syzbot

======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted
------------------------------------------------------
syz.3.11292/12599 is trying to acquire lock:
ffff888067e049d0 (&c->mark_lock){++++}-{0:0}, at: __bch2_disk_reservation_add+0xd7/0x7f0 fs/bcachefs/buckets.c:1170

but task is already holding lock:
ffff888029112518 (sb_pagefaults#10){.+.+}-{0:0}, at: do_page_mkwrite+0x15e/0x350 mm/memory.c:3176

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #6 (sb_pagefaults#10){.+.+}-{0:0}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
       __sb_start_write include/linux/fs.h:1725 [inline]
       sb_start_pagefault include/linux/fs.h:1890 [inline]
       bch2_page_mkwrite+0x2d9/0x1020 fs/bcachefs/fs-io-pagecache.c:614
       do_page_mkwrite+0x15e/0x350 mm/memory.c:3176
       do_shared_fault mm/memory.c:5398 [inline]
       do_fault mm/memory.c:5460 [inline]
       do_pte_missing mm/memory.c:3979 [inline]
       handle_pte_fault+0x10c6/0x5ed0 mm/memory.c:5801
       __handle_mm_fault mm/memory.c:5944 [inline]
       handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
       do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
       handle_page_fault arch/x86/mm/fault.c:1481 [inline]
       exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
       asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

-> #5 (&mm->mmap_lock){++++}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __might_fault+0xc6/0x120 mm/memory.c:6751
       drm_mode_get_lease_ioctl+0x399/0x680 drivers/gpu/drm/drm_lease.c:673
       drm_ioctl_kernel+0x339/0x440 drivers/gpu/drm/drm_ioctl.c:796
       drm_ioctl+0x60e/0xad0 drivers/gpu/drm/drm_ioctl.c:893
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #4 (&dev->mode_config.idr_mutex){+.+.}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       __drm_mode_object_add+0xc7/0x250 drivers/gpu/drm/drm_mode_object.c:47
       drm_framebuffer_init+0x118/0x290 drivers/gpu/drm/drm_framebuffer.c:875
       drm_gem_fb_init drivers/gpu/drm/drm_gem_framebuffer_helper.c:82 [inline]
       drm_gem_fb_init_with_funcs+0xd88/0x10a0 drivers/gpu/drm/drm_gem_framebuffer_helper.c:202
       drm_gem_fb_create_with_funcs drivers/gpu/drm/drm_gem_framebuffer_helper.c:245 [inline]
       drm_gem_fb_create+0x77/0xc0 drivers/gpu/drm/drm_gem_framebuffer_helper.c:286
       drm_internal_framebuffer_create+0x13fd/0x18a0 drivers/gpu/drm/drm_framebuffer.c:304
       drm_mode_addfb2+0xa0/0x300 drivers/gpu/drm/drm_framebuffer.c:338
       drm_client_buffer_addfb drivers/gpu/drm/drm_client.c:386 [inline]
       drm_client_framebuffer_create+0x4bf/0x8c0 drivers/gpu/drm/drm_client.c:428
       drm_fbdev_shmem_driver_fbdev_probe+0x1f7/0x910 drivers/gpu/drm/drm_fbdev_shmem.c:151
       __drm_fb_helper_initial_config_and_unlock+0x1567/0x1cc0 drivers/gpu/drm/drm_fb_helper.c:1819
       drm_fbdev_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_client.c:51
       drm_client_register+0x181/0x210 drivers/gpu/drm/drm_client.c:140
       drm_fbdev_client_setup+0x1a9/0x3b0 drivers/gpu/drm/drm_fbdev_client.c:158
       drm_client_setup+0x1d/0x90 drivers/gpu/drm/drm_client_setup.c:29
       vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
       vkms_init+0x5eb/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
       do_one_initcall+0x24a/0x870 init/main.c:1266
       do_initcall_level+0x157/0x210 init/main.c:1328
       do_initcalls+0x3f/0x80 init/main.c:1344
       kernel_init_freeable+0x435/0x5d0 init/main.c:1577
       kernel_init+0x1d/0x2b0 init/main.c:1466
       ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #3 (&helper->lock){+.+.}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       __drm_fb_helper_restore_fbdev_mode_unlocked+0xa2/0x170 drivers/gpu/drm/drm_fb_helper.c:228
       drm_fb_helper_set_par+0xaf/0x100 drivers/gpu/drm/drm_fb_helper.c:1351
       fbcon_init+0x112d/0x2100 drivers/video/fbdev/core/fbcon.c:1113
       visual_init+0x2e9/0x660 drivers/tty/vt/vt.c:1011
       do_bind_con_driver+0x863/0xf60 drivers/tty/vt/vt.c:3833
       do_take_over_console+0x5e7/0x750 drivers/tty/vt/vt.c:4399
       do_fbcon_takeover+0x11a/0x200 drivers/video/fbdev/core/fbcon.c:549
       do_fb_registered drivers/video/fbdev/core/fbcon.c:2988 [inline]
       fbcon_fb_registered+0x364/0x620 drivers/video/fbdev/core/fbcon.c:3008
       do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
       register_framebuffer+0x654/0x810 drivers/video/fbdev/core/fbmem.c:515
       __drm_fb_helper_initial_config_and_unlock+0x1697/0x1cc0 drivers/gpu/drm/drm_fb_helper.c:1841
       drm_fbdev_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_client.c:51
       drm_client_register+0x181/0x210 drivers/gpu/drm/drm_client.c:140
       drm_fbdev_client_setup+0x1a9/0x3b0 drivers/gpu/drm/drm_fbdev_client.c:158
       drm_client_setup+0x1d/0x90 drivers/gpu/drm/drm_client_setup.c:29
       vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
       vkms_init+0x5eb/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
       do_one_initcall+0x24a/0x870 init/main.c:1266
       do_initcall_level+0x157/0x210 init/main.c:1328
       do_initcalls+0x3f/0x80 init/main.c:1344
       kernel_init_freeable+0x435/0x5d0 init/main.c:1577
       kernel_init+0x1d/0x2b0 init/main.c:1466
       ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #2 (console_lock){+.+.}-{0:0}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       console_lock+0x164/0x1b0 kernel/printk/printk.c:2833
       __bch2_print_string_as_lines fs/bcachefs/util.c:267 [inline]
       bch2_print_string_as_lines+0x20/0xc0 fs/bcachefs/util.c:286
       __bch2_fsck_err+0x104d/0x1570 fs/bcachefs/error.c:411
       __bch2_bkey_fsck_err+0x24d/0x280 fs/bcachefs/error.c:464
       __bch2_inode_validate+0x4dd/0x610
       bch2_btree_node_read_done+0x3e7e/0x5e90 fs/bcachefs/btree_io.c:1219
       btree_node_read_work+0x68b/0x1260 fs/bcachefs/btree_io.c:1323
       bch2_btree_node_read+0x2433/0x29f0
       __bch2_btree_root_read fs/bcachefs/btree_io.c:1749 [inline]
       bch2_btree_root_read+0x617/0x7a0 fs/bcachefs/btree_io.c:1771
       read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:523
       bch2_fs_recovery+0x2585/0x39d0 fs/bcachefs/recovery.c:853
       bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
       bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
       vfs_get_tree+0x92/0x2b0 fs/super.c:1814
       do_new_mount+0x2be/0xb40 fs/namespace.c:3507
       do_mount fs/namespace.c:3847 [inline]
       __do_sys_mount fs/namespace.c:4057 [inline]
       __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&c->fsck_error_msgs_lock){+.+.}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       __bch2_fsck_err+0x3d4/0x1570 fs/bcachefs/error.c:282
       bch2_check_fix_ptr fs/bcachefs/buckets.c:137 [inline]
       bch2_check_fix_ptrs+0x1f24/0x6530 fs/bcachefs/buckets.c:266
       bch2_trigger_extent+0x92c/0xaa0 fs/bcachefs/buckets.c:856
       bch2_key_trigger fs/bcachefs/bkey_methods.h:87 [inline]
       bch2_gc_mark_key+0x6b7/0x10e0 fs/bcachefs/btree_gc.c:634
       bch2_gc_btree fs/bcachefs/btree_gc.c:698 [inline]
       bch2_gc_btrees fs/bcachefs/btree_gc.c:729 [inline]
       bch2_check_allocations+0x2324/0x7070 fs/bcachefs/btree_gc.c:1133
       bch2_run_recovery_pass+0xf2/0x1e0 fs/bcachefs/recovery_passes.c:191
       bch2_run_recovery_passes+0x3a7/0x880 fs/bcachefs/recovery_passes.c:244
       bch2_fs_recovery+0x25cc/0x39d0 fs/bcachefs/recovery.c:861
       bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
       bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
       vfs_get_tree+0x92/0x2b0 fs/super.c:1814
       do_new_mount+0x2be/0xb40 fs/namespace.c:3507
       do_mount fs/namespace.c:3847 [inline]
       __do_sys_mount fs/namespace.c:4057 [inline]
       __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&c->mark_lock){++++}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       percpu_down_read+0x44/0x1b0 include/linux/percpu-rwsem.h:51
       __bch2_disk_reservation_add+0xd7/0x7f0 fs/bcachefs/buckets.c:1170
       bch2_disk_reservation_add fs/bcachefs/buckets.h:367 [inline]
       __bch2_folio_reservation_get+0x3e0/0xb50 fs/bcachefs/fs-io-pagecache.c:428
       bch2_folio_reservation_get fs/bcachefs/fs-io-pagecache.c:477 [inline]
       bch2_page_mkwrite+0xb0f/0x1020 fs/bcachefs/fs-io-pagecache.c:637
       do_page_mkwrite+0x15e/0x350 mm/memory.c:3176
       do_shared_fault mm/memory.c:5398 [inline]
       do_fault mm/memory.c:5460 [inline]
       do_pte_missing mm/memory.c:3979 [inline]
       handle_pte_fault+0x10c6/0x5ed0 mm/memory.c:5801
       __handle_mm_fault mm/memory.c:5944 [inline]
       handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
       do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
       handle_page_fault arch/x86/mm/fault.c:1481 [inline]
       exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
       asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

other info that might help us debug this:

Chain exists of:
  &c->mark_lock --> &mm->mmap_lock --> sb_pagefaults#10

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(sb_pagefaults#10);
                               lock(&mm->mmap_lock);
                               lock(sb_pagefaults#10);
  rlock(&c->mark_lock);

 *** DEADLOCK ***

2 locks held by syz.3.11292/12599:
 #0: ffff88807e3d4620 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline]
 #0: ffff88807e3d4620 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/memory.c:6149 [inline]
 #0: ffff88807e3d4620 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x32/0x2f0 mm/memory.c:6209
 #1: ffff888029112518 (sb_pagefaults#10){.+.+}-{0:0}, at: do_page_mkwrite+0x15e/0x350 mm/memory.c:3176

stack backtrace:
CPU: 0 UID: 0 PID: 12599 Comm: syz.3.11292 Not tainted 6.13.0-rc3-syzkaller-00209-g499551201b5f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 percpu_down_read+0x44/0x1b0 include/linux/percpu-rwsem.h:51
 __bch2_disk_reservation_add+0xd7/0x7f0 fs/bcachefs/buckets.c:1170
 bch2_disk_reservation_add fs/bcachefs/buckets.h:367 [inline]
 __bch2_folio_reservation_get+0x3e0/0xb50 fs/bcachefs/fs-io-pagecache.c:428
 bch2_folio_reservation_get fs/bcachefs/fs-io-pagecache.c:477 [inline]
 bch2_page_mkwrite+0xb0f/0x1020 fs/bcachefs/fs-io-pagecache.c:637
 do_page_mkwrite+0x15e/0x350 mm/memory.c:3176
 do_shared_fault mm/memory.c:5398 [inline]
 do_fault mm/memory.c:5460 [inline]
 do_pte_missing mm/memory.c:3979 [inline]
 handle_pte_fault+0x10c6/0x5ed0 mm/memory.c:5801
 __handle_mm_fault mm/memory.c:5944 [inline]
 handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f597324cc41
Code: 48 8b 54 24 08 48 85 d2 74 17 8b 44 24 18 0f c8 89 c0 48 89 44 24 18 48 83 fa 01 0f 85 b3 01 00 00 48 8b 44 24 10 8b 54 24 18 <89> 10 e9 15 fd ff ff 48 8b 44 24 10 8b 10 48 8b 44 24 08 48 85 c0
RSP: 002b:00007fffe766aaa0 EFLAGS: 00010246
RAX: 0000000020000440 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000007 RSI: 0000000000000000 RDI: 00005555695ff3c8
RBP: 00007fffe766abb8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000002be08b
R13: 00007f5973575fa0 R14: 0000000000000032 R15: fffffffffffffffe
 </TASK>