====================================================== WARNING: possible circular locking dependency detected 6.11.0-rc1-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.33/3458 is trying to acquire lock: ffff888102bf5918 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 but task is already holding lock: ffff88810934c400 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] ffff88810934c400 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}: down_write+0x29/0xb0 kernel/locking/rwsem.c:1579 inode_lock include/linux/fs.h:799 [inline] process_measurement+0x154/0x900 security/integrity/ima/ima_main.c:250 ima_file_mmap+0x74/0xe0 security/integrity/ima/ima_main.c:455 security_mmap_file+0x3a7/0x480 security/security.c:2977 __do_sys_remap_file_pages mm/mmap.c:3201 [inline] __se_sys_remap_file_pages+0x278/0x370 mm/mmap.c:3133 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5879 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5930 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 fault_in_readable+0x78/0xd0 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#12); lock(&mm->mmap_lock); lock(&sb->s_type->i_mutex_key#12); rlock(&mm->mmap_lock); *** DEADLOCK *** 3 locks held by syz.0.33/3458: #0: ffff888103375ec8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x71/0xa0 fs/file.c:1191 #1: ffff888104733410 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2876 [inline] #1: ffff888104733410 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x111/0x3d0 fs/read_write.c:586 #2: ffff88810934c400 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:799 [inline] #2: ffff88810934c400 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x2f/0x90 mm/shmem.c:3068 stack backtrace: CPU: 1 UID: 0 PID: 3458 Comm: syz.0.33 Not tainted 6.11.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xa3/0x100 lib/dump_stack.c:119 check_noncircular+0x119/0x140 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x122b/0x2530 kernel/locking/lockdep.c:5142 lock_acquire+0xeb/0x270 kernel/locking/lockdep.c:5759 down_read_killable+0x50/0x610 kernel/locking/rwsem.c:1549 mmap_read_lock_killable+0x13/0x50 include/linux/mmap_lock.h:153 get_mmap_lock_carefully mm/memory.c:5879 [inline] lock_mm_and_find_vma+0x11a/0x130 mm/memory.c:5930 do_user_addr_fault arch/x86/mm/fault.c:1361 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x1d3/0x6a0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:fault_in_readable+0x78/0xd0 mm/gup.c:2244 Code: 00 f0 ff ff eb 0a 4c 8d 87 ff 0f 00 00 48 89 f9 49 01 f0 49 81 e0 00 f0 ff ff 49 39 f8 72 4d 4c 39 c1 74 1a 48 89 ca 48 89 d1 <8a> 02 4c 89 c1 88 04 24 48 81 c2 00 10 00 00 4c 39 c2 75 e9 f3 0f RSP: 0018:ffffc90002183d5f EFLAGS: 00050287 RAX: 0400000000000000 RBX: 0000000000034000 RCX: 0000000021000000 RDX: 0000000021000000 RSI: 0000000000034000 RDI: 0000000020fcc040 RBP: 00000000008d7c85 R08: 0000000021001000 R09: ffffea0005c64a40 R10: 0000000000000008 R11: ffffffff81256410 R12: 0000000000fcc000 R13: ffff88810934c4d8 R14: 0000000000034000 R15: 0000000000fcc000 fault_in_iov_iter_readable+0x3c/0xd0 lib/iov_iter.c:94 generic_perform_write+0xaa/0x3d0 mm/filemap.c:4009 shmem_file_write_iter+0x67/0x90 mm/shmem.c:3078 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x342/0x3d0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x180 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa88cf7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa88ddc2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa88d135f80 RCX: 00007fa88cf7def9 RDX: 00000000018a3c85 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007fa88cff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fa88d135f80 R15: 00007fffc8674d78 ---------------- Code disassembly (best guess), 4 bytes skipped: 0: eb 0a jmp 0xc 2: 4c 8d 87 ff 0f 00 00 lea 0xfff(%rdi),%r8 9: 48 89 f9 mov %rdi,%rcx c: 49 01 f0 add %rsi,%r8 f: 49 81 e0 00 f0 ff ff and $0xfffffffffffff000,%r8 16: 49 39 f8 cmp %rdi,%r8 19: 72 4d jb 0x68 1b: 4c 39 c1 cmp %r8,%rcx 1e: 74 1a je 0x3a 20: 48 89 ca mov %rcx,%rdx 23: 48 89 d1 mov %rdx,%rcx * 26: 8a 02 mov (%rdx),%al <-- trapping instruction 28: 4c 89 c1 mov %r8,%rcx 2b: 88 04 24 mov %al,(%rsp) 2e: 48 81 c2 00 10 00 00 add $0x1000,%rdx 35: 4c 39 c2 cmp %r8,%rdx 38: 75 e9 jne 0x23 3a: f3 repz 3b: 0f .byte 0xf