======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
------------------------------------------------------
syz.1.185/7400 is trying to acquire lock:
ffff0000ef16f680 (&ni->ni_lock/4){+.+.}-{3:3}, at: ni_lock fs/ntfs3/ntfs_fs.h:1110 [inline]
ffff0000ef16f680 (&ni->ni_lock/4){+.+.}-{3:3}, at: ntfs_read_folio+0xa8/0x1c0 fs/ntfs3/inode.c:718
but task is already holding lock:
ffff0000ef16fab8 (mapping.invalidate_lock#7){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:855 [inline]
ffff0000ef16fab8 (mapping.invalidate_lock#7){.+.+}-{3:3}, at: filemap_fault+0x704/0x10a0 mm/filemap.c:3321
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (mapping.invalidate_lock#7){.+.+}-{3:3}:
down_read+0x58/0x2fc kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:855 [inline]
filemap_fault+0x528/0x10a0 mm/filemap.c:3302
__do_fault+0x11c/0x374 mm/memory.c:4655
do_shared_fault mm/memory.c:5121 [inline]
do_fault mm/memory.c:5195 [inline]
do_pte_missing mm/memory.c:3947 [inline]
handle_pte_fault+0x111c/0x56f4 mm/memory.c:5521
__handle_mm_fault mm/memory.c:5664 [inline]
handle_mm_fault+0xee8/0x1784 mm/memory.c:5832
do_page_fault+0x3cc/0xfa8 arch/arm64/mm/fault.c:607
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:743
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:879
el0_da+0x60/0x178 arch/arm64/kernel/entry-common.c:580
el0t_64_sync_handler+0xcc/0xfc arch/arm64/kernel/entry-common.c:733
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
-> #2 (&vma->vm_lock->lock){++++}-{3:3}:
down_write+0x50/0xc0 kernel/locking/rwsem.c:1579
vma_start_write include/linux/mm.h:751 [inline]
vma_link+0x238/0x484 mm/mmap.c:457
insert_vm_struct+0x284/0x378 mm/mmap.c:3484
__bprm_mm_init fs/exec.c:291 [inline]
bprm_mm_init fs/exec.c:395 [inline]
alloc_bprm+0x68c/0xb68 fs/exec.c:1623
kernel_execve+0xa4/0x820 fs/exec.c:2052
run_init_process+0x1bc/0x1ec init/main.c:1388
try_to_run_init_process init/main.c:1395 [inline]
kernel_init+0xdc/0x2a0 init/main.c:1523
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
-> #1 (&mm->mmap_lock){++++}-{3:3}:
__might_fault+0xc4/0x124 mm/memory.c:6387
_inline_copy_to_user include/linux/uaccess.h:176 [inline]
copy_to_user include/linux/uaccess.h:207 [inline]
ni_fiemap+0x11a0/0x14dc fs/ntfs3/frecord.c:2140
ntfs_fiemap+0x110/0x168 fs/ntfs3/file.c:1279
ioctl_fiemap fs/ioctl.c:220 [inline]
do_vfs_ioctl+0x1d70/0x2a90 fs/ioctl.c:841
__do_sys_ioctl fs/ioctl.c:905 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0xe4/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
-> #0 (&ni->ni_lock/4){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:608
__mutex_lock kernel/locking/mutex.c:752 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:804
ni_lock fs/ntfs3/ntfs_fs.h:1110 [inline]
ntfs_read_folio+0xa8/0x1c0 fs/ntfs3/inode.c:718
filemap_read_folio+0x14c/0x39c mm/filemap.c:2355
filemap_fault+0xb34/0x10a0 mm/filemap.c:3406
__do_fault+0x11c/0x374 mm/memory.c:4655
do_read_fault mm/memory.c:5061 [inline]
do_fault mm/memory.c:5191 [inline]
do_pte_missing mm/memory.c:3947 [inline]
handle_pte_fault+0x27f0/0x56f4 mm/memory.c:5521
__handle_mm_fault mm/memory.c:5664 [inline]
handle_mm_fault+0xee8/0x1784 mm/memory.c:5832
do_page_fault+0x538/0xfa8 arch/arm64/mm/fault.c:650
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:743
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:879
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:432
el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:492
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
__uaccess_mask_ptr arch/arm64/include/asm/uaccess.h:169 [inline]
do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
strncpy_from_user+0x190/0x310 lib/strncpy_from_user.c:139
getname_flags+0x100/0x4b4 fs/namei.c:150
getname+0x24/0x34 fs/namei.c:225
do_sys_openat2+0xd0/0x1b8 fs/open.c:1410
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1442
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
other info that might help us debug this:
Chain exists of:
&ni->ni_lock/4 --> &vma->vm_lock->lock --> mapping.invalidate_lock#7
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(mapping.invalidate_lock#7);
lock(&vma->vm_lock->lock);
lock(mapping.invalidate_lock#7);
lock(&ni->ni_lock/4);
*** DEADLOCK ***
1 lock held by syz.1.185/7400:
#0: ffff0000ef16fab8 (mapping.invalidate_lock#7){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:855 [inline]
#0: ffff0000ef16fab8 (mapping.invalidate_lock#7){.+.+}-{3:3}, at: filemap_fault+0x704/0x10a0 mm/filemap.c:3321
stack backtrace:
CPU: 1 UID: 0 PID: 7400 Comm: syz.1.185 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2059
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:608
__mutex_lock kernel/locking/mutex.c:752 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:804
ni_lock fs/ntfs3/ntfs_fs.h:1110 [inline]
ntfs_read_folio+0xa8/0x1c0 fs/ntfs3/inode.c:718
filemap_read_folio+0x14c/0x39c mm/filemap.c:2355
filemap_fault+0xb34/0x10a0 mm/filemap.c:3406
__do_fault+0x11c/0x374 mm/memory.c:4655
do_read_fault mm/memory.c:5061 [inline]
do_fault mm/memory.c:5191 [inline]
do_pte_missing mm/memory.c:3947 [inline]
handle_pte_fault+0x27f0/0x56f4 mm/memory.c:5521
__handle_mm_fault mm/memory.c:5664 [inline]
handle_mm_fault+0xee8/0x1784 mm/memory.c:5832
do_page_fault+0x538/0xfa8 arch/arm64/mm/fault.c:650
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:743
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:879
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:432
el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:492
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
__uaccess_mask_ptr arch/arm64/include/asm/uaccess.h:169 [inline]
do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
strncpy_from_user+0x190/0x310 lib/strncpy_from_user.c:139
getname_flags+0x100/0x4b4 fs/namei.c:150
getname+0x24/0x34 fs/namei.c:225
do_sys_openat2+0xd0/0x1b8 fs/open.c:1410
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1442
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598