------------[ cut here ]------------
WARNING: CPU: 1 PID: 11829 at mm/util.c:522 __vm_enough_memory+0x38b/0x470 mm/util.c:520
memory commitment underflow
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 11829 Comm: syz-executor5 Not tainted 4.9.80-g20c8a00 #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cf0bfa30 ffffffff81d94b69 ffffffff83a47c40 ffff8801cf0bfb08
 ffffffff83aac800 ffffffff81498f8b 0000000000000009 ffff8801cf0bfaf8
 ffffffff8142f541 0000000041b58ab3 ffffffff8418ab20 ffffffff8142f385
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8142f541>] panic+0x1bc/0x3a8 kernel/panic.c:179
 [<ffffffff81131174>] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [<ffffffff81131254>] warn_slowpath_fmt+0xc4/0x110 kernel/panic.c:565
 [<ffffffff81498f8b>] __vm_enough_memory+0x38b/0x470 mm/util.c:520
 [<ffffffff81bd0a90>] security_vm_enough_memory_mm+0x90/0xb0 security/security.c:238
 [<ffffffff814e750b>] mmap_region+0x93b/0xfd0 mm/mmap.c:1644
 [<ffffffff814e811b>] do_mmap+0x57b/0xbe0 mm/mmap.c:1473
 [<ffffffff8149885b>] do_mmap_pgoff include/linux/mm.h:2019 [inline]
 [<ffffffff8149885b>] vm_mmap_pgoff+0x16b/0x1b0 mm/util.c:305
 [<ffffffff814e21b0>] SYSC_mmap_pgoff mm/mmap.c:1523 [inline]
 [<ffffffff814e21b0>] SyS_mmap_pgoff+0xd0/0x560 mm/mmap.c:1481
 [<ffffffff8105f306>] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
 [<ffffffff8105f306>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
 [<ffffffff838b34ee>] entry_SYSCALL_64_fastpath+0x29/0xe8
======================================================
[ INFO: possible circular locking dependency detected ]
4.9.80-g20c8a00 #30 Not tainted
-------------------------------------------------------
syz-executor7/11864 is trying to acquire lock:
 (&sb->s_type->i_mutex_key#10){++++++}, at: [<ffffffff8148454f>] inode_lock include/linux/fs.h:746 [inline]
 (&sb->s_type->i_mutex_key#10){++++++}, at: [<ffffffff8148454f>] shmem_file_llseek+0xef/0x240 mm/shmem.c:2403
but task is already holding lock:
 (ashmem_mutex){+.+.+.}, at: [<ffffffff82d49446>] ashmem_llseek+0x56/0x1f0 drivers/staging/android/ashmem.c:343
which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
       __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       mutex_lock_nested+0xbb/0x870 kernel/locking/mutex.c:621
       ashmem_mmap+0x53/0x400 drivers/staging/android/ashmem.c:379
       mmap_region+0x7dd/0xfd0 mm/mmap.c:1694
       do_mmap+0x57b/0xbe0 mm/mmap.c:1473
       do_mmap_pgoff include/linux/mm.h:2019 [inline]
       vm_mmap_pgoff+0x16b/0x1b0 mm/util.c:305
       SYSC_mmap_pgoff mm/mmap.c:1523 [inline]
       SyS_mmap_pgoff+0x33f/0x560 mm/mmap.c:1481
       SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
       SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
       entry_SYSCALL_64_fastpath+0x29/0xe8

       lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
       __might_fault+0x14a/0x1d0 mm/memory.c:3994
       copy_to_user arch/x86/include/asm/uaccess.h:718 [inline]
       filldir+0x1aa/0x340 fs/readdir.c:195
       dir_emit_dot include/linux/fs.h:3203 [inline]
       dir_emit_dots include/linux/fs.h:3214 [inline]
       dcache_readdir+0x12d/0x5e0 fs/libfs.c:191
       iterate_dir+0x4a6/0x5d0 fs/readdir.c:50
       SYSC_getdents fs/readdir.c:230 [inline]
       SyS_getdents+0x14a/0x2a0 fs/readdir.c:211
       entry_SYSCALL_64_fastpath+0x29/0xe8

       check_prev_add kernel/locking/lockdep.c:1828 [inline]
       check_prevs_add kernel/locking/lockdep.c:1938 [inline]
       validate_chain kernel/locking/lockdep.c:2265 [inline]
       __lock_acquire+0x2bf9/0x3640 kernel/locking/lockdep.c:3345
       lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
       down_write+0x41/0xa0 kernel/locking/rwsem.c:52
       inode_lock include/linux/fs.h:746 [inline]
       shmem_file_llseek+0xef/0x240 mm/shmem.c:2403
       vfs_llseek+0xa2/0xd0 fs/read_write.c:301
       ashmem_llseek+0xe7/0x1f0 drivers/staging/android/ashmem.c:355
       vfs_llseek fs/read_write.c:301 [inline]
       SYSC_lseek fs/read_write.c:314 [inline]
       SyS_lseek+0xeb/0x170 fs/read_write.c:305
       entry_SYSCALL_64_fastpath+0x29/0xe8

other info that might help us debug this:

Chain exists of:
 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(ashmem_mutex);
                               lock(&mm->mmap_sem);
                               lock(ashmem_mutex);
  lock(&sb->s_type->i_mutex_key#10);

 *** DEADLOCK ***

1 lock held by syz-executor7/11864:
 #0:  (ashmem_mutex){+.+.+.}, at: [<ffffffff82d49446>] ashmem_llseek+0x56/0x1f0 drivers/staging/android/ashmem.c:343

stack backtrace:
CPU: 0 PID: 11864 Comm: syz-executor7 Not tainted 4.9.80-g20c8a00 #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cdbd7b98 ffffffff81d94b69 ffffffff853a0f00 ffffffff853aada0
 ffffffff853c1a20 ffff8801cd3aa0d8 ffff8801cd3a9800 ffff8801cdbd7be0
 ffffffff81238641 ffff8801cd3aa0d8 00000000cd3aa0b0 ffff8801cd3aa0d8
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81238641>] print_circular_bug+0x271/0x310 kernel/locking/lockdep.c:1202
 [<ffffffff8123ea79>] check_prev_add kernel/locking/lockdep.c:1828 [inline]
 [<ffffffff8123ea79>] check_prevs_add kernel/locking/lockdep.c:1938 [inline]
 [<ffffffff8123ea79>] validate_chain kernel/locking/lockdep.c:2265 [inline]
 [<ffffffff8123ea79>] __lock_acquire+0x2bf9/0x3640 kernel/locking/lockdep.c:3345
 [<ffffffff8123fefe>] lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
 [<ffffffff838acce1>] down_write+0x41/0xa0 kernel/locking/rwsem.c:52
 [<ffffffff8148454f>] inode_lock include/linux/fs.h:746 [inline]
 [<ffffffff8148454f>] shmem_file_llseek+0xef/0x240 mm/shmem.c:2403
 [<ffffffff8156bb42>] vfs_llseek+0xa2/0xd0 fs/read_write.c:301
 [<ffffffff82d494d7>] ashmem_llseek+0xe7/0x1f0 drivers/staging/android/ashmem.c:355
 [<ffffffff8156f5ab>] vfs_llseek fs/read_write.c:301 [inline]
 [<ffffffff8156f5ab>] SYSC_lseek fs/read_write.c:314 [inline]
 [<ffffffff8156f5ab>] SyS_lseek+0xeb/0x170 fs/read_write.c:305
 [<ffffffff838b34ee>] entry_SYSCALL_64_fastpath+0x29/0xe8
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..