====================================================== WARNING: possible circular locking dependency detected 6.14.0-rc3-next-20250218-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.1224/9897 is trying to acquire lock: ffff88805207cea8 (mapping.invalidate_lock#8){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:922 [inline] ffff88805207cea8 (mapping.invalidate_lock#8){++++}-{4:4}, at: filemap_fault+0x71d/0x1620 mm/filemap.c:3436 but task is already holding lock: ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: do_user_addr_fault arch/x86/mm/fault.c:1328 [inline] ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: handle_page_fault arch/x86/mm/fault.c:1480 [inline] ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: exc_page_fault+0x17b/0x920 arch/x86/mm/fault.c:1538 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (vm_lock){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __vma_enter_locked+0x263/0x550 mm/memory.c:6366 __vma_start_write+0x1f/0x120 mm/memory.c:6390 vma_start_write include/linux/mm.h:841 [inline] mprotect_fixup+0x5a4/0xa20 mm/mprotect.c:670 setup_arg_pages+0x63e/0xbc0 fs/exec.c:782 load_elf_binary+0xb87/0x2820 fs/binfmt_elf.c:1019 search_binary_handler fs/exec.c:1775 [inline] exec_binprm fs/exec.c:1807 [inline] bprm_execve+0x979/0x1430 fs/exec.c:1859 kernel_execve+0x931/0xa50 fs/exec.c:2026 try_to_run_init_process init/main.c:1385 [inline] kernel_init+0xed/0x2b0 init/main.c:1513 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #2 (&mm->mmap_lock){++++}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __might_fault+0xc6/0x120 mm/memory.c:6927 _inline_copy_to_user include/linux/uaccess.h:192 [inline] _copy_to_user+0x2c/0xb0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:225 [inline] fiemap_fill_next_extent+0x235/0x420 fs/ioctl.c:145 ni_fiemap+0xa2f/0x1270 fs/ntfs3/frecord.c:2064 ntfs_fiemap+0x132/0x180 fs/ntfs3/file.c:1380 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1974/0x2750 fs/ioctl.c:840 __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x80/0x160 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&ni->ni_lock/5){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 ni_lock fs/ntfs3/ntfs_fs.h:1111 [inline] ntfs_fallocate+0x5c7/0x1270 fs/ntfs3/file.c:630 vfs_fallocate+0x623/0x7a0 fs/open.c:338 ksys_fallocate fs/open.c:362 [inline] __do_sys_fallocate fs/open.c:367 [inline] __se_sys_fallocate fs/open.c:365 [inline] __x64_sys_fallocate+0xbc/0x110 fs/open.c:365 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (mapping.invalidate_lock#8){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524 filemap_invalidate_lock_shared include/linux/fs.h:922 [inline] filemap_fault+0x71d/0x1620 mm/filemap.c:3436 __do_fault+0x135/0x390 mm/memory.c:4978 do_shared_fault mm/memory.c:5457 [inline] do_fault mm/memory.c:5531 [inline] do_pte_missing mm/memory.c:4048 [inline] handle_pte_fault+0xfca/0x61c0 mm/memory.c:5890 __handle_mm_fault mm/memory.c:6033 [inline] handle_mm_fault+0x11ae/0x1cd0 mm/memory.c:6202 do_user_addr_fault arch/x86/mm/fault.c:1337 [inline] handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x459/0x920 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 other info that might help us debug this: Chain exists of: mapping.invalidate_lock#8 --> &mm->mmap_lock --> vm_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(vm_lock); lock(&mm->mmap_lock); lock(vm_lock); rlock(mapping.invalidate_lock#8); *** DEADLOCK *** 1 lock held by syz.0.1224/9897: #0: ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: do_user_addr_fault arch/x86/mm/fault.c:1328 [inline] #0: ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: handle_page_fault arch/x86/mm/fault.c:1480 [inline] #0: ffff88801bb641c8 (vm_lock){++++}-{0:0}, at: exc_page_fault+0x17b/0x920 arch/x86/mm/fault.c:1538 stack backtrace: CPU: 1 UID: 0 PID: 9897 Comm: syz.0.1224 Not tainted 6.14.0-rc3-next-20250218-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524 filemap_invalidate_lock_shared include/linux/fs.h:922 [inline] filemap_fault+0x71d/0x1620 mm/filemap.c:3436 __do_fault+0x135/0x390 mm/memory.c:4978 do_shared_fault mm/memory.c:5457 [inline] do_fault mm/memory.c:5531 [inline] do_pte_missing mm/memory.c:4048 [inline] handle_pte_fault+0xfca/0x61c0 mm/memory.c:5890 __handle_mm_fault mm/memory.c:6033 [inline] handle_mm_fault+0x11ae/0x1cd0 mm/memory.c:6202 do_user_addr_fault arch/x86/mm/fault.c:1337 [inline] handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x459/0x920 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f63dff55025 Code: e0 e9 a6 fd ff ff c5 fe 6f 4e 20 f7 c1 00 0e 00 00 75 67 49 89 c9 48 8d 4c 16 ff 48 83 ce 3f 4a 8d 7c 0e 01 48 29 f1 48 ff c6 a4 c4 c1 7e 7f 00 c4 c1 7e 7f 48 20 e9 70 fd ff ff 66 0f 1f 84 RSP: 002b:00007ffd2ee428b8 EFLAGS: 00010216 RAX: 0000400000009640 RBX: 0000000000000004 RCX: 0000000000006df1 RDX: 00000000000097b1 RSI: 00007f63dfa21e40 RDI: 000040000000c000 RBP: 00007ffd2ee42988 R08: 0000400000009640 R09: ffffc09c205ea1c0 R10: 0000000000000000 R11: 0000000000000002 R12: 00007f63e01a5fac R13: 00007f63e01a5fa0 R14: fffffffffffffffe R15: 00007ffd2ee429d0