program: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="6368616e67656861742030783b050000000000000038d5e307ea5d0a955e5a303030303030303030305e2f06e90a660972fa3e6b803c2e6d51993c1b9277025d85984e7d02204d7677a03b073a6d9bd55acdc5541d1a2286fdaa477842563be16ef5b71a82499dc257bcf2b61a2bb4707c7fd03f7b9191714d5c227b89e02a44da69243933"], 0x1d) preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) (fail_nth: 4) [ 154.644170][ T5287] Bluetooth: hci0: command tx timeout [ 154.731025][ T5326] [ 154.732147][ T5326] ====================================================== [ 154.735038][ T5326] WARNING: possible circular locking dependency detected [ 154.738056][ T5326] syzkaller #0 Not tainted [ 154.739866][ T5326] ------------------------------------------------------ [ 154.742690][ T5326] syz.0.0/5326 is trying to acquire lock: [ 154.745009][ T5326] ffffffff8ec611a0 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x231/0x1900 [ 154.748789][ T5326] [ 154.748789][ T5326] but task is already holding lock: [ 154.751842][ T5326] ffff88803557c190 (&q->q_usage_counter(io)#17){++++}-{0:0}, at: blk_throtl_init+0x27b/0x420 [ 154.756131][ T5326] [ 154.756131][ T5326] which lock already depends on the new lock. [ 154.756131][ T5326] [ 154.760442][ T5326] [ 154.760442][ T5326] the existing dependency chain (in reverse order) is: [ 154.764032][ T5326] [ 154.764032][ T5326] -> #2 (&q->q_usage_counter(io)#17){++++}-{0:0}: [ 154.767714][ T5326] blk_alloc_queue+0x544/0x690 [ 154.769784][ T5326] __blk_mq_alloc_disk+0x194/0x390 [ 154.771871][ T5326] loop_add+0x480/0xb40 [ 154.773758][ T5326] loop_init+0xd7/0x160 [ 154.776826][ T5326] do_one_initcall+0x250/0x870 [ 154.779055][ T5326] do_initcall_level+0x10a/0x1a0 [ 154.781407][ T5326] do_initcalls+0x59/0xa0 [ 154.783583][ T5326] kernel_init_freeable+0x29d/0x3e0 [ 154.786077][ T5326] kernel_init+0x1d/0x1d0 [ 154.788263][ T5326] ret_from_fork+0x514/0xb70 [ 154.790700][ T5326] ret_from_fork_asm+0x1a/0x30 [ 154.793010][ T5326] [ 154.793010][ T5326] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 154.796038][ T5326] fs_reclaim_acquire+0x71/0x100 [ 154.798373][ T5326] prepare_alloc_pages+0x15b/0x650 [ 154.800704][ T5326] __alloc_frozen_pages_noprof+0x12f/0x380 [ 154.803383][ T5326] __alloc_pages_noprof+0x10/0x100 [ 154.805744][ T5326] pcpu_populate_chunk+0x181/0xb30 [ 154.808087][ T5326] pcpu_alloc_noprof+0xbca/0x1900 [ 154.810444][ T5326] iommu_dma_init_fq+0x2d3/0x700 [ 154.812702][ T5326] iommu_setup_dma_ops+0x6e5/0x1820 [ 154.815064][ T5326] bus_iommu_probe+0x296/0x470 [ 154.817294][ T5326] iommu_device_register+0x1af/0x210 [ 154.819679][ T5326] intel_iommu_init+0x6f0/0x8e0 [ 154.821903][ T5326] pci_iommu_init+0x38/0x70 [ 154.824022][ T5326] do_one_initcall+0x250/0x870 [ 154.826217][ T5326] do_initcall_level+0x10a/0x1a0 [ 154.828497][ T5326] do_initcalls+0x59/0xa0 [ 154.830533][ T5326] kernel_init_freeable+0x29d/0x3e0 [ 154.832879][ T5326] kernel_init+0x1d/0x1d0 [ 154.834916][ T5326] ret_from_fork+0x514/0xb70 [ 154.837063][ T5326] ret_from_fork_asm+0x1a/0x30 [ 154.839250][ T5326] [ 154.839250][ T5326] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 154.842391][ T5326] __lock_acquire+0x1520/0x2cf0 [ 154.844588][ T5326] lock_acquire+0x106/0x350 [ 154.846664][ T5326] __mutex_lock+0x19d/0x1550 [ 154.848989][ T5326] pcpu_alloc_noprof+0x231/0x1900 [ 154.851292][ T5326] __percpu_counter_init_many+0x42/0x380 [ 154.853888][ T5326] blkg_rwstat_init+0x2c/0x170 [ 154.856133][ T5326] throtl_pd_alloc+0xb6/0x460 [ 154.858414][ T5326] blkcg_activate_policy+0x650/0xb10 [ 154.860856][ T5326] blk_throtl_init+0x2f7/0x420 [ 154.863037][ T5326] tg_set_conf+0x1db/0x4e0 [ 154.865107][ T5326] cgroup_file_write+0x331/0x8f0 [ 154.867338][ T5326] kernfs_fop_write_iter+0x3a4/0x540 [ 154.869757][ T5326] vfs_write+0x612/0xba0 [ 154.871726][ T5326] ksys_write+0x150/0x270 [ 154.873749][ T5326] do_syscall_64+0x174/0x580 [ 154.875843][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.878438][ T5326] [ 154.878438][ T5326] other info that might help us debug this: [ 154.878438][ T5326] [ 154.882642][ T5326] Chain exists of: [ 154.882642][ T5326] pcpu_alloc_mutex --> fs_reclaim --> &q->q_usage_counter(io)#17 [ 154.882642][ T5326] [ 154.888016][ T5326] Possible unsafe locking scenario: [ 154.888016][ T5326] [ 154.891031][ T5326] CPU0 CPU1 [ 154.893225][ T5326] ---- ---- [ 154.895390][ T5326] lock(&q->q_usage_counter(io)#17); [ 154.897580][ T5326] lock(fs_reclaim); [ 154.900217][ T5326] lock(&q->q_usage_counter(io)#17); [ 154.903345][ T5326] lock(pcpu_alloc_mutex); [ 154.905191][ T5326] [ 154.905191][ T5326] *** DEADLOCK *** [ 154.905191][ T5326] [ 154.908296][ T5326] 7 locks held by syz.0.0/5326: [ 154.910366][ T5326] #0: ffff8880128d72b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 154.914016][ T5326] #1: ffff88803b7cc450 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 154.917626][ T5326] #2: ffff888040743c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 154.921546][ T5326] #3: ffff888011daf5a8 (kn->active#66){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 [ 154.925551][ T5326] #4: ffff88803557c390 (&q->rq_qos_mutex){+.+.}-{4:4}, at: blkg_conf_open_bdev+0x2a8/0x3c0 [ 154.929738][ T5326] #5: ffff88803557c190 (&q->q_usage_counter(io)#17){++++}-{0:0}, at: blk_throtl_init+0x27b/0x420 [ 154.933974][ T5326] #6: ffff88803557c1c8 (&q->q_usage_counter(queue)){+.+.}-{0:0}, at: blk_throtl_init+0x27b/0x420 [ 154.938370][ T5326] [ 154.938370][ T5326] stack backtrace: [ 154.940866][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 154.940881][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 154.940888][ T5326] Call Trace: [ 154.940895][ T5326] [ 154.940900][ T5326] dump_stack_lvl+0xe8/0x150 [ 154.940920][ T5326] print_circular_bug+0x2e1/0x300 [ 154.940932][ T5326] check_noncircular+0x12e/0x150 [ 154.940949][ T5326] __lock_acquire+0x1520/0x2cf0 [ 154.940963][ T5326] ? pcpu_alloc_noprof+0x231/0x1900 [ 154.940973][ T5326] lock_acquire+0x106/0x350 [ 154.940985][ T5326] ? pcpu_alloc_noprof+0x231/0x1900 [ 154.940998][ T5326] __mutex_lock+0x19d/0x1550 [ 154.941008][ T5326] ? pcpu_alloc_noprof+0x231/0x1900 [ 154.941017][ T5326] ? tg_set_conf+0x1db/0x4e0 [ 154.941026][ T5326] ? kernfs_fop_write_iter+0x3a4/0x540 [ 154.941040][ T5326] ? vfs_write+0x612/0xba0 [ 154.941051][ T5326] ? ksys_write+0x150/0x270 [ 154.941068][ T5326] ? do_syscall_64+0x174/0x580 [ 154.941082][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.941094][ T5326] ? pcpu_alloc_noprof+0x231/0x1900 [ 154.941104][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 154.941117][ T5326] pcpu_alloc_noprof+0x231/0x1900 [ 154.941128][ T5326] ? rcu_is_watching+0x15/0xb0 [ 154.941143][ T5326] ? __kasan_kmalloc+0x93/0xb0 [ 154.941152][ T5326] __percpu_counter_init_many+0x42/0x380 [ 154.941163][ T5326] ? throtl_pd_alloc+0x9d/0x460 [ 154.941173][ T5326] blkg_rwstat_init+0x2c/0x170 [ 154.941182][ T5326] throtl_pd_alloc+0xb6/0x460 [ 154.941193][ T5326] ? __pfx_throtl_pd_alloc+0x10/0x10 [ 154.941205][ T5326] blkcg_activate_policy+0x650/0xb10 [ 154.941221][ T5326] blk_throtl_init+0x2f7/0x420 [ 154.941236][ T5326] tg_set_conf+0x1db/0x4e0 [ 154.941245][ T5326] ? kernfs_root+0x1c/0x230 [ 154.941256][ T5326] ? __pfx_tg_set_conf+0x10/0x10 [ 154.941266][ T5326] ? kernfs_root+0x1c/0x230 [ 154.941277][ T5326] ? kernfs_root+0x1c/0x230 [ 154.941287][ T5326] ? kernfs_root+0x1c/0x230 [ 154.941297][ T5326] ? kernfs_root+0x1ea/0x230 [ 154.941309][ T5326] ? __pfx_tg_set_conf_u64+0x10/0x10 [ 154.941317][ T5326] cgroup_file_write+0x331/0x8f0 [ 154.941324][ T5326] ? kernfs_fop_write_iter+0x22b/0x540 [ 154.941333][ T5326] ? __pfx_cgroup_file_write+0x10/0x10 [ 154.941339][ T5326] ? __kmalloc_noprof+0x396/0x720 [ 154.941346][ T5326] ? vfs_write+0x22b/0xba0 [ 154.941353][ T5326] ? __kmalloc_noprof+0x1ad/0x720 [ 154.941360][ T5326] ? __pfx_cgroup_file_write+0x10/0x10 [ 154.941366][ T5326] kernfs_fop_write_iter+0x3a4/0x540 [ 154.941376][ T5326] vfs_write+0x612/0xba0 [ 154.941385][ T5326] ? __pfx_vfs_write+0x10/0x10 [ 154.941398][ T5326] ? __fget_files+0x2a/0x420 [ 154.941410][ T5326] ksys_write+0x150/0x270 [ 154.941422][ T5326] ? __pfx_ksys_write+0x10/0x10 [ 154.941437][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.941447][ T5326] do_syscall_64+0x174/0x580 [ 154.941461][ T5326] ? trace_irq_disable+0x3b/0x140 [ 154.941474][ T5326] ? clear_bhb_loop+0x40/0x90 [ 154.941482][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.941490][ T5326] RIP: 0033:0x7fc4c539de99 [ 154.941499][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.941507][ T5326] RSP: 002b:00007fc4c6289fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 154.941519][ T5326] RAX: ffffffffffffffda RBX: 00007fc4c5625fa0 RCX: 00007fc4c539de99 [ 154.941526][ T5326] RDX: 000000000000006a RSI: 00002000000000c0 RDI: 0000000000000005 [ 154.941532][ T5326] RBP: 00007fc4c628a050 R08: 0000000000000000 R09: 0000000000000000 [ 154.941539][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 154.941545][ T5326] R13: 00007fc4c5626038 R14: 00007fc4c5625fa0 R15: 00007ffd1a7008b8 [ 154.941556][ T5326]