====================================================== WARNING: possible circular locking dependency detected 6.11.0-rc1-syzkaller #0 Not tainted ------------------------------------------------------ syz.3.225/4710 is trying to acquire lock: ffff888102eac798 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 but task is already holding lock: ffff888107ffac40 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] ffff888107ffac40 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}: down_write+0x29/0xb0 kernel/locking/rwsem.c:1579 inode_lock include/linux/fs.h:799 [inline] process_measurement+0x154/0x900 security/integrity/ima/ima_main.c:250 ima_file_mmap+0x74/0xe0 security/integrity/ima/ima_main.c:455 security_mmap_file+0x3a7/0x480 security/security.c:2977 __do_sys_remap_file_pages mm/mmap.c:3201 [inline] __se_sys_remap_file_pages+0x278/0x370 mm/mmap.c:3133 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5879 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5930 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 fault_in_readable+0x3c/0xd0 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#12); lock(&mm->mmap_lock); lock(&sb->s_type->i_mutex_key#12); rlock(&mm->mmap_lock); *** DEADLOCK *** 3 locks held by syz.3.225/4710: #0: ffff8881023668c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x71/0xa0 fs/file.c:1191 #1: ffff8881023cf410 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2876 [inline] #1: ffff8881023cf410 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x111/0x3d0 fs/read_write.c:586 #2: ffff888107ffac40 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] #2: ffff888107ffac40 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 stack backtrace: CPU: 1 UID: 0 PID: 4710 Comm: syz.3.225 Not tainted 6.11.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xa3/0x100 lib/dump_stack.c:119 check_noncircular+0x119/0x140 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5879 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5930 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:fault_in_readable+0x3c/0xd0 mm/gup.c:2237 Code: 00 00 00 48 89 f8 48 01 f0 0f 88 8d 00 00 00 48 39 f8 0f 82 84 00 00 00 0f 01 cb 0f ae e8 48 89 f8 48 c1 e0 34 74 1b 48 89 f9 <8a> 07 88 04 24 4c 8d 87 ff 0f 00 00 4c 89 c1 48 81 e1 00 f0 ff ff RSP: 0018:ffffc90003507d5f EFLAGS: 00050207 RAX: 2400000000000000 RBX: 0000000000069000 RCX: 0000000020197240 RDX: 0000000000000001 RSI: 0000000000069000 RDI: 0000000020197240 RBP: 0000000001ef724b R08: 0000000000000000 R09: 0000000000000000 R10: ffff88816020d000 R11: ffffffff81256410 R12: 0000000000197000 R13: ffff888107ffad18 R14: 0000000000069000 R15: 0000000000197000 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4d3b97dff9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4d3c6a2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f4d3bb36058 RCX: 00007f4d3b97dff9 RDX: 000000000208e24b RSI: 0000000020000240 RDI: 0000000000000003 RBP: 00007f4d3b9f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4d3bb36058 R15: 00007ffe5a9561c8 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 48 89 add %cl,-0x77(%rax) 5: f8 clc 6: 48 01 f0 add %rsi,%rax 9: 0f 88 8d 00 00 00 js 0x9c f: 48 39 f8 cmp %rdi,%rax 12: 0f 82 84 00 00 00 jb 0x9c 18: 0f 01 cb stac 1b: 0f ae e8 lfence 1e: 48 89 f8 mov %rdi,%rax 21: 48 c1 e0 34 shl $0x34,%rax 25: 74 1b je 0x42 27: 48 89 f9 mov %rdi,%rcx * 2a: 8a 07 mov (%rdi),%al <-- trapping instruction 2c: 88 04 24 mov %al,(%rsp) 2f: 4c 8d 87 ff 0f 00 00 lea 0xfff(%rdi),%r8 36: 4c 89 c1 mov %r8,%rcx 39: 48 81 e1 00 f0 ff ff and $0xfffffffffffff000,%rcx