program: bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000004201e48ac34ac2fab4518e60c48da440f2b48e7e16fc3ed3f72551bb2113661742a6a072efc5c51dd516a5837b91a5074882f8ba56e22118a27b35ff7f387e8fe4b53db232fea7e14f099cbaaf74c29cd1cfdbc68a8a6c866740bd9ef7bc403dfeba33e12754a563d71e5eab", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000e40)={0x30, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @val={0x2d, 0x1a, {0x400, 0x1, 0x0, 0x0, {0x401, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x3}, 0x8, 0x8, 0xd}}, @void, @void}, 0x4b) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r4 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r8, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r10 = socket(0x11, 0x80a, 0x1) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11, 0x40, 0x1040}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x4}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000008c0)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, '\x00', 0x18, 0x3a, 0x1, @local, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x7, '\x00', @remote}}}}}}, 0x0) getdents(r4, &(0x7f0000001fc0)=""/184, 0x18) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x150, 0x168, 0x9, 0x150, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}, {[], 0x74c8aad696aabd1d}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000480)=ANY=[@ANYBLOB="300000000802111000ea2e2994dd45a31920ff48c113dad808a220c2b33d7d7002110000001000000002000000100121"], 0x21) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="10000000080211000001"], 0x20) [ 86.395647][ T5270] Bluetooth: hci0: command tx timeout [ 86.532048][ T1362] cfg80211: failed to load regulatory.db [ 86.572688][ T5311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 86.654093][ T5312] jffs2: notice: (5312) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 86.681480][ T5311] loop0: detected capacity change from 0 to 2048 [ 86.719896][ T5311] loop0: p2 p3 < > p4 < p5 > [ 86.728207][ T5311] loop0: partition table partially beyond EOD, truncated [ 86.743995][ T5311] loop0: p3 start 4225 is beyond EOD, truncated [ 86.809598][ T5311] netlink: 'syz.0.0': attribute type 10 has an invalid length. [ 86.818957][ T76] [ 86.820109][ T76] ====================================================== [ 86.823041][ T76] WARNING: possible circular locking dependency detected [ 86.826019][ T76] syzkaller #0 Not tainted [ 86.827961][ T76] ------------------------------------------------------ [ 86.830944][ T76] kswapd0/76 is trying to acquire lock: [ 86.833393][ T76] ffff8880123db760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 86.840343][ T76] [ 86.840343][ T76] but task is already holding lock: [ 86.843552][ T76] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 86.846959][ T76] [ 86.846959][ T76] which lock already depends on the new lock. [ 86.846959][ T76] [ 86.851332][ T76] [ 86.851332][ T76] the existing dependency chain (in reverse order) is: [ 86.855190][ T76] [ 86.855190][ T76] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 86.858274][ T76] fs_reclaim_acquire+0x71/0x100 [ 86.860477][ T76] kmem_cache_alloc_noprof+0x64/0x5f0 [ 86.863049][ T76] jffs2_do_read_inode+0x33f/0x6a0 [ 86.865175][ T76] jffs2_iget+0x228/0xcc0 [ 86.867143][ T76] jffs2_do_fill_super+0x59d/0xc50 [ 86.869377][ T76] mtd_get_sb+0x18a/0x410 [ 86.871268][ T76] get_tree_mtd+0x597/0x7d0 [ 86.873154][ T76] vfs_get_tree+0x92/0x2a0 [ 86.875084][ T76] do_new_mount+0x319/0xdc0 [ 86.877039][ T76] __se_sys_mount+0x31d/0x420 [ 86.879067][ T76] do_syscall_64+0x174/0x580 [ 86.881167][ T76] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.883862][ T76] [ 86.883862][ T76] -> #0 (&f->sem){+.+.}-{4:4}: [ 86.886870][ T76] __lock_acquire+0x1520/0x2cf0 [ 86.889149][ T76] lock_acquire+0x106/0x350 [ 86.891346][ T76] __mutex_lock+0x19d/0x1550 [ 86.893544][ T76] jffs2_do_clear_inode+0x62/0x390 [ 86.895928][ T76] evict+0x624/0xb50 [ 86.897931][ T76] prune_icache_sb+0x223/0x2d0 [ 86.900098][ T76] super_cache_scan+0x38d/0x4a0 [ 86.902466][ T76] do_shrink_slab+0x6d0/0x10e0 [ 86.904807][ T76] shrink_slab+0x838/0x1220 [ 86.906839][ T76] shrink_one+0x2a2/0x730 [ 86.908879][ T76] shrink_node+0x3303/0x3b60 [ 86.910976][ T76] kswapd+0x17b6/0x31c0 [ 86.912858][ T76] kthread+0x388/0x470 [ 86.914761][ T76] ret_from_fork+0x514/0xb70 [ 86.916853][ T76] ret_from_fork_asm+0x1a/0x30 [ 86.919016][ T76] [ 86.919016][ T76] other info that might help us debug this: [ 86.919016][ T76] [ 86.923074][ T76] Possible unsafe locking scenario: [ 86.923074][ T76] [ 86.926080][ T76] CPU0 CPU1 [ 86.928282][ T76] ---- ---- [ 86.930502][ T76] lock(fs_reclaim); [ 86.932333][ T76] lock(&f->sem); [ 86.935035][ T76] lock(fs_reclaim); [ 86.937829][ T76] lock(&f->sem); [ 86.939451][ T76] [ 86.939451][ T76] *** DEADLOCK *** [ 86.939451][ T76] [ 86.942854][ T76] 2 locks held by kswapd0/76: [ 86.944852][ T76] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 86.948440][ T76] #1: ffff8880129300d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 86.952703][ T76] [ 86.952703][ T76] stack backtrace: [ 86.955274][ T76] CPU: 0 UID: 0 PID: 76 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 86.955289][ T76] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.955295][ T76] Call Trace: [ 86.955301][ T76] [ 86.955306][ T76] dump_stack_lvl+0xe8/0x150 [ 86.955323][ T76] print_circular_bug+0x2e1/0x300 [ 86.955339][ T76] check_noncircular+0x12e/0x150 [ 86.955353][ T76] __lock_acquire+0x1520/0x2cf0 [ 86.955365][ T76] ? ret_from_fork_asm+0x1a/0x30 [ 86.955381][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 86.955393][ T76] lock_acquire+0x106/0x350 [ 86.955404][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 86.955417][ T76] __mutex_lock+0x19d/0x1550 [ 86.955428][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 86.955441][ T76] ? jffs2_do_clear_inode+0x62/0x390 [ 86.955451][ T76] ? __pfx___mutex_lock+0x10/0x10 [ 86.955461][ T76] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.955470][ T76] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 86.955480][ T76] ? lockdep_hardirqs_on+0x7a/0x110 [ 86.955491][ T76] jffs2_do_clear_inode+0x62/0x390 [ 86.955502][ T76] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 86.955514][ T76] evict+0x624/0xb50 [ 86.955529][ T76] ? __pfx_evict+0x10/0x10 [ 86.955540][ T76] ? __pfx_inode_lru_isolate+0x10/0x10 [ 86.955551][ T76] ? __pfx_inode_lru_isolate+0x10/0x10 [ 86.955560][ T76] ? list_lru_walk_one+0x3c/0x50 [ 86.955572][ T76] prune_icache_sb+0x223/0x2d0 [ 86.955581][ T76] ? __pfx_prune_icache_sb+0x10/0x10 [ 86.955590][ T76] ? list_lru_count_one+0x27/0x2c0 [ 86.955601][ T76] ? list_lru_count_one+0x27/0x2c0 [ 86.955610][ T76] ? list_lru_count_one+0x27/0x2c0 [ 86.955619][ T76] ? list_lru_count_one+0x264/0x2c0 [ 86.955630][ T76] super_cache_scan+0x38d/0x4a0 [ 86.955644][ T76] do_shrink_slab+0x6d0/0x10e0 [ 86.955660][ T76] shrink_slab+0x838/0x1220 [ 86.955672][ T76] ? shrink_slab+0x1e9/0x1220 [ 86.955685][ T76] ? __pfx_shrink_slab+0x10/0x10 [ 86.955697][ T76] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 86.955708][ T76] ? shrink_node+0x2ed4/0x3b60 [ 86.955721][ T76] shrink_one+0x2a2/0x730 [ 86.955732][ T76] ? shrink_node+0x2ed4/0x3b60 [ 86.955743][ T76] shrink_node+0x3303/0x3b60 [ 86.955756][ T76] ? shrink_node+0x2ed4/0x3b60 [ 86.955768][ T76] ? percpu_ref_put+0x19/0x180 [ 86.955790][ T76] ? percpu_ref_put+0x19/0x180 [ 86.955802][ T76] ? __pfx_shrink_node+0x10/0x10 [ 86.955812][ T76] ? percpu_ref_put+0x19/0x180 [ 86.955824][ T76] ? percpu_ref_put+0x19/0x180 [ 86.955837][ T76] ? mem_cgroup_iter+0x410/0x440 [ 86.955851][ T76] ? mem_cgroup_iter+0x3b/0x440 [ 86.955864][ T76] kswapd+0x17b6/0x31c0 [ 86.955882][ T76] ? kswapd+0x9b6/0x31c0 [ 86.955897][ T76] ? __pfx_kswapd+0x10/0x10 [ 86.955908][ T76] ? trace_contention_end+0x3d/0x140 [ 86.955919][ T76] ? __lock_acquire+0x683/0x2cf0 [ 86.955933][ T76] ? kthread_affine_node+0x2b2/0x360 [ 86.955947][ T76] ? __mutex_unlock_slowpath+0x731/0x900 [ 86.955966][ T76] ? __pfx_autoremove_wake_function+0x10/0x10 [ 86.955977][ T76] ? __kthread_parkme+0x71/0x1f0 [ 86.955989][ T76] ? __kthread_parkme+0x196/0x1f0 [ 86.956001][ T76] kthread+0x388/0x470 [ 86.956015][ T76] ? __pfx_kswapd+0x10/0x10 [ 86.956027][ T76] ? __pfx_kthread+0x10/0x10 [ 86.956039][ T76] ret_from_fork+0x514/0xb70 [ 86.956055][ T76] ? __pfx_ret_from_fork+0x10/0x10 [ 86.956067][ T76] ? __switch_to+0xc89/0x1420 [ 86.956079][ T76] ? __pfx_kthread+0x10/0x10 [ 86.956092][ T76] ret_from_fork_asm+0x1a/0x30 [ 86.956110][ T76] [ 87.113569][ T5312] xt_ipcomp: unknown flags 1D [ 87.116637][ T5312] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 87.122519][ T5312] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 87.145050][ T185] bond0: (slave bond_slave_0): interface is now down [ 87.148009][ T185] bond0: (slave bond_slave_1): interface is now down [ 87.156272][ T5311] syz_tun: entered promiscuous mode [ 87.163867][ T5311] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 87.167610][ T185] bond0: (slave bond_slave_0): interface is now down [ 87.172599][ T185] bond0: (slave bond_slave_1): interface is now down [ 87.184574][ T185] bond0: (slave syz_tun): interface is now down [ 87.187801][ T185] bond0: now running without any active interface!