program: ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000280)={'veth0\x00', {0x2, 0x4e22, @broadcast}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@printk={@llu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x20000, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f00000000c0)={[{@orlov}, {@errors_remount}]}, 0x3, 0x5eb, &(0x7f0000000c00)="$eJzs3ctvFEcaAPCvxw9sjNYDWu0ue1gsrVYg7WJjAysU5QDXCFnkoVxyiYMNIRiwsKPEJBJGIpdIUS5RFCmnHEL+iwSFK6fklEMuOUVIKIk4RspEPdNtPHaPX9jTiP79pGG6q6Zd1djfVHVNVU8AlTWS/lOLOBgRc0nEcLK0nNcbWeZI63WPfnv/fPpIotF4+Zckkiwtf32SPQ9lBw9ExHffJnGgZ22584s3Lk/Nzs5cz/bHFq7Mjc0v3jh66crUxZmLM1cn/j9x6uSJk6fGj23rvG4WpJ29/dY7wx9Ovvbl578n41/9OJnE6Xghe+HK89gpIzHS/D9J1mYNndrpwkrSk/2dNBqNRp6W9JZbJzYv//31RcTfYzh64vEvbzg+eLHUygG7qpG03ruBKkrEP1RU3g/Ir+1XXwfXSumVAN3w8ExrAGBt/Pe2xgZjoDk2sPdREiuHdZKI2N7IXLt9EXH/3uTtC/cmb8cujcMBxZZuRcQ/iuI/acZ/PQai3oz/Wlv8p/2Cc9lzmv7SNstfPVQs/qF7WvE/sG78R4f4fz19vtmK4Te2WX798eabg23xP7jdUwIAAAAAAIDKunsmIv5X9Pl/bXn+TxTM/xmKiNM7UP7Iqv21n//XHuxAMUCBh2cini+c/1vLZ//We1YsYa1HX3Lh0uzMsYj4S0Qcib496f74OmUc/ejAZ53yRrL5f/kjLf9+Nhcwq8eD3j3tx0xPLUw9wSkDmYe3Iv5ZOP83WW7/k4L2P31nmNtkGQf+c+dcp7yN4x/YLY0vIg4Xtv+P71qRrH9/jrFmf2As7xWs9a/3Pv66U/nbjX+3mIAnl7b/e9eP/3qy8n4981sv4/hib6NT3nb7//3JK827CvVnae9OLSxcH4/oT872pKlt6RNbrzM8i/J4yOMljf8j/15//K+o/z8YEUurfnbya/ua4tzf/hj6qVN99P+hPGn8T2+p/d/6xsSd+jedyt9c+3+i2dYfyVKM/0HLp3mY9renF4Rjb1FWt+sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+CWkTsi6Q2urxdq42ORgxFxF9jb2322vzCfy9ce/vqdJrX/P7/Wv5Nv8Ot/ST//v/6iv2JVfvHI2J/RHzSM9jcHz1/bXa67JMHAAAAAAAAAAAAAAAAAACAp8RQh/X/qZ97yq4dsOt6y64AUJqC+P++jHoA3af9h+oS/1Bd4h+qS/xDdYl/qC7xD9Ul/qG6xD8AAAAAADxT9h+6+0MSEUvPDTYfqf4sr6/UmgG7rVZ2BYDSuMUPVJepP1BdrvGBZIP8gY4HbXTkeubOP8HBAAAAAAAAAAAAAFA5hw9a/w9VZf0/VJf1/1Bd+fr/QyXXA+g+1/hAbLCSv3D9/4ZHAQAAAAAAAAAAAAA7aX7xxuWp2dmZ6zZefTqq0c2NRqNxM/0reFrqs/MbSTZDvSuF5lPhu3+m/Zs5wXyt3+Z+cnnvSQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQLs/AwAA//+JjCTl") timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = open(&(0x7f0000000200)='./file1\x00', 0x4827e, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000002c0)='itimer_state\x00', 0xffffffffffffffff, 0x0, 0xb5d1}, 0x18) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, &(0x7f00000001c0)) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000600)={0xee, 0x989f, 0x8, "d5a29cb9c5695e5e6f81928a0ee41eca93d8554e70dd544b11aac74ad94a73d7c1bac425a375d70b9a602296ef18979d58f6ae5f10aaa3b7ae86abef957d33886f56b4fd1fe0c87b0682e935e78d07f869139183932fc486122b89cdfbcd1b4ce03adc174aba5b1b6838a873552a4efcf73189b9cf3653c312bd3ebc931d1dd0f19157166b4442d3c8d1d0e82f87a2e0008687d258bd63a11814a84f289f6b941580a60c98ac7e5f77c5dbb03d7eef6281151eaf552414b8fab13fbf167cfdeb09127f62f129b9a3bc1b9d8e2c927cd09b1d9b06602bc7b7388844b7fcb51762095353354f695fb83b5d870f7c47"}) pwritev2(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="85", 0xfffffd05}], 0x1, 0x1600, 0x0, 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000180)={0xff, 0xc0, 0x6, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0) [ 93.699546][ T4642] Bluetooth: hci0: command tx timeout [ 93.779234][ T5320] loop0: detected capacity change from 0 to 1024 [ 93.786412][ T5320] EXT4-fs: Ignoring removed orlov option [ 93.858472][ T5320] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.890550][ T5320] jffs2: notice: (5320) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 94.280594][ T69] [ 94.281678][ T69] ====================================================== [ 94.284665][ T69] WARNING: possible circular locking dependency detected [ 94.287657][ T69] syzkaller #0 Not tainted [ 94.289609][ T69] ------------------------------------------------------ [ 94.292607][ T69] kswapd0/69 is trying to acquire lock: [ 94.294991][ T69] ffff888013242c60 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 94.298630][ T69] [ 94.298630][ T69] but task is already holding lock: [ 94.301845][ T69] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.305334][ T69] [ 94.305334][ T69] which lock already depends on the new lock. [ 94.305334][ T69] [ 94.309668][ T69] [ 94.309668][ T69] the existing dependency chain (in reverse order) is: [ 94.313324][ T69] [ 94.313324][ T69] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 94.316481][ T69] fs_reclaim_acquire+0x71/0x100 [ 94.318738][ T69] kmem_cache_alloc_noprof+0x64/0x5f0 [ 94.321350][ T69] jffs2_do_read_inode+0x33f/0x6a0 [ 94.323706][ T69] jffs2_iget+0x228/0xcc0 [ 94.325737][ T69] jffs2_do_fill_super+0x59d/0xc50 [ 94.328082][ T69] mtd_get_sb+0x18a/0x410 [ 94.330148][ T69] get_tree_mtd+0x597/0x7d0 [ 94.332179][ T69] vfs_get_tree+0x92/0x2a0 [ 94.334232][ T69] do_new_mount+0x319/0xdc0 [ 94.336360][ T69] __se_sys_mount+0x31d/0x420 [ 94.338564][ T69] do_syscall_64+0x174/0x580 [ 94.340628][ T69] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.343366][ T69] [ 94.343366][ T69] -> #0 (&f->sem){+.+.}-{4:4}: [ 94.346312][ T69] __lock_acquire+0x1520/0x2cf0 [ 94.348459][ T69] lock_acquire+0x106/0x350 [ 94.350635][ T69] __mutex_lock+0x19d/0x1550 [ 94.352701][ T69] jffs2_do_clear_inode+0x62/0x390 [ 94.354847][ T69] evict+0x624/0xb50 [ 94.356562][ T69] prune_icache_sb+0x223/0x2d0 [ 94.358520][ T69] super_cache_scan+0x38d/0x4a0 [ 94.360692][ T69] do_shrink_slab+0x6d0/0x10e0 [ 94.362803][ T69] shrink_slab+0x838/0x1220 [ 94.364885][ T69] shrink_one+0x2a2/0x730 [ 94.366867][ T69] shrink_node+0x3303/0x3b60 [ 94.369127][ T69] kswapd+0x17b6/0x31c0 [ 94.371197][ T69] kthread+0x388/0x470 [ 94.372974][ T69] ret_from_fork+0x514/0xb70 [ 94.375087][ T69] ret_from_fork_asm+0x1a/0x30 [ 94.377488][ T69] [ 94.377488][ T69] other info that might help us debug this: [ 94.377488][ T69] [ 94.381925][ T69] Possible unsafe locking scenario: [ 94.381925][ T69] [ 94.385100][ T69] CPU0 CPU1 [ 94.387370][ T69] ---- ---- [ 94.389654][ T69] lock(fs_reclaim); [ 94.391393][ T69] lock(&f->sem); [ 94.393960][ T69] lock(fs_reclaim); [ 94.396728][ T69] lock(&f->sem); [ 94.398412][ T69] [ 94.398412][ T69] *** DEADLOCK *** [ 94.398412][ T69] [ 94.401712][ T69] 2 locks held by kswapd0/69: [ 94.403728][ T69] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.406974][ T69] #1: ffff888012fa00d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 94.410998][ T69] [ 94.410998][ T69] stack backtrace: [ 94.413443][ T69] CPU: 0 UID: 0 PID: 69 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 94.413457][ T69] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.413464][ T69] Call Trace: [ 94.413469][ T69] [ 94.413473][ T69] dump_stack_lvl+0xe8/0x150 [ 94.413490][ T69] print_circular_bug+0x2e1/0x300 [ 94.413507][ T69] check_noncircular+0x12e/0x150 [ 94.413521][ T69] __lock_acquire+0x1520/0x2cf0 [ 94.413533][ T69] ? ret_from_fork_asm+0x1a/0x30 [ 94.413550][ T69] ? jffs2_do_clear_inode+0x62/0x390 [ 94.413563][ T69] lock_acquire+0x106/0x350 [ 94.413575][ T69] ? jffs2_do_clear_inode+0x62/0x390 [ 94.413589][ T69] __mutex_lock+0x19d/0x1550 [ 94.413601][ T69] ? jffs2_do_clear_inode+0x62/0x390 [ 94.413615][ T69] ? jffs2_do_clear_inode+0x62/0x390 [ 94.413627][ T69] ? __pfx___mutex_lock+0x10/0x10 [ 94.413638][ T69] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.413650][ T69] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 94.413661][ T69] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.413670][ T69] jffs2_do_clear_inode+0x62/0x390 [ 94.413679][ T69] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 94.413687][ T69] evict+0x624/0xb50 [ 94.413700][ T69] ? __pfx_evict+0x10/0x10 [ 94.413712][ T69] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.413722][ T69] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.413731][ T69] ? list_lru_walk_one+0x3c/0x50 [ 94.413743][ T69] prune_icache_sb+0x223/0x2d0 [ 94.413753][ T69] ? __pfx_prune_icache_sb+0x10/0x10 [ 94.413762][ T69] ? list_lru_count_one+0x27/0x2c0 [ 94.413772][ T69] ? list_lru_count_one+0x27/0x2c0 [ 94.413781][ T69] ? list_lru_count_one+0x27/0x2c0 [ 94.413792][ T69] ? list_lru_count_one+0x264/0x2c0 [ 94.413802][ T69] super_cache_scan+0x38d/0x4a0 [ 94.413817][ T69] do_shrink_slab+0x6d0/0x10e0 [ 94.413830][ T69] shrink_slab+0x838/0x1220 [ 94.413837][ T69] ? shrink_slab+0x1e9/0x1220 [ 94.413845][ T69] ? __pfx_shrink_slab+0x10/0x10 [ 94.413852][ T69] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 94.413859][ T69] ? shrink_node+0x2ed4/0x3b60 [ 94.413866][ T69] shrink_one+0x2a2/0x730 [ 94.413875][ T69] ? shrink_node+0x2ed4/0x3b60 [ 94.413883][ T69] shrink_node+0x3303/0x3b60 [ 94.413901][ T69] ? shrink_node+0x2ed4/0x3b60 [ 94.413914][ T69] ? percpu_ref_put+0x19/0x180 [ 94.413927][ T69] ? percpu_ref_put+0x19/0x180 [ 94.413938][ T69] ? __pfx_shrink_node+0x10/0x10 [ 94.413949][ T69] ? percpu_ref_put+0x19/0x180 [ 94.413960][ T69] ? percpu_ref_put+0x19/0x180 [ 94.413971][ T69] ? mem_cgroup_iter+0x410/0x440 [ 94.413984][ T69] ? mem_cgroup_iter+0x3b/0x440 [ 94.413996][ T69] kswapd+0x17b6/0x31c0 [ 94.414012][ T69] ? kswapd+0x9b6/0x31c0 [ 94.414026][ T69] ? __pfx_kswapd+0x10/0x10 [ 94.414037][ T69] ? trace_contention_end+0x3d/0x140 [ 94.414046][ T69] ? __lock_acquire+0x683/0x2cf0 [ 94.414059][ T69] ? kthread_affine_node+0x2b2/0x360 [ 94.414072][ T69] ? __mutex_unlock_slowpath+0x731/0x900 [ 94.414089][ T69] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.414099][ T69] ? __kthread_parkme+0x71/0x1f0 [ 94.414110][ T69] ? __kthread_parkme+0x196/0x1f0 [ 94.414117][ T69] kthread+0x388/0x470 [ 94.414126][ T69] ? __pfx_kswapd+0x10/0x10 [ 94.414133][ T69] ? __pfx_kthread+0x10/0x10 [ 94.414141][ T69] ret_from_fork+0x514/0xb70 [ 94.414155][ T69] ? __pfx_ret_from_fork+0x10/0x10 [ 94.414163][ T69] ? __switch_to+0xc89/0x1420 [ 94.414170][ T69] ? __pfx_kthread+0x10/0x10 [ 94.414178][ T69] ret_from_fork_asm+0x1a/0x30 [ 94.414189][ T69]