====================================================== WARNING: possible circular locking dependency detected 6.0.0-rc6-syzkaller #0 Not tainted ------------------------------------------------------ syz-fuzzer/3663 is trying to acquire lock: ffff88801afd0990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xfb4/0x14a0 fs/jbd2/transaction.c:461 but task is already holding lock: ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4723 [inline] ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4748 [inline] ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x84f/0x2240 mm/page_alloc.c:5151 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (fs_reclaim){+.+.}-{0:0}: __fs_reclaim_acquire mm/page_alloc.c:4674 [inline] fs_reclaim_acquire+0x115/0x160 mm/page_alloc.c:4688 might_alloc include/linux/sched/mm.h:271 [inline] slab_pre_alloc_hook mm/slab.h:700 [inline] slab_alloc_node mm/slab.c:3194 [inline] kmem_cache_alloc_node_trace+0x47/0x570 mm/slab.c:3601 kmalloc_node include/linux/slab.h:618 [inline] kzalloc_node include/linux/slab.h:744 [inline] mempool_create_node mm/mempool.c:266 [inline] mempool_create+0x4e/0xc0 mm/mempool.c:255 mempool_create_page_pool include/linux/mempool.h:107 [inline] fscrypt_initialize+0x86/0xa0 fs/crypto/crypto.c:330 fscrypt_setup_encryption_info+0xef/0xe90 fs/crypto/keysetup.c:538 fscrypt_get_encryption_info+0x34a/0x3f0 fs/crypto/keysetup.c:647 fscrypt_setup_filename+0x238/0xec0 fs/crypto/fname.c:458 ext4_fname_setup_filename+0x88/0x110 fs/ext4/crypto.c:28 ext4_find_entry+0x8c/0x140 fs/ext4/namei.c:1720 ext4_rename+0x4d1/0x2650 fs/ext4/namei.c:3809 ext4_rename2+0x1c3/0x270 fs/ext4/namei.c:4164 vfs_rename+0x115e/0x1a90 fs/namei.c:4756 do_renameat2+0xb5e/0xc80 fs/namei.c:4907 __do_sys_renameat2 fs/namei.c:4940 [inline] __se_sys_renameat2 fs/namei.c:4937 [inline] __x64_sys_renameat2+0xe4/0x120 fs/namei.c:4937 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #1 (fscrypt_init_mutex){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x12f/0x1350 kernel/locking/mutex.c:747 fscrypt_initialize+0x3c/0xa0 fs/crypto/crypto.c:324 fscrypt_setup_encryption_info+0xef/0xe90 fs/crypto/keysetup.c:538 fscrypt_get_encryption_info+0x34a/0x3f0 fs/crypto/keysetup.c:647 fscrypt_setup_filename+0x238/0xec0 fs/crypto/fname.c:458 ext4_fname_setup_filename+0x88/0x110 fs/ext4/crypto.c:28 ext4_add_entry+0x3aa/0xef0 fs/ext4/namei.c:2367 ext4_rename+0x190a/0x2650 fs/ext4/namei.c:3884 ext4_rename2+0x1c3/0x270 fs/ext4/namei.c:4164 vfs_rename+0x115e/0x1a90 fs/namei.c:4756 do_renameat2+0xb5e/0xc80 fs/namei.c:4907 __do_sys_renameat2 fs/namei.c:4940 [inline] __se_sys_renameat2 fs/namei.c:4937 [inline] __x64_sys_renameat2+0xe4/0x120 fs/namei.c:4937 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #0 (jbd2_handle){++++}-{0:0}: check_prev_add kernel/locking/lockdep.c:3095 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x2a43/0x56d0 kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 start_this_handle+0xfe7/0x14a0 fs/jbd2/transaction.c:463 jbd2__journal_start+0x38c/0x910 fs/jbd2/transaction.c:520 __ext4_journal_start_sb+0x3a3/0x490 fs/ext4/ext4_jbd2.c:105 __ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline] ext4_dirty_inode+0x9d/0x110 fs/ext4/inode.c:5963 __mark_inode_dirty+0x48b/0x1040 fs/fs-writeback.c:2381 mark_inode_dirty_sync include/linux/fs.h:2467 [inline] iput.part.0+0x57/0x810 fs/inode.c:1771 iput+0x58/0x70 fs/inode.c:1764 dentry_unlink_inode+0x2b1/0x460 fs/dcache.c:401 __dentry_kill+0x3c0/0x640 fs/dcache.c:607 shrink_dentry_list+0x23c/0x800 fs/dcache.c:1201 prune_dcache_sb+0xe7/0x140 fs/dcache.c:1282 super_cache_scan+0x336/0x590 fs/super.c:104 do_shrink_slab+0x428/0xbd0 mm/vmscan.c:831 shrink_slab_memcg mm/vmscan.c:900 [inline] shrink_slab+0x3e9/0x6f0 mm/vmscan.c:979 shrink_node_memcgs mm/vmscan.c:3182 [inline] shrink_node+0x8c9/0x1e80 mm/vmscan.c:3304 shrink_zones mm/vmscan.c:3542 [inline] do_try_to_free_pages+0x3b4/0x17a0 mm/vmscan.c:3601 try_to_free_pages+0x2a7/0x840 mm/vmscan.c:3836 __perform_reclaim mm/page_alloc.c:4726 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4748 [inline] __alloc_pages_slowpath.constprop.0+0x8f8/0x2240 mm/page_alloc.c:5151 __alloc_pages+0x43d/0x510 mm/page_alloc.c:5528 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270 folio_alloc+0x1c/0x70 mm/mempolicy.c:2280 filemap_alloc_folio+0x306/0x3a0 mm/filemap.c:970 __filemap_get_folio+0x328/0xed0 mm/filemap.c:1970 filemap_fault+0x16ad/0x2610 mm/filemap.c:3130 __do_fault+0x10d/0x610 mm/memory.c:4173 do_read_fault mm/memory.c:4518 [inline] do_fault mm/memory.c:4647 [inline] handle_pte_fault mm/memory.c:4911 [inline] __handle_mm_fault+0x2130/0x39b0 mm/memory.c:5053 handle_mm_fault+0x1c8/0x780 mm/memory.c:5151 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1397 handle_page_fault arch/x86/mm/fault.c:1488 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1544 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 other info that might help us debug this: Chain exists of: jbd2_handle --> fscrypt_init_mutex --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(fscrypt_init_mutex); lock(fs_reclaim); lock(jbd2_handle); *** DEADLOCK *** 4 locks held by syz-fuzzer/3663: #0: ffff888028abfae0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline] #0: ffff888028abfae0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x1666/0x2610 mm/filemap.c:3127 #1: ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4723 [inline] #1: ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4748 [inline] #1: ffffffff8c0be7e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x84f/0x2240 mm/page_alloc.c:5151 #2: ffffffff8c07e7f0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab_memcg mm/vmscan.c:873 [inline] #2: ffffffff8c07e7f0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x2b4/0x6f0 mm/vmscan.c:979 #3: ffff88801afcc0e0 (&type->s_umount_key#50){++++}-{3:3}, at: trylock_super fs/super.c:415 [inline] #3: ffff88801afcc0e0 (&type->s_umount_key#50){++++}-{3:3}, at: super_cache_scan+0x6c/0x590 fs/super.c:79 stack backtrace: CPU: 2 PID: 3663 Comm: syz-fuzzer Not tainted 6.0.0-rc6-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3095 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x2a43/0x56d0 kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 start_this_handle+0xfe7/0x14a0 fs/jbd2/transaction.c:463 jbd2__journal_start+0x38c/0x910 fs/jbd2/transaction.c:520 __ext4_journal_start_sb+0x3a3/0x490 fs/ext4/ext4_jbd2.c:105 __ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline] ext4_dirty_inode+0x9d/0x110 fs/ext4/inode.c:5963 __mark_inode_dirty+0x48b/0x1040 fs/fs-writeback.c:2381 mark_inode_dirty_sync include/linux/fs.h:2467 [inline] iput.part.0+0x57/0x810 fs/inode.c:1771 iput+0x58/0x70 fs/inode.c:1764 dentry_unlink_inode+0x2b1/0x460 fs/dcache.c:401 __dentry_kill+0x3c0/0x640 fs/dcache.c:607 shrink_dentry_list+0x23c/0x800 fs/dcache.c:1201 prune_dcache_sb+0xe7/0x140 fs/dcache.c:1282 super_cache_scan+0x336/0x590 fs/super.c:104 do_shrink_slab+0x428/0xbd0 mm/vmscan.c:831 shrink_slab_memcg mm/vmscan.c:900 [inline] shrink_slab+0x3e9/0x6f0 mm/vmscan.c:979 shrink_node_memcgs mm/vmscan.c:3182 [inline] shrink_node+0x8c9/0x1e80 mm/vmscan.c:3304 shrink_zones mm/vmscan.c:3542 [inline] do_try_to_free_pages+0x3b4/0x17a0 mm/vmscan.c:3601 try_to_free_pages+0x2a7/0x840 mm/vmscan.c:3836 __perform_reclaim mm/page_alloc.c:4726 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4748 [inline] __alloc_pages_slowpath.constprop.0+0x8f8/0x2240 mm/page_alloc.c:5151 __alloc_pages+0x43d/0x510 mm/page_alloc.c:5528 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270 folio_alloc+0x1c/0x70 mm/mempolicy.c:2280 filemap_alloc_folio+0x306/0x3a0 mm/filemap.c:970 __filemap_get_folio+0x328/0xed0 mm/filemap.c:1970 filemap_fault+0x16ad/0x2610 mm/filemap.c:3130 __do_fault+0x10d/0x610 mm/memory.c:4173 do_read_fault mm/memory.c:4518 [inline] do_fault mm/memory.c:4647 [inline] handle_pte_fault mm/memory.c:4911 [inline] __handle_mm_fault+0x2130/0x39b0 mm/memory.c:5053 handle_mm_fault+0x1c8/0x780 mm/memory.c:5151 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1397 handle_page_fault arch/x86/mm/fault.c:1488 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1544 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0x441df2 Code: 48 89 4b 20 31 ff eb 50 48 8b 7b 20 48 81 c7 80 96 98 00 0f 1f 44 00 00 48 39 f9 7c 2d 48 89 7c 24 20 48 89 d8 e8 2e 02 00 00 <48> 8b 4c 24 40 48 8b 54 24 20 48 39 d1 48 8b 44 24 18 48 8b 54 24 RSP: 002b:000000c00003def0 EFLAGS: 00010206 RAX: 0000000000000001 RBX: 000000c000021000 RCX: 000000c000080000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000042ae2c2440 RBP: 000000c00003df20 R08: 000000000002a83d R09: 00007ffcca48c080 R10: 00007ffcca48c090 R11: 000000000000d9d0 R12: 000000c00003df10 R13: 000000c016ee2800 R14: 000000c0000004e0 R15: 00007f0feeeec927