mmap: syz.0.15 (3422) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. ====================================================== WARNING: possible circular locking dependency detected 6.11.0-rc1-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.15/3422 is trying to acquire lock: ffff888103b20198 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] ffff888103b20198 (&mm->mmap_lock){++++}-{3:3}, at: upgrade_mmap_lock_carefully+0x45/0xa0 mm/memory.c:5903 but task is already holding lock: ffff88810432a650 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] ffff88810432a650 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}: down_write+0x29/0xb0 kernel/locking/rwsem.c:1579 inode_lock include/linux/fs.h:799 [inline] process_measurement+0x154/0x900 security/integrity/ima/ima_main.c:250 ima_file_mmap+0x74/0xe0 security/integrity/ima/ima_main.c:455 security_mmap_file+0x3a7/0x480 security/security.c:2977 __do_sys_remap_file_pages mm/mmap.c:3201 [inline] __se_sys_remap_file_pages+0x278/0x370 mm/mmap.c:3133 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_write_killable+0x33/0xf0 kernel/locking/rwsem.c:1590 mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] upgrade_mmap_lock_carefully+0x45/0xa0 mm/memory.c:5903 lock_mm_and_find_vma+0x79/0x130 mm/memory.c:5956 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 fault_in_readable+0x78/0xd0 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#12); lock(&mm->mmap_lock); lock(&sb->s_type->i_mutex_key#12); lock(&mm->mmap_lock); *** DEADLOCK *** 3 locks held by syz.0.15/3422: #0: ffff888103fab6c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x71/0xa0 fs/file.c:1191 #1: ffff888104b67410 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2876 [inline] #1: ffff888104b67410 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x111/0x3d0 fs/read_write.c:586 #2: ffff88810432a650 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] #2: ffff88810432a650 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 stack backtrace: CPU: 0 UID: 0 PID: 3422 Comm: syz.0.15 Not tainted 6.11.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xa3/0x100 lib/dump_stack.c:119 check_noncircular+0x119/0x140 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_write_killable+0x33/0xf0 kernel/locking/rwsem.c:1590 mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] upgrade_mmap_lock_carefully+0x45/0xa0 mm/memory.c:5903 lock_mm_and_find_vma+0x79/0x130 mm/memory.c:5956 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:fault_in_readable+0x78/0xd0 mm/gup.c:2244 Code: 00 f0 ff ff eb 0a 4c 8d 87 ff 0f 00 00 48 89 f9 49 01 f0 49 81 e0 00 f0 ff ff 49 39 f8 72 4d 4c 39 c1 74 1a 48 89 ca 48 89 d1 <8a> 02 4c 89 c1 88 04 24 48 81 c2 00 10 00 00 4c 39 c2 75 e9 f3 0f RSP: 0018:ffffc900023b3d5f EFLAGS: 00050287 RAX: 1000000000000023 RBX: 000000000000fecc RCX: 0000000020001000 RDX: 0000000020001000 RSI: 000000000000fecc RDI: 0000000020000100 RBP: 000000000000fecc R08: 0000000020010000 R09: ffff888104b67000 R10: 0000000000000003 R11: ffffffff81117fa0 R12: 0000000000000000 R13: ffff88810432a728 R14: 000000000000fecc R15: 0000000000000000 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f119fb7dff9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f11a0a42038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f119fd35f80 RCX: 00007f119fb7dff9 RDX: 000000000000fecc RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00007f119fbf0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f119fd35f80 R15: 00007fff336106e8 ---------------- Code disassembly (best guess), 4 bytes skipped: 0: eb 0a jmp 0xc 2: 4c 8d 87 ff 0f 00 00 lea 0xfff(%rdi),%r8 9: 48 89 f9 mov %rdi,%rcx c: 49 01 f0 add %rsi,%r8 f: 49 81 e0 00 f0 ff ff and $0xfffffffffffff000,%r8 16: 49 39 f8 cmp %rdi,%r8 19: 72 4d jb 0x68 1b: 4c 39 c1 cmp %r8,%rcx 1e: 74 1a je 0x3a 20: 48 89 ca mov %rcx,%rdx 23: 48 89 d1 mov %rdx,%rcx * 26: 8a 02 mov (%rdx),%al <-- trapping instruction 28: 4c 89 c1 mov %r8,%rcx 2b: 88 04 24 mov %al,(%rsp) 2e: 48 81 c2 00 10 00 00 add $0x1000,%rdx 35: 4c 39 c2 cmp %r8,%rdx 38: 75 e9 jne 0x23 3a: f3 repz 3b: 0f .byte 0xf