======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc5-syzkaller #0 Not tainted
------------------------------------------------------
syz.3.68/3046 is trying to acquire lock:
ffff88810a3c5520 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock_killable+0x13/0x110 include/linux/mmap_lock.h:432

but task is already holding lock:
ffff88810878ad88 (vm_lock){++++}-{0:0}, at: get_next_vma+0xa6/0xe0 fs/proc/task_mmu.c:182

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (vm_lock){++++}-{0:0}:
       __vma_enter_locked+0x75/0xf0 mm/mmap_lock.c:63
       __vma_start_write+0x13/0x70 mm/mmap_lock.c:87
       vma_start_write include/linux/mmap_lock.h:267 [inline]
       vma_expand+0x8a/0x210 mm/vma.c:1131
       relocate_vma_down+0x27f/0x380 mm/vma_exec.c:58
       setup_arg_pages+0x307/0x490 fs/exec.c:690
       load_elf_binary+0x38c/0xd50 fs/binfmt_elf.c:1013
       search_binary_handler fs/exec.c:1670 [inline]
       exec_binprm fs/exec.c:1702 [inline]
       bprm_execve+0x38b/0x5e0 fs/exec.c:1754
       kernel_execve+0x1c1/0x210 fs/exec.c:1920
       try_to_run_init_process+0x9/0x40 init/main.c:1402
       kernel_init+0x96/0x120 init/main.c:1530
       ret_from_fork+0x152/0x240 arch/x86/kernel/process.c:148
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (&mm->mmap_lock){++++}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3168 [inline]
       check_prevs_add kernel/locking/lockdep.c:3287 [inline]
       validate_chain kernel/locking/lockdep.c:3911 [inline]
       __lock_acquire+0x12e6/0x2100 kernel/locking/lockdep.c:5240
       lock_acquire+0xe9/0x270 kernel/locking/lockdep.c:5871
       down_read_killable+0x37/0x120 kernel/locking/rwsem.c:1547
       mmap_read_lock_killable+0x13/0x110 include/linux/mmap_lock.h:432
       lock_vma_under_mmap_lock mm/mmap_lock.c:189 [inline]
       lock_next_vma+0x3af/0x600 mm/mmap_lock.c:264
       get_next_vma+0xa6/0xe0 fs/proc/task_mmu.c:182
       query_vma_find_by_addr fs/proc/task_mmu.c:512 [inline]
       query_matching_vma+0xf9/0x1c0 fs/proc/task_mmu.c:544
       do_procmap_query fs/proc/task_mmu.c:629 [inline]
       procfs_procmap_ioctl+0x282/0x6a0 fs/proc/task_mmu.c:747
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:907 [inline]
       __se_sys_ioctl+0x6c/0xc0 fs/ioctl.c:893
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(vm_lock);
                               lock(&mm->mmap_lock);
                               lock(vm_lock);
  rlock(&mm->mmap_lock);

 *** DEADLOCK ***

1 lock held by syz.3.68/3046:
 #0: ffff88810878ad88 (vm_lock){++++}-{0:0}, at: get_next_vma+0xa6/0xe0 fs/proc/task_mmu.c:182

stack backtrace:
CPU: 0 UID: 0 PID: 3046 Comm: syz.3.68 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0xad/0x110 lib/dump_stack.c:120
 print_circular_bug+0x29b/0x2b0 kernel/locking/lockdep.c:2046
 check_noncircular+0x10e/0x130 kernel/locking/lockdep.c:2178
 check_prev_add kernel/locking/lockdep.c:3168 [inline]
 check_prevs_add kernel/locking/lockdep.c:3287 [inline]
 validate_chain kernel/locking/lockdep.c:3911 [inline]
 __lock_acquire+0x12e6/0x2100 kernel/locking/lockdep.c:5240
 lock_acquire+0xe9/0x270 kernel/locking/lockdep.c:5871
 down_read_killable+0x37/0x120 kernel/locking/rwsem.c:1547
 mmap_read_lock_killable+0x13/0x110 include/linux/mmap_lock.h:432
 lock_vma_under_mmap_lock mm/mmap_lock.c:189 [inline]
 lock_next_vma+0x3af/0x600 mm/mmap_lock.c:264
 get_next_vma+0xa6/0xe0 fs/proc/task_mmu.c:182
 query_vma_find_by_addr fs/proc/task_mmu.c:512 [inline]
 query_matching_vma+0xf9/0x1c0 fs/proc/task_mmu.c:544
 do_procmap_query fs/proc/task_mmu.c:629 [inline]
 procfs_procmap_ioctl+0x282/0x6a0 fs/proc/task_mmu.c:747
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x6c/0xc0 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa463d9e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa46380f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa463fc5fa0 RCX: 00007fa463d9e929
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003
RBP: 00007fa463e20b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa463fc5fa0 R15: 00007fffd77369c8
 </TASK>