======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/u10:7/10943 is trying to acquire lock:
ffff8881106c4618 (sb_internal#2){.+.+}-{0:0}, at: btrfs_finish_one_ordered+0x573/0x1fd0

but task is already holding lock:
ffff88811f1d2628 (btrfs_ordered_extent){++++}-{0:0}, at: btrfs_finish_one_ordered+0x30e/0x1fd0

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #9 (btrfs_ordered_extent){++++}-{0:0}:
       lock_acquire+0x120/0x360
       btrfs_start_ordered_extent_nowriteback+0x39c/0x6e0
       btrfs_wait_ordered_range+0x154/0x260
       btrfs_remap_file_range+0x4ef/0x1290
       vfs_clone_file_range+0x42c/0x7a0
       do_vfs_ioctl+0xd2b/0x1430
       __se_sys_ioctl+0x82/0x170
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #8 (&ei->i_mmap_lock){++++}-{4:4}:
       lock_acquire+0x120/0x360
       down_read+0x46/0x2e0
       btrfs_page_mkwrite+0x5f3/0x1a70
       do_page_mkwrite+0x14d/0x310
       do_wp_page+0x268d/0x5800
       __handle_mm_fault+0x1033/0x5440
       handle_mm_fault+0x40a/0x8e0
       do_user_addr_fault+0xa81/0x1390
       exc_page_fault+0x76/0xf0
       asm_exc_page_fault+0x26/0x30

-> #7 (sb_pagefaults#3){.+.+}-{0:0}:
       lock_acquire+0x120/0x360
       btrfs_page_mkwrite+0x317/0x1a70
       do_page_mkwrite+0x14d/0x310
       do_wp_page+0x268d/0x5800
       __handle_mm_fault+0x1033/0x5440
       handle_mm_fault+0x40a/0x8e0
       do_user_addr_fault+0xa81/0x1390
       exc_page_fault+0x76/0xf0
       asm_exc_page_fault+0x26/0x30

-> #6 (vm_lock){++++}-{0:0}:
       lock_acquire+0x120/0x360
       __vma_enter_locked+0x182/0x380
       __vma_start_write+0x1e/0x120
       mprotect_fixup+0x578/0x9c0
       setup_arg_pages+0x53a/0xaa0
       load_elf_binary+0xba4/0x2740
       bprm_execve+0x99c/0x1450
       kernel_execve+0x8f0/0x9f0
       try_to_run_init_process+0x13/0x60
       kernel_init+0xad/0x1d0
       ret_from_fork+0x439/0x7d0
       ret_from_fork_asm+0x1a/0x30

-> #5 (&mm->mmap_lock){++++}-{4:4}:
       lock_acquire+0x120/0x360
       __might_fault+0xcc/0x130
       _copy_to_user+0x2c/0xb0
       fiemap_fill_next_extent+0x1c0/0x390
       iomap_fiemap+0x476/0x520
       ext4_fiemap+0x282/0x320
       do_vfs_ioctl+0x1173/0x1430
       __se_sys_ioctl+0x82/0x170
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #4 (&type->i_mutex_dir_key#3){++++}-{4:4}:
       lock_acquire+0x120/0x360
       down_read+0x46/0x2e0
       lookup_slow+0x46/0x70
       walk_component+0x2d2/0x400
       path_lookupat+0x163/0x430
       filename_lookup+0x212/0x570
       kern_path+0x35/0x50
       device_list_add+0xe2a/0x22a0
       btrfs_scan_one_device+0x3ee/0x650
       btrfs_control_ioctl+0x11f/0x360
       __se_sys_ioctl+0xfc/0x170
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #3 (&fs_devs->device_list_mutex){+.+.}-{4:4}:
       lock_acquire+0x120/0x360
       __mutex_lock+0x187/0x1350
       btrfs_create_pending_block_groups+0x5f8/0x1780
       __btrfs_end_transaction+0x140/0x640
       btrfs_inc_block_group_ro+0x641/0x6f0
       btrfs_relocate_block_group+0x3f1/0xc60
       btrfs_relocate_chunk+0x12f/0x5c0
       __btrfs_balance+0x1860/0x23f0
       btrfs_balance+0xac2/0x11b0
       btrfs_ioctl_balance+0x3d3/0x610
       __se_sys_ioctl+0xfc/0x170
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #2 (btrfs_trans_num_extwriters){++++}-{0:0}:
       lock_acquire+0x120/0x360
       join_transaction+0x1a4/0xd70
       start_transaction+0x6b6/0x1620
       btrfs_setattr+0x59c/0x10b0
       notify_change+0xb36/0xe40
       do_truncate+0x1a4/0x220
       do_ftruncate+0x489/0x540
       __x64_sys_ftruncate+0x92/0xf0
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (btrfs_trans_num_writers){++++}-{0:0}:
       lock_acquire+0x120/0x360
       join_transaction+0x182/0xd70
       start_transaction+0x6b6/0x1620
       btrfs_setattr+0x59c/0x10b0
       notify_change+0xb36/0xe40
       do_truncate+0x1a4/0x220
       do_ftruncate+0x489/0x540
       __x64_sys_ftruncate+0x92/0xf0
       do_syscall_64+0xfa/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (sb_internal#2){.+.+}-{0:0}:
       validate_chain+0xb9b/0x2140
       __lock_acquire+0xab9/0xd20
       lock_acquire+0x120/0x360
       start_transaction+0x56e/0x1620
       btrfs_finish_one_ordered+0x573/0x1fd0
       btrfs_work_helper+0x39c/0xc20
       process_scheduled_works+0xae1/0x17b0
       worker_thread+0x8a0/0xda0
       kthread+0x711/0x8a0
       ret_from_fork+0x439/0x7d0
       ret_from_fork_asm+0x1a/0x30

other info that might help us debug this:

Chain exists of:
  sb_internal#2 --> &ei->i_mmap_lock --> btrfs_ordered_extent

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(btrfs_ordered_extent);
                               lock(&ei->i_mmap_lock);
                               lock(btrfs_ordered_extent);
  rlock(sb_internal#2);

 *** DEADLOCK ***

3 locks held by kworker/u10:7/10943:
 #0: ffff88811d9fa148 ((wq_completion)btrfs-endio-write){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
 #1: ffffc90002e57bc0 ((work_completion)(&work->normal_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
 #2: ffff88811f1d2628 (btrfs_ordered_extent){++++}-{0:0}, at: btrfs_finish_one_ordered+0x30e/0x1fd0

stack backtrace:
CPU: 1 UID: 0 PID: 10943 Comm: kworker/u10:7 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: btrfs-endio-write btrfs_work_helper
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250
 print_circular_bug+0x2ee/0x310
 check_noncircular+0x134/0x160
 validate_chain+0xb9b/0x2140
 __lock_acquire+0xab9/0xd20
 lock_acquire+0x120/0x360
 start_transaction+0x56e/0x1620
 btrfs_finish_one_ordered+0x573/0x1fd0
 btrfs_work_helper+0x39c/0xc20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x439/0x7d0
 ret_from_fork_asm+0x1a/0x30
 </TASK>
