====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc1-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.29/4075 is trying to acquire lock: ffff88810c749bd8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 but task is already holding lock: ffff88810d8a0a78 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: inode_trylock include/linux/fs.h:811 [inline] ffff88810d8a0a78 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: ntfs_file_write_iter+0x81/0x1e0 fs/ntfs3/file.c:1099 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}: down_write+0x29/0xb0 kernel/locking/rwsem.c:1579 inode_lock include/linux/fs.h:791 [inline] ntfs_file_mmap+0x19c/0x1f0 fs/ntfs3/file.c:302 call_mmap include/linux/fs.h:2107 [inline] mmap_region+0x593/0xaa0 mm/mmap.c:2886 do_mmap+0x3e9/0x590 mm/mmap.c:1397 vm_mmap_pgoff+0xcd/0x1a0 mm/util.c:573 ksys_mmap_pgoff+0x182/0x200 mm/mmap.c:1443 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x11fe/0x2490 kernel/locking/lockdep.c:5137 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5754 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5724 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5775 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1a2/0x6f0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 fault_in_readable+0x3c/0xd0 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0x1d6/0x250 mm/filemap.c:4005 ntfs_file_write_iter+0x1ca/0x1e0 fs/ntfs3/file.c:1126 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x298/0x390 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#15); lock(&mm->mmap_lock); lock(&sb->s_type->i_mutex_key#15); rlock(&mm->mmap_lock); *** DEADLOCK *** 3 locks held by syz.0.29/4075: #0: ffff88810c2fe8c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x71/0xa0 fs/file.c:1191 #1: ffff888115780408 (sb_writers#12){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2854 [inline] #1: ffff888115780408 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0xdc/0x390 fs/read_write.c:586 #2: ffff88810d8a0a78 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: inode_trylock include/linux/fs.h:811 [inline] #2: ffff88810d8a0a78 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: ntfs_file_write_iter+0x81/0x1e0 fs/ntfs3/file.c:1099 stack backtrace: CPU: 1 PID: 4075 Comm: syz.0.29 Not tainted 6.10.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xa3/0x100 lib/dump_stack.c:114 check_noncircular+0x119/0x140 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x11fe/0x2490 kernel/locking/lockdep.c:5137 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5754 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5724 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5775 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1a2/0x6f0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:fault_in_readable+0x3c/0xd0 mm/gup.c:2334 Code: 00 00 00 48 89 f8 48 01 f0 0f 88 8d 00 00 00 48 39 f8 0f 82 84 00 00 00 0f 01 cb 0f ae e8 48 89 f8 48 c1 e0 34 74 1b 48 89 f9 <8a> 07 88 04 24 4c 8d 87 ff 0f 00 00 4c 89 c1 48 81 e1 00 f0 ff ff RSP: 0018:ffffc90002507d27 EFLAGS: 00050207 RAX: 4400000000000000 RBX: 000000000000000f RCX: 0000000020005440 RDX: 0000000000000000 RSI: 000000000000000f RDI: 0000000020005440 RBP: 0000000000000000 R08: 0000000020136274 R09: ffff888115780000 R10: ffff88811649a000 R11: 0000000000000000 R12: ffffc90002507e38 R13: 000000000000c8ab R14: 000000000000000f R15: ffffc90002507e60 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0x1d6/0x250 mm/filemap.c:4005 ntfs_file_write_iter+0x1ca/0x1e0 fs/ntfs3/file.c:1126 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x298/0x390 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa21f3773b9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa220063048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa21f506058 RCX: 00007fa21f3773b9 RDX: 000000000000000f RSI: 0000000020005440 RDI: 0000000000000004 RBP: 00007fa21f3e48e6 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fa21f506058 R15: 00007fff1be1a328 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 48 89 add %cl,-0x77(%rax) 5: f8 clc 6: 48 01 f0 add %rsi,%rax 9: 0f 88 8d 00 00 00 js 0x9c f: 48 39 f8 cmp %rdi,%rax 12: 0f 82 84 00 00 00 jb 0x9c 18: 0f 01 cb stac 1b: 0f ae e8 lfence 1e: 48 89 f8 mov %rdi,%rax 21: 48 c1 e0 34 shl $0x34,%rax 25: 74 1b je 0x42 27: 48 89 f9 mov %rdi,%rcx * 2a: 8a 07 mov (%rdi),%al <-- trapping instruction 2c: 88 04 24 mov %al,(%rsp) 2f: 4c 8d 87 ff 0f 00 00 lea 0xfff(%rdi),%r8 36: 4c 89 c1 mov %r8,%rcx 39: 48 81 e1 00 f0 ff ff and $0xfffffffffffff000,%rcx