=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
5.7.0-rc1-next-20200415-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.2/12647 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
ffff888054a9a118 (&info->lock){+.+.}-{2:2}, at: shmem_uncharge+0x24/0x270 mm/shmem.c:341
and this task is already holding:
ffff888054a9a468 (&xa->xa_lock#4){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:353 [inline]
ffff888054a9a468 (&xa->xa_lock#4){..-.}-{2:2}, at: split_huge_page_to_list+0xad0/0x33b0 mm/huge_memory.c:2864
which would create a new lock dependency:
(&xa->xa_lock#4){..-.}-{2:2} -> (&info->lock){+.+.}-{2:2}
but this new dependency connects a SOFTIRQ-irq-safe lock:
(&xa->xa_lock#4){..-.}-{2:2}
... which became SOFTIRQ-irq-safe at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
test_clear_page_writeback+0x1d7/0x11e0 mm/page-writeback.c:2728
end_page_writeback+0x239/0x520 mm/filemap.c:1317
end_buffer_async_write+0x442/0x5c0 fs/buffer.c:384
end_bio_bh_io_sync+0xe2/0x140 fs/buffer.c:3049
bio_endio+0x46a/0x820 block/bio.c:1422
req_bio_endio block/blk-core.c:245 [inline]
blk_update_request+0x3e1/0xdc0 block/blk-core.c:1472
scsi_end_request+0x80/0x7b0 drivers/scsi/scsi_lib.c:575
scsi_io_completion+0x1e7/0x1300 drivers/scsi/scsi_lib.c:959
scsi_softirq_done+0x31e/0x3b0 drivers/scsi/scsi_lib.c:1454
blk_done_softirq+0x2db/0x440 block/blk-softirq.c:37
__do_softirq+0x26c/0x9f7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x192/0x1d0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
do_IRQ+0xda/0x270 arch/x86/kernel/irq.c:263
ret_from_intr+0x0/0x2b
__read_once_size include/linux/compiler.h:232 [inline]
check_kcov_mode kernel/kcov.c:165 [inline]
write_comp_data+0x2e/0x80 kernel/kcov.c:218
tomoyo_domain_quota_is_ok+0x32b/0x500 security/tomoyo/util.c:1070
tomoyo_supervisor+0x286/0xe60 security/tomoyo/common.c:2089
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x257/0x360 security/tomoyo/file.c:573
tomoyo_path_perm+0x2f6/0x400 security/tomoyo/file.c:838
security_inode_getattr+0xeb/0x150 security/security.c:1273
vfs_getattr+0x22/0x60 fs/stat.c:117
vfs_statx+0x142/0x1e0 fs/stat.c:201
vfs_lstat include/linux/fs.h:3284 [inline]
__do_sys_newlstat+0x96/0x120 fs/stat.c:364
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
to a SOFTIRQ-irq-unsafe lock:
(&info->lock){+.+.}-{2:2}
... which became SOFTIRQ-irq-unsafe at:
...
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:353 [inline]
shmem_mfill_atomic_pte+0x1012/0x21c0 mm/shmem.c:2402
shmem_mfill_zeropage_pte+0x91/0xc0 mm/shmem.c:2451
mfill_atomic_pte mm/userfaultfd.c:453 [inline]
__mcopy_atomic mm/userfaultfd.c:582 [inline]
mfill_zeropage+0xab0/0x10d0 mm/userfaultfd.c:639
userfaultfd_zeropage fs/userfaultfd.c:1795 [inline]
userfaultfd_ioctl+0x1e6f/0x4210 fs/userfaultfd.c:1944
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&info->lock);
local_irq_disable();
lock(&xa->xa_lock#4);
lock(&info->lock);
<Interrupt>
lock(&xa->xa_lock#4);
*** DEADLOCK ***
5 locks held by syz-executor.2/12647:
#0: ffff888090c8e450 (sb_writers#7){.+.+}-{0:0}, at: sb_start_write include/linux/fs.h:1655 [inline]
#0: ffff888090c8e450 (sb_writers#7){.+.+}-{0:0}, at: do_sys_ftruncate+0x29f/0x570 fs/open.c:190
#1: ffff888054a9a370 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:797 [inline]
#1: ffff888054a9a370 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: do_truncate+0x125/0x1f0 fs/open.c:62
#2: ffff888054a9a530 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:541 [inline]
#2: ffff888054a9a530 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: split_huge_page_to_list+0x4c3/0x33b0 mm/huge_memory.c:2825
#3: ffff88812ffffcd8 (&pgdat->lru_lock){....}-{2:2}, at: split_huge_page_to_list+0x8da/0x33b0 mm/huge_memory.c:2855
#4: ffff888054a9a468 (&xa->xa_lock#4){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:353 [inline]
#4: ffff888054a9a468 (&xa->xa_lock#4){..-.}-{2:2}, at: split_huge_page_to_list+0xad0/0x33b0 mm/huge_memory.c:2864
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (&xa->xa_lock#4){..-.}-{2:2} {
IN-SOFTIRQ-W at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
test_clear_page_writeback+0x1d7/0x11e0 mm/page-writeback.c:2728
end_page_writeback+0x239/0x520 mm/filemap.c:1317
end_buffer_async_write+0x442/0x5c0 fs/buffer.c:384
end_bio_bh_io_sync+0xe2/0x140 fs/buffer.c:3049
bio_endio+0x46a/0x820 block/bio.c:1422
req_bio_endio block/blk-core.c:245 [inline]
blk_update_request+0x3e1/0xdc0 block/blk-core.c:1472
scsi_end_request+0x80/0x7b0 drivers/scsi/scsi_lib.c:575
scsi_io_completion+0x1e7/0x1300 drivers/scsi/scsi_lib.c:959
scsi_softirq_done+0x31e/0x3b0 drivers/scsi/scsi_lib.c:1454
blk_done_softirq+0x2db/0x440 block/blk-softirq.c:37
__do_softirq+0x26c/0x9f7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x192/0x1d0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
do_IRQ+0xda/0x270 arch/x86/kernel/irq.c:263
ret_from_intr+0x0/0x2b
__read_once_size include/linux/compiler.h:232 [inline]
check_kcov_mode kernel/kcov.c:165 [inline]
write_comp_data+0x2e/0x80 kernel/kcov.c:218
tomoyo_domain_quota_is_ok+0x32b/0x500 security/tomoyo/util.c:1070
tomoyo_supervisor+0x286/0xe60 security/tomoyo/common.c:2089
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x257/0x360 security/tomoyo/file.c:573
tomoyo_path_perm+0x2f6/0x400 security/tomoyo/file.c:838
security_inode_getattr+0xeb/0x150 security/security.c:1273
vfs_getattr+0x22/0x60 fs/stat.c:117
vfs_statx+0x142/0x1e0 fs/stat.c:201
vfs_lstat include/linux/fs.h:3284 [inline]
__do_sys_newlstat+0x96/0x120 fs/stat.c:364
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
INITIAL USE at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0x5b/0x80 kernel/locking/spinlock.c:167
spin_lock_irq include/linux/spinlock.h:378 [inline]
__add_to_page_cache_locked+0x607/0xe00 mm/filemap.c:855
add_to_page_cache_lru+0x1aa/0x700 mm/filemap.c:921
do_read_cache_page+0x9ab/0x1810 mm/filemap.c:2761
read_mapping_page include/linux/pagemap.h:397 [inline]
read_part_sector+0xf6/0x600 block/partitions/core.c:643
adfspart_check_ICS+0x9d/0xc80 block/partitions/acorn.c:360
check_partition block/partitions/core.c:140 [inline]
blk_add_partitions+0x474/0xe50 block/partitions/core.c:571
bdev_disk_changed+0x1fb/0x380 fs/block_dev.c:1544
__blkdev_get+0xb15/0x1530 fs/block_dev.c:1647
blkdev_get+0x41/0x2b0 fs/block_dev.c:1749
register_disk block/genhd.c:763 [inline]
__device_add_disk+0xa4f/0x1170 block/genhd.c:853
add_disk include/linux/genhd.h:294 [inline]
brd_init+0x297/0x463 drivers/block/brd.c:533
do_one_initcall+0x10a/0x7d0 init/main.c:1160
do_initcall_level init/main.c:1233 [inline]
do_initcalls init/main.c:1249 [inline]
do_basic_setup init/main.c:1269 [inline]
kernel_init_freeable+0x501/0x5ae init/main.c:1454
kernel_init+0xd/0x1bb init/main.c:1360
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
}
... key at: [<ffffffff8c6b4140>] __key.18068+0x0/0x40
... acquired at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
shmem_uncharge+0x24/0x270 mm/shmem.c:341
__split_huge_page mm/huge_memory.c:2613 [inline]
split_huge_page_to_list+0x274b/0x33b0 mm/huge_memory.c:2886
split_huge_page include/linux/huge_mm.h:204 [inline]
shmem_punch_compound+0x13e/0x1e0 mm/shmem.c:814
shmem_undo_range+0x5f1/0x1b80 mm/shmem.c:870
shmem_truncate_range+0x27/0xa0 mm/shmem.c:980
shmem_setattr+0x8b6/0xc80 mm/shmem.c:1039
notify_change+0xb6d/0x1020 fs/attr.c:336
do_truncate+0x134/0x1f0 fs/open.c:64
do_sys_ftruncate+0x4a5/0x570 fs/open.c:195
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
-> (&info->lock){+.+.}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:353 [inline]
shmem_mfill_atomic_pte+0x1012/0x21c0 mm/shmem.c:2402
shmem_mfill_zeropage_pte+0x91/0xc0 mm/shmem.c:2451
mfill_atomic_pte mm/userfaultfd.c:453 [inline]
__mcopy_atomic mm/userfaultfd.c:582 [inline]
mfill_zeropage+0xab0/0x10d0 mm/userfaultfd.c:639
userfaultfd_zeropage fs/userfaultfd.c:1795 [inline]
userfaultfd_ioctl+0x1e6f/0x4210 fs/userfaultfd.c:1944
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
SOFTIRQ-ON-W at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:353 [inline]
shmem_mfill_atomic_pte+0x1012/0x21c0 mm/shmem.c:2402
shmem_mfill_zeropage_pte+0x91/0xc0 mm/shmem.c:2451
mfill_atomic_pte mm/userfaultfd.c:453 [inline]
__mcopy_atomic mm/userfaultfd.c:582 [inline]
mfill_zeropage+0xab0/0x10d0 mm/userfaultfd.c:639
userfaultfd_zeropage fs/userfaultfd.c:1795 [inline]
userfaultfd_ioctl+0x1e6f/0x4210 fs/userfaultfd.c:1944
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
INITIAL USE at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0x5b/0x80 kernel/locking/spinlock.c:167
spin_lock_irq include/linux/spinlock.h:378 [inline]
shmem_getpage_gfp+0x937/0x2a10 mm/shmem.c:1882
shmem_getpage mm/shmem.c:154 [inline]
shmem_write_begin+0x102/0x1e0 mm/shmem.c:2483
generic_perform_write+0x20a/0x4e0 mm/filemap.c:3308
__generic_file_write_iter+0x24c/0x610 mm/filemap.c:3437
generic_file_write_iter+0x3f3/0x630 mm/filemap.c:3469
call_write_iter include/linux/fs.h:1907 [inline]
new_sync_write+0x4a2/0x700 fs/read_write.c:484
__vfs_write+0xc9/0x100 fs/read_write.c:497
vfs_write+0x268/0x5d0 fs/read_write.c:559
ksys_write+0x12d/0x250 fs/read_write.c:612
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
}
... key at: [<ffffffff8c6a0bc0>] __key.56628+0x0/0x40
... acquired at:
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
shmem_uncharge+0x24/0x270 mm/shmem.c:341
__split_huge_page mm/huge_memory.c:2613 [inline]
split_huge_page_to_list+0x274b/0x33b0 mm/huge_memory.c:2886
split_huge_page include/linux/huge_mm.h:204 [inline]
shmem_punch_compound+0x13e/0x1e0 mm/shmem.c:814
shmem_undo_range+0x5f1/0x1b80 mm/shmem.c:870
shmem_truncate_range+0x27/0xa0 mm/shmem.c:980
shmem_setattr+0x8b6/0xc80 mm/shmem.c:1039
notify_change+0xb6d/0x1020 fs/attr.c:336
do_truncate+0x134/0x1f0 fs/open.c:64
do_sys_ftruncate+0x4a5/0x570 fs/open.c:195
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
stack backtrace:
CPU: 0 PID: 12647 Comm: syz-executor.2 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
print_bad_irq_dependency kernel/locking/lockdep.c:2132 [inline]
check_irq_usage.cold+0x566/0x6de kernel/locking/lockdep.c:2330
check_prev_add kernel/locking/lockdep.c:2519 [inline]
check_prevs_add kernel/locking/lockdep.c:2620 [inline]
validate_chain kernel/locking/lockdep.c:3237 [inline]
__lock_acquire+0x2ac9/0x4c50 kernel/locking/lockdep.c:4355
lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
shmem_uncharge+0x24/0x270 mm/shmem.c:341
__split_huge_page mm/huge_memory.c:2613 [inline]
split_huge_page_to_list+0x274b/0x33b0 mm/huge_memory.c:2886
split_huge_page include/linux/huge_mm.h:204 [inline]
shmem_punch_compound+0x13e/0x1e0 mm/shmem.c:814
shmem_undo_range+0x5f1/0x1b80 mm/shmem.c:870
shmem_truncate_range+0x27/0xa0 mm/shmem.c:980
shmem_setattr+0x8b6/0xc80 mm/shmem.c:1039
notify_change+0xb6d/0x1020 fs/attr.c:336
do_truncate+0x134/0x1f0 fs/open.c:64
do_sys_ftruncate+0x4a5/0x570 fs/open.c:195
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f22cf425c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 00000000004dc500 RCX: 000000000045c829
RDX: 0000000000000000 RSI: 000000000000ee72 RDI: 0000000000000006
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000000e9 R14: 00000000004c3701 R15: 00007f22cf4266d4