TITLE: possible deadlock in test_clear_page_writeback
TYPE: LOCKDEP

[   26.449922] =====================================================
[   26.456163] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
[   26.462899] 4.19.121-syzkaller-00214-g8833700 #0 Not tainted
[   26.468680] -----------------------------------------------------
[   26.474882] syz-executor960/1740 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
[   26.482238] 0000000032662ab5 (shmlock_user_lock){+.+.}, at: user_shm_lock+0xb4/0x1a0
[   26.490108] 
[   26.490108] and this task is already holding:
[   26.496056] 000000001b48eb26 (&(&info->lock)->rlock){....}, at: shmem_lock+0x4f/0x2b0
[   26.504003] which would create a new lock dependency:
[   26.509174]  (&(&info->lock)->rlock){....} -> (shmlock_user_lock){+.+.}
[   26.515913] 
[   26.515913] but this new dependency connects a HARDIRQ-irq-safe lock:
[   26.523948]  (&(&(&mapping->i_pages)->xa_lock)->rlock){-...}
[   26.523953] 
[   26.523953] ... which became HARDIRQ-irq-safe at:
[   26.536022]   _raw_spin_lock_irqsave+0x47/0x60
[   26.540576]   test_clear_page_writeback+0x1a8/0xcfb
[   26.545562]   end_page_writeback+0xec/0x1b0
[   26.549853]   ext4_finish_bio+0x496/0x6e0
[   26.553972]   ext4_end_bio+0x17e/0x600
[   26.557827]   bio_endio+0x437/0x7c0
[   26.561438]   blk_update_request+0x311/0xb30
[   26.565818]   scsi_end_request+0x82/0xb20
[   26.569936]   scsi_io_completion+0x288/0x1840
[   26.574402]   scsi_softirq_done+0x33b/0x3e0
[   26.578694]   blk_mq_complete_request+0x3b0/0x660
[   26.583522]   virtscsi_vq_done+0xbc/0x170
[   26.587641]   vring_interrupt+0x134/0x220
[   26.591769]   __handle_irq_event_percpu+0x25a/0x860
[   26.596768]   handle_irq_event_percpu+0x7b/0x160
[   26.601501]   handle_irq_event+0xa7/0x132
[   26.605628]   handle_edge_irq+0x2b7/0x940
[   26.609761]   handle_irq+0x224/0x36a
[   26.613446]   do_IRQ+0x84/0x1c0
[   26.616700]   ret_from_intr+0x0/0x1e
[   26.620383]   lock_acquire+0x165/0x320
[   26.624241]   _raw_spin_lock+0x2f/0x40
[   26.628112]   chrdev_open+0x80/0x5d0
[   26.631808]   do_dentry_open+0x49d/0x1050
[   26.635927]   path_openat+0x1472/0x3f50
[   26.639886]   do_filp_open+0x1a6/0x280
[   26.643744]   do_sys_open+0x3c5/0x510
[   26.647520]   do_syscall_64+0xc2/0x500
[   26.651381]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   26.656623] 
[   26.656623] to a HARDIRQ-irq-unsafe lock:
[   26.662216]  (shmlock_user_lock){+.+.}
[   26.662221] 
[   26.662221] ... which became HARDIRQ-irq-unsafe at:
[   26.672559] ...
[   26.672568]   _raw_spin_lock+0x2f/0x40
[   26.678296]   user_shm_lock+0xb4/0x1a0
[   26.682155]   hugetlb_file_setup+0x4e6/0x67c
[   26.686535]   newseg+0x465/0xde0
[   26.689879]   ipcget+0xef/0xcb0
[   26.693129]   __x64_sys_shmget+0x13e/0x1b0
[   26.697349]   do_syscall_64+0xc2/0x500
[   26.701221]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   26.706462] 
[   26.706462] other info that might help us debug this:
[   26.706462] 
[   26.715530] Chain exists of:
[   26.715530]   &(&(&mapping->i_pages)->xa_lock)->rlock --> &(&info->lock)->rlock --> shmlock_user_lock
[   26.715530] 
[   26.729202]  Possible interrupt unsafe locking scenario:
[   26.729202] 
[   26.736101]        CPU0                    CPU1
[   26.740762]        ----                    ----
[   26.745403]   lock(shmlock_user_lock);
[   26.749266]                                local_irq_disable();
[   26.755305]                                lock(&(&(&mapping->i_pages)->xa_lock)->rlock);
[   26.763593]                                lock(&(&info->lock)->rlock);
[   26.770316]   <Interrupt>
[   26.773040]     lock(&(&(&mapping->i_pages)->xa_lock)->rlock);
[   26.778979] 
[   26.778979]  *** DEADLOCK ***
[   26.778979] 
[   26.785010] 3 locks held by syz-executor960/1740:
[   26.789820]  #0: 00000000faf5038a (rcu_read_lock){....}, at: shmctl_do_lock+0x5/0x900
[   26.797767]  #1: 000000008ba7ce88 (&(&new->lock)->rlock){+.+.}, at: shmctl_do_lock+0x211/0x900
[   26.806496]  #2: 000000001b48eb26 (&(&info->lock)->rlock){....}, at: shmem_lock+0x4f/0x2b0
[   26.814883] 
[   26.814883] the dependencies between HARDIRQ-irq-safe lock and the holding lock:
[   26.823874]  -> (&(&(&mapping->i_pages)->xa_lock)->rlock){-...} ops: 20596 {
[   26.831034]     IN-HARDIRQ-W at:
[   26.834375]                       _raw_spin_lock_irqsave+0x47/0x60
[   26.840678]                       test_clear_page_writeback+0x1a8/0xcfb
[   26.847398]                       end_page_writeback+0xec/0x1b0
[   26.853425]                       ext4_finish_bio+0x496/0x6e0
[   26.859305]                       ext4_end_bio+0x17e/0x600
[   26.864900]                       bio_endio+0x437/0x7c0
[   26.870256]                       blk_update_request+0x311/0xb30
[   26.876370]                       scsi_end_request+0x82/0xb20
[   26.882241]                       scsi_io_completion+0x288/0x1840
[   26.888443]                       scsi_softirq_done+0x33b/0x3e0
[   26.894471]                       blk_mq_complete_request+0x3b0/0x660
[   26.901021]                       virtscsi_vq_done+0xbc/0x170
[   26.906876]                       vring_interrupt+0x134/0x220
[   26.912734]                       __handle_irq_event_percpu+0x25a/0x860
[   26.919457]                       handle_irq_event_percpu+0x7b/0x160
[   26.925917]                       handle_irq_event+0xa7/0x132
[   26.931771]                       handle_edge_irq+0x2b7/0x940
[   26.937627]                       handle_irq+0x224/0x36a
[   26.943061]                       do_IRQ+0x84/0x1c0
[   26.948048]                       ret_from_intr+0x0/0x1e
[   26.953467]                       lock_acquire+0x165/0x320
[   26.959061]                       _raw_spin_lock+0x2f/0x40
[   26.964653]                       chrdev_open+0x80/0x5d0
[   26.970084]                       do_dentry_open+0x49d/0x1050
[   26.975940]                       path_openat+0x1472/0x3f50
[   26.981621]                       do_filp_open+0x1a6/0x280
[   26.987233]                       do_sys_open+0x3c5/0x510
[   26.992740]                       do_syscall_64+0xc2/0x500
[   26.998337]                       entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.005331]     INITIAL USE at:
[   27.008584]                      _raw_spin_lock_irq+0x3b/0x50
[   27.014449]                      __add_to_page_cache_locked+0x352/0x930
[   27.021183]                      add_to_page_cache_lru+0xde/0x2e0
[   27.027399]                      do_read_cache_page+0x700/0x1140
[   27.033517]                      read_dev_sector+0xc4/0x380
[   27.039746]                      read_lba+0x2e0/0x5f0
[   27.044903]                      find_valid_gpt+0x286/0x1690
[   27.050671]                      efi_partition+0x1af/0xd1f
[   27.056263]                      check_partition+0x3a7/0x6b9
[   27.062041]                      rescan_partitions+0x222/0x8f0
[   27.067989]                      bdev_disk_changed+0x196/0x1d0
[   27.073936]                      __blkdev_get+0xb1a/0x14a0
[   27.079544]                      blkdev_get+0xb2/0x910
[   27.085585]                      __device_add_disk+0xa65/0x1020
[   27.091615]                      brd_init+0x29a/0x466
[   27.096775]                      do_one_initcall+0xf6/0x6a5
[   27.102466]                      kernel_init_freeable+0x4cf/0x5c1
[   27.108669]                      kernel_init+0x12/0x1c0
[   27.114015]                      ret_from_fork+0x24/0x30
[   27.119431]   }
[   27.121300]   ... key      at: [<ffffffff85b8e600>] __key.49807+0x0/0x40
[   27.128120]   ... acquired at:
[   27.131308]    shmem_uncharge+0x29/0x280
[   27.135346]    split_huge_page_to_list+0x16ba/0x1c30
[   27.140438]    follow_page_pte+0x57d/0xf80
[   27.144663]    follow_page_mask+0xbaf/0x1710
[   27.149041]    __get_user_pages+0x48d/0x1400
[   27.153418]    get_user_pages_remote+0x225/0x450
[   27.158144]    uprobe_write_opcode+0xfd/0x1080
[   27.162697]    install_breakpoint.isra.0+0xe6/0x6b0
[   27.167696]    register_for_each_vma+0x930/0xce0
[   27.172423]    uprobe_apply+0xe9/0x130
[   27.176280]    trace_uprobe_register+0x73b/0x910
[   27.181016]    perf_trace_event_init+0x193/0x960
[   27.186149]    perf_uprobe_init+0x165/0x200
[   27.190466]    perf_uprobe_event_init+0xf8/0x190
[   27.195194]    perf_try_init_event+0x124/0x2e0
[   27.199760]    perf_event_alloc.part.0+0x1e4d/0x2e70
[   27.204831]    __do_sys_perf_event_open+0x902/0x2830
[   27.209940]    do_syscall_64+0xc2/0x500
[   27.213900]    entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.219243] 
[   27.220840] -> (&(&info->lock)->rlock){....} ops: 687 {
[   27.226174]    INITIAL USE at:
[   27.229338]                    _raw_spin_lock_irq+0x3b/0x50
[   27.235029]                    shmem_getpage_gfp.isra.0+0xf2e/0x24c0
[   27.241503]                    shmem_write_begin+0x10b/0x1e0
[   27.247272]                    generic_perform_write+0x1fd/0x4d0
[   27.253388]                    __generic_file_write_iter+0x395/0x5c0
[   27.259850]                    generic_file_write_iter+0x384/0x72e
[   27.266152]                    __vfs_write+0x48b/0x690
[   27.271398]                    vfs_write+0x20b/0x550
[   27.276478]                    ksys_write+0x130/0x2a0
[   27.281649]                    do_syscall_64+0xc2/0x500
[   27.286982]                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.293699]  }
[   27.295478]  ... key      at: [<ffffffff85b7f8c0>] __key.51501+0x0/0x40
[   27.302206]  ... acquired at:
[   27.305296]    _raw_spin_lock+0x2f/0x40
[   27.309240]    user_shm_lock+0xb4/0x1a0
[   27.313184]    shmem_lock+0x1d1/0x2b0
[   27.316956]    shmctl_do_lock+0x74e/0x900
[   27.321073]    ksys_shmctl+0x208/0x350
[   27.324942]    do_syscall_64+0xc2/0x500
[   27.328888]    entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.334216] 
[   27.335825] 
[   27.335825] the dependencies between the lock to be acquired
[   27.335828]  and HARDIRQ-irq-unsafe lock:
[   27.347201] -> (shmlock_user_lock){+.+.} ops: 2 {
[   27.352014]    HARDIRQ-ON-W at:
[   27.355284]                     _raw_spin_lock+0x2f/0x40
[   27.360707]                     user_shm_lock+0xb4/0x1a0
[   27.366140]                     hugetlb_file_setup+0x4e6/0x67c
[   27.372081]                     newseg+0x465/0xde0
[   27.376980]                     ipcget+0xef/0xcb0
[   27.381804]                     __x64_sys_shmget+0x13e/0x1b0
[   27.387596]                     do_syscall_64+0xc2/0x500
[   27.393022]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.399827]    SOFTIRQ-ON-W at:
[   27.403079]                     _raw_spin_lock+0x2f/0x40
[   27.408500]                     user_shm_lock+0xb4/0x1a0
[   27.413931]                     hugetlb_file_setup+0x4e6/0x67c
[   27.419874]                     newseg+0x465/0xde0
[   27.424773]                     ipcget+0xef/0xcb0
[   27.429584]                     __x64_sys_shmget+0x13e/0x1b0
[   27.435352]                     do_syscall_64+0xc2/0x500
[   27.440778]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.447601]    INITIAL USE at:
[   27.450774]                    _raw_spin_lock+0x2f/0x40
[   27.456108]                    user_shm_lock+0xb4/0x1a0
[   27.461442]                    hugetlb_file_setup+0x4e6/0x67c
[   27.467307]                    newseg+0x465/0xde0
[   27.472119]                    ipcget+0xef/0xcb0
[   27.476844]                    __x64_sys_shmget+0x13e/0x1b0
[   27.482525]                    do_syscall_64+0xc2/0x500
[   27.487880]                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.494611]  }
[   27.496386]  ... key      at: [<ffffffff841d06d8>] shmlock_user_lock+0x18/0x60
[   27.503710]  ... acquired at:
[   27.506787]    _raw_spin_lock+0x2f/0x40
[   27.510734]    user_shm_lock+0xb4/0x1a0
[   27.514680]    shmem_lock+0x1d1/0x2b0
[   27.518453]    shmctl_do_lock+0x74e/0x900
[   27.522586]    ksys_shmctl+0x208/0x350
[   27.526445]    do_syscall_64+0xc2/0x500
[   27.530399]    entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.535899] 
[   27.537500] 
[   27.537500] stack backtrace:
[   27.541973] CPU: 0 PID: 1740 Comm: syz-executor960 Not tainted 4.19.121-syzkaller-00214-g8833700 #0
[   27.551122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   27.560445] Call Trace:
[   27.563030]  dump_stack+0x111/0x19e
[   27.566631]  check_usage.cold+0x611/0x946
[   27.570764]  ? deref_stack_reg+0xaf/0xe0
[   27.574804]  ? check_usage_forwards+0x300/0x300
[   27.579444]  ? unwind_next_frame+0xe20/0x1840
[   27.583919]  ? bpf_prog_kallsyms_find+0x52/0x2b0
[   27.588658]  ? check_preemption_disabled+0x41/0x230
[   27.593660]  ? is_bpf_text_address+0xd5/0x170
[   27.598138]  ? kernel_text_address+0xe7/0x110
[   27.602606]  ? __kernel_text_address+0xe/0x30
[   27.607071]  ? __save_stack_trace+0x8f/0x100
[   27.611458]  ? __bfs+0x24/0x540
[   27.614706]  ? lockdep_on+0x50/0x50
[   27.618308]  ? __lock_acquire+0x1f62/0x47c0
[   27.622614]  __lock_acquire+0x1f62/0x47c0
[   27.626734]  ? __lock_acquire+0x23b2/0x47c0
[   27.631028]  ? mark_held_locks+0xf0/0xf0
[   27.635067]  ? smk_curacc_shm+0xfe/0x160
[   27.639098]  lock_acquire+0x116/0x320
[   27.642887]  ? user_shm_lock+0xb4/0x1a0
[   27.646846]  ? shmem_lock+0x4f/0x2b0
[   27.650533]  _raw_spin_lock+0x2f/0x40
[   27.654317]  ? user_shm_lock+0xb4/0x1a0
[   27.658261]  user_shm_lock+0xb4/0x1a0
[   27.662045]  shmem_lock+0x1d1/0x2b0
[   27.665643]  shmctl_do_lock+0x74e/0x900
[   27.669605]  ksys_shmctl+0x208/0x350
[   27.673305]  ? __ia32_sys_shmget+0x1b0/0x1b0
[   27.677684]  ? up_write+0x1d/0x150
[   27.681207]  ? ipcget+0x101/0xcb0
[   27.684630]  ? __put_user_ns+0x60/0x60
[   27.688491]  ? debug_mutex_init+0x28/0x60
[   27.692610]  ? set_dumpable+0x9d/0xc0
[   27.696383]  ? ipc_obtain_object_check+0xd0/0xd0
[   27.701111]  ? commit_creds+0x8b4/0x11e0
[   27.705146]  ? __x64_sys_shmget+0x13e/0x1b0
[   27.709458]  ? ksys_shmget+0x130/0x130
[   27.713318]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   27.718045]  ? trace_hardirqs_off_caller+0x55/0x210
[   27.723032]  ? do_syscall_64+0x1f/0x500
[   27.726978]  do_syscall_64+0xc2/0x500
[   27.730753]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.735915] RIP: 0033:0x444309
[   27.739077] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[   27.757951] RSP: 002b:00007fff1471c9a8 EFLAGS: 00000246 ORIG_RAX: 000000000000001f
[   27.765627] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444309
[   27.772869] RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000
[   27.780109] RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0
[   27.787364] R10: 00000000004002e0 R11: 0000000000000246 R12: 0000000000401f70
[   27.794603] R13: 0000000000402000 R14: 0000000000000000 R15: 0000000000000000
