acquire kernel/locking/lockdep.c:5437 [inline]
 lock_acquire+0x29d/0x750 kernel/locking/lockdep.c:5402
 down_write+0x8d/0x150 kernel/locking/rwsem.c:1406
 i_mmap_lock_write include/linux/fs.h:493 [inline]
 unmap_ref_private mm/hugetlb.c:4019 [inline]
 hugetlb_cow+0xf55/0x16c0 mm/hugetlb.c:4110
 hugetlb_fault+0x1708/0x24f0 mm/hugetlb.c:4562
 handle_mm_fault+0x11b8/0x5760 mm/memory.c:4616
 do_user_addr_fault+0x458/0xc60 arch/x86/mm/fault.c:1393
 handle_page_fault arch/x86/mm/fault.c:1450 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1506
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580
RIP: 0033:0x400684
Code: 01 e9 c9 00 00 00 48 8b 44 24 10 48 0b 44 24 28 be 08 00 00 00 48 8b 14 24 75 17 48 8b 7c 24 20 e8 51 69 00 00 48 8b 4c 24 08 <48> 89 01 e9 9d 00 00 00 48 8b 44 24 08 48 8b 38 e8 37 69 00 00 8a
RSP: 002b:00000000016afbb0 EFLAGS: 00010202
RAX: 00000000200000c0 RBX: 00000000011a0f58 RCX: 0000000020000440
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 00000000200000c0
RBP: 00000000011a0f60 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000016afcb0 R11: 0000000000000246 R12: fffffffffffffffe
R13: 0000000000000000 R14: 0000000000000002 R15: 000000000119bf8c