program: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'veth0_to_bridge\x00', 0x400}) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r3, 0x2180}, [@IFLA_CARRIER={0x5, 0x21, 0x7f}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x8080) r4 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)={0x34, r6, 0x1, 0x0, 0x0, {{}, {}, {0x18, 0x17, {0x21, 0x0, @l2={'eth', 0x3a, 'dummy0\x00'}}}}}, 0x34}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r4, &(0x7f00000008c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x400, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}}, 0x4000) open(0x0, 0x64842, 0x0) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") getdents(r4, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r7, 0x84, 0x83, &(0x7f0000000080), 0x8) setns(0xc9, 0x0) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000180)='mtd0\x00', &(0x7f00000001c0)='fusectl\x00', 0x12a8080, &(0x7f00000002c0)='\x00') r8 = socket$netlink(0x10, 0x3, 0xb) sendmsg$AUDIT_DEL_RULE(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000400)=ANY=[@ANYBLOB="20040000f403080029bd7000fddbdf25010000000100000021000000010000000600000001040000f9ffffff210a00003204000004000000ff000000020000000080000009000000050000000c000000090000000000000000020000050000000c000000060000000600000000000000ffff000009000000810000002b0900000100000004000000400000000400000009000000be000000b000000004000000020000001000000001040000020000000800000002000000070000000100000005000000030000000300000008000000ff070000fdffffffff030000050000007b00000003000000050000000012000005000000040000000103000003000000060000000000008007000000090000000600000000000100030000000900000006000000050000000100000000000000ffffffff05000000050000000700000003000000040000000300000004000000080000000500000004000000070000002a939d4306000000c40b0000050000002f0000000900000001000000080000000600000002000000f8ffffff08000000010000000600000000000080ffffff7f08000000090000000500000007000000ff000000070000000a00000009000000070000000300000002000000ef000000fff56435ffffff02000000050000000400000000100000ffffff7f04000000fdffffff010000000500000001000000000000008c00000009000000fbffffff0400000002000000060000000200000005000000030000007c090000090000000600000002000000020000000800000080ffffff040000000d0000000800000001040000090000000600000008000000ff0f000008070000000200000700000000000000fe000000000000003e6f47620010000007000000b700000008000000010000000800000006000000008000000ac700001000000032000000ffffffffc30300005500000008000000ad080000020000000800000005ac0000030000000800000000100000090000000300000007000000fffffffff8ffffff0600000009000000090000000480000007000000ad000000fdffffff04000000f708000001040000070000000700000003000000800000007f0000000080000008000000000020000c000000060000000700000007000000060000000400000000000010000001000800000010000000ffffffff0b00000007000000fbffffffff00000002000000020000000e0000000000000006000000810000000500000008000000b00100000400000008000000020000000a000000090000002b060000ffffffff030000000600000003000000010000006e00000003000000110000001f0000000600000001000080030000000800000001000080090000001000000001000080b80400000400000007000000ffffffff020000000500000000010000050000007f00000009000000000000000e00000000"], 0x420}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 93.904809][ T4636] Bluetooth: hci0: command tx timeout [ 93.971632][ T5314] jffs2: notice: (5314) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 94.021954][ T5314] syzkaller0: entered promiscuous mode [ 94.035734][ T5314] tipc: Started in network mode [ 94.038378][ T5314] tipc: Node identity aaaaaaaaaa24, cluster identity 4711 [ 94.041574][ T5314] tipc: Enabled bearer , priority 10 [ 94.060842][ T5314] loop0: detected capacity change from 0 to 2048 [ 94.089495][ T5314] loop0: p2 p3 < > p4 < p5 > [ 94.094119][ T5314] loop0: partition table partially beyond EOD, truncated [ 94.109683][ T5314] loop0: p3 start 4225 is beyond EOD, truncated [ 94.188757][ T76] [ 94.189913][ T76] ====================================================== [ 94.192750][ T76] WARNING: possible circular locking dependency detected [ 94.195585][ T76] syzkaller #0 Not tainted [ 94.197534][ T76] ------------------------------------------------------ [ 94.200600][ T76] kswapd0/76 is trying to acquire lock: [ 94.202820][ T76] ffff888011cb3760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 94.206632][ T76] [ 94.206632][ T76] but task is already holding lock: [ 94.209667][ T76] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.212969][ T76] [ 94.212969][ T76] which lock already depends on the new lock. [ 94.212969][ T76] [ 94.216937][ T76] [ 94.216937][ T76] the existing dependency chain (in reverse order) is: [ 94.220584][ T76] [ 94.220584][ T76] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 94.223483][ T76] fs_reclaim_acquire+0x71/0x100 [ 94.225729][ T76] kmem_cache_alloc_noprof+0x64/0x5f0 [ 94.228231][ T76] jffs2_do_read_inode+0x33f/0x6a0 [ 94.230684][ T76] jffs2_iget+0x228/0xcc0 [ 94.232709][ T76] jffs2_do_fill_super+0x59d/0xc50 [ 94.235026][ T76] mtd_get_sb+0x18a/0x410 [ 94.237090][ T76] get_tree_mtd+0x597/0x7d0 [ 94.239209][ T76] vfs_get_tree+0x92/0x2a0 [ 94.241305][ T76] do_new_mount+0x319/0xdc0 [ 94.243293][ T76] __se_sys_mount+0x31d/0x420 [ 94.245339][ T76] do_syscall_64+0x174/0x580 [ 94.247409][ T76] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.249946][ T76] [ 94.249946][ T76] -> #0 (&f->sem){+.+.}-{4:4}: [ 94.252704][ T76] __lock_acquire+0x1520/0x2cf0 [ 94.254763][ T76] lock_acquire+0x106/0x350 [ 94.256865][ T76] __mutex_lock+0x19d/0x1550 [ 94.259031][ T76] jffs2_do_clear_inode+0x62/0x390 [ 94.261428][ T76] evict+0x624/0xb50 [ 94.263314][ T76] prune_icache_sb+0x223/0x2d0 [ 94.265500][ T76] super_cache_scan+0x38d/0x4a0 [ 94.267662][ T76] do_shrink_slab+0x6d0/0x10e0 [ 94.269873][ T76] shrink_slab+0x838/0x1220 [ 94.271834][ T76] shrink_one+0x2a2/0x730 [ 94.273843][ T76] shrink_node+0x3303/0x3b60 [ 94.275985][ T76] kswapd+0x17b6/0x31c0 [ 94.277882][ T76] kthread+0x388/0x470 [ 94.279852][ T76] ret_from_fork+0x514/0xb70 [ 94.281884][ T76] ret_from_fork_asm+0x1a/0x30 [ 94.283958][ T76] [ 94.283958][ T76] other info that might help us debug this: [ 94.283958][ T76] [ 94.292736][ T76] Possible unsafe locking scenario: [ 94.292736][ T76] [ 94.295629][ T76] CPU0 CPU1 [ 94.298043][ T76] ---- ---- [ 94.300220][ T76] lock(fs_reclaim); [ 94.302037][ T76] lock(&f->sem); [ 94.304548][ T76] lock(fs_reclaim); [ 94.307198][ T76] lock(&f->sem); [ 94.308774][ T76] [ 94.308774][ T76] *** DEADLOCK *** [ 94.308774][ T76] [ 94.312189][ T76] 2 locks held by kswapd0/76: [ 94.314277][ T76] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.317832][ T76] #1: ffff88801c3240d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 94.322101][ T76] [ 94.322101][ T76] stack backtrace: [ 94.324586][ T76] CPU: 0 UID: 0 PID: 76 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 94.324599][ T76] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.324605][ T76] Call Trace: [ 94.324614][ T76] [ 94.324620][ T76] dump_stack_lvl+0xe8/0x150 [ 94.324638][ T76] print_circular_bug+0x2e1/0x300 [ 94.324655][ T76] check_noncircular+0x12e/0x150 [ 94.324670][ T76] __lock_acquire+0x1520/0x2cf0 [ 94.324685][ T76] ? ret_from_fork_asm+0x1a/0x30 [ 94.324700][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 94.324714][ T76] lock_acquire+0x106/0x350 [ 94.324725][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 94.324741][ T76] __mutex_lock+0x19d/0x1550 [ 94.324754][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 94.324767][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 94.324781][ T76] ? __pfx___mutex_lock+0x10/0x10 [ 94.324791][ T76] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.324802][ T76] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 94.324815][ T76] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.324826][ T76] jffs2_do_clear_inode+0x62/0x390 [ 94.324840][ T76] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 94.324853][ T76] evict+0x624/0xb50 [ 94.324870][ T76] ? __pfx_evict+0x10/0x10 [ 94.324882][ T76] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.324892][ T76] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.324904][ T76] ? list_lru_walk_one+0x3c/0x50 [ 94.324915][ T76] prune_icache_sb+0x223/0x2d0 [ 94.324926][ T76] ? __pfx_prune_icache_sb+0x10/0x10 [ 94.324937][ T76] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 94.324947][ T76] ? __rcu_read_unlock+0x83/0xe0 [ 94.324956][ T76] ? list_lru_count_one+0x27/0x2c0 [ 94.324969][ T76] ? list_lru_count_one+0x264/0x2c0 [ 94.324980][ T76] super_cache_scan+0x38d/0x4a0 [ 94.324995][ T76] do_shrink_slab+0x6d0/0x10e0 [ 94.325009][ T76] shrink_slab+0x838/0x1220 [ 94.325020][ T76] ? shrink_slab+0x1e9/0x1220 [ 94.325033][ T76] ? __pfx_shrink_slab+0x10/0x10 [ 94.325044][ T76] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 94.325056][ T76] ? shrink_node+0x2ed4/0x3b60 [ 94.325068][ T76] shrink_one+0x2a2/0x730 [ 94.325078][ T76] ? shrink_node+0x2ed4/0x3b60 [ 94.325087][ T76] shrink_node+0x3303/0x3b60 [ 94.325101][ T76] ? shrink_node+0x2ed4/0x3b60 [ 94.325118][ T76] ? percpu_ref_put+0x19/0x180 [ 94.325130][ T76] ? percpu_ref_put+0x19/0x180 [ 94.325143][ T76] ? __pfx_shrink_node+0x10/0x10 [ 94.325152][ T76] ? percpu_ref_put+0x19/0x180 [ 94.325161][ T76] ? percpu_ref_put+0x19/0x180 [ 94.325175][ T76] ? mem_cgroup_iter+0x410/0x440 [ 94.325189][ T76] ? mem_cgroup_iter+0x3b/0x440 [ 94.325203][ T76] kswapd+0x17b6/0x31c0 [ 94.325219][ T76] ? kswapd+0x9b6/0x31c0 [ 94.325233][ T76] ? __pfx_kswapd+0x10/0x10 [ 94.325245][ T76] ? trace_contention_end+0x3d/0x140 [ 94.325255][ T76] ? __lock_acquire+0x683/0x2cf0 [ 94.325269][ T76] ? kthread_affine_node+0x2b2/0x360 [ 94.325281][ T76] ? __mutex_unlock_slowpath+0x731/0x900 [ 94.325303][ T76] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.325312][ T76] ? __kthread_parkme+0x71/0x1f0 [ 94.325327][ T76] ? __kthread_parkme+0x196/0x1f0 [ 94.325340][ T76] kthread+0x388/0x470 [ 94.325351][ T76] ? __pfx_kswapd+0x10/0x10 [ 94.325362][ T76] ? __pfx_kthread+0x10/0x10 [ 94.325375][ T76] ret_from_fork+0x514/0xb70 [ 94.325396][ T76] ? __pfx_ret_from_fork+0x10/0x10 [ 94.325408][ T76] ? __switch_to+0xc89/0x1420 [ 94.325419][ T76] ? __pfx_kthread+0x10/0x10 [ 94.325433][ T76] ret_from_fork_asm+0x1a/0x30 [ 94.325448][ T76]