Extracting prog: 1m41.840900771s
Minimizing prog: 4m52.97730658s
Simplifying prog options: 3m52.52881445s
Extracting C: 1m27.409877114s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-setsockopt$sock_int-shutdown-recvmmsg-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x207f, 0x4)
shutdown(0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000066c0), 0xa0d, 0x0, 0x0)
syz_emit_ethernet(0x17, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000e4ff1826a405c78e27fc37ffff0000001100464150f0008a88bc8e6f93156e71c1f556e29cd221717704dec2644ac76055098ef47bd81e1d3886298d4df53ba020b7d2d2487e294689247d587fbae30177ad1d5b670ed1db3deb5565e31831542d3165ed26947ce7cb8e42371f7bb435cd10a0e025d1295d8644bc2cd914b6e08eec724a99088ed92ec03341703f44f37bd687b8b109e9cfea05d49e16702fcba3e7c4987db4098c"], &(0x7f0000000080)={0x0, 0x3, [0x202, 0x3ce, 0x8a3, 0x687]})

program crashed: possible deadlock in zswap_store
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-setsockopt$sock_int-shutdown-recvmmsg
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x207f, 0x4)
shutdown(0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000066c0), 0xa0d, 0x0, 0x0)

program crashed: possible deadlock in zswap_store
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-setsockopt$sock_int-shutdown
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x207f, 0x4)
shutdown(0xffffffffffffffff, 0x0)

program crashed: possible deadlock in zswap_store
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-setsockopt$sock_int
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x207f, 0x4)

program did not crash
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-shutdown
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
shutdown(0xffffffffffffffff, 0x0)

program crashed: possible deadlock in zswap_store
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-shutdown
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80)
shutdown(0xffffffffffffffff, 0x0)

program crashed: possible deadlock in zswap_store
testing program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
detailed listing:
executing program 0:
shutdown(0xffffffffffffffff, 0x0)

program crashed: possible deadlock in zswap_store
extracting C reproducer
testing compiled C program (duration=44.422998822s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
program did not crash
simplifying guilty program options
testing program (duration=44.422998822s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
detailed listing:
executing program 0:
shutdown(0xffffffffffffffff, 0x0)

program crashed: possible deadlock in zswap_store
extracting C reproducer
testing compiled C program (duration=44.422998822s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
program did not crash
testing program (duration=44.422998822s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
detailed listing:
executing program 0:
shutdown(0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=44.422998822s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shutdown
detailed listing:
executing program 0:
shutdown(0xffffffffffffffff, 0x0)

program did not crash
reproducing took 11m38.812249145s
repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0 Not tainted
------------------------------------------------------
syz-executor/5327 is trying to acquire lock:
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_compress mm/zswap.c:931 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_store_page mm/zswap.c:1456 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_store+0xa3b/0x1c30 mm/zswap.c:1563

but task is already holding lock:
ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline]
ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (fs_reclaim){+.+.}-{0:0}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
       fs_reclaim_acquire+0x88/0x130 mm/page_alloc.c:3867
       might_alloc include/linux/sched/mm.h:318 [inline]
       slab_pre_alloc_hook mm/slub.c:4070 [inline]
       slab_alloc_node mm/slub.c:4148 [inline]
       __kmalloc_cache_node_noprof+0x40/0x3a0 mm/slub.c:4337
       kmalloc_node_noprof include/linux/slab.h:924 [inline]
       zswap_cpu_comp_prepare+0xdc/0x400 mm/zswap.c:828
       cpuhp_invoke_callback+0x415/0x830 kernel/cpu.c:204
       cpuhp_issue_call+0x46f/0x7e0
       __cpuhp_state_add_instance_cpuslocked+0x1ed/0x500 kernel/cpu.c:2437
       __cpuhp_state_add_instance+0x27/0x40 kernel/cpu.c:2458
       cpuhp_state_add_instance include/linux/cpuhotplug.h:386 [inline]
       zswap_pool_create+0x38c/0x680 mm/zswap.c:291
       zswap_setup+0x32a/0x4b0 mm/zswap.c:1811
       do_one_initcall+0x248/0x870 init/main.c:1266
       do_initcall_level+0x157/0x210 init/main.c:1328
       do_initcalls+0x3f/0x80 init/main.c:1344
       kernel_init_freeable+0x435/0x5d0 init/main.c:1577
       kernel_init+0x1d/0x2b0 init/main.c:1466
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
       zswap_compress mm/zswap.c:931 [inline]
       zswap_store_page mm/zswap.c:1456 [inline]
       zswap_store+0xa3b/0x1c30 mm/zswap.c:1563
       swap_writepage+0x647/0xce0 mm/page_io.c:279
       shmem_writepage+0x1248/0x1610 mm/shmem.c:1579
       pageout mm/vmscan.c:696 [inline]
       shrink_folio_list+0x3b68/0x5ca0 mm/vmscan.c:1374
       evict_folios+0x3c92/0x58c0 mm/vmscan.c:4600
       try_to_shrink_lruvec+0x9a6/0xc70 mm/vmscan.c:4799
       shrink_one+0x3b9/0x850 mm/vmscan.c:4844
       shrink_many mm/vmscan.c:4907 [inline]
       lru_gen_shrink_node mm/vmscan.c:4985 [inline]
       shrink_node+0x37c5/0x3e50 mm/vmscan.c:5966
       shrink_zones mm/vmscan.c:6225 [inline]
       do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6287
       try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6537
       __perform_reclaim mm/page_alloc.c:3929 [inline]
       __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951
       __alloc_pages_slowpath+0x764/0x1020 mm/page_alloc.c:4382
       __alloc_pages_noprof+0x49b/0x710 mm/page_alloc.c:4766
       alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
       vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
       __vmalloc_area_node mm/vmalloc.c:3669 [inline]
       __vmalloc_node_range_noprof+0x9c9/0x1380 mm/vmalloc.c:3846
       vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:4000
       kcov_ioctl+0x56/0x640 kernel/kcov.c:716
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(fs_reclaim);
                               lock(&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex);
                               lock(fs_reclaim);
  lock(&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex);

 *** DEADLOCK ***

1 lock held by syz-executor/5327:
 #0: ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline]
 #0: ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951

stack backtrace:
CPU: 0 UID: 0 PID: 5327 Comm: syz-executor Not tainted 6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
 acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
 zswap_compress mm/zswap.c:931 [inline]
 zswap_store_page mm/zswap.c:1456 [inline]
 zswap_store+0xa3b/0x1c30 mm/zswap.c:1563
 swap_writepage+0x647/0xce0 mm/page_io.c:279
 shmem_writepage+0x1248/0x1610 mm/shmem.c:1579
 pageout mm/vmscan.c:696 [inline]
 shrink_folio_list+0x3b68/0x5ca0 mm/vmscan.c:1374
 evict_folios+0x3c92/0x58c0 mm/vmscan.c:4600
 try_to_shrink_lruvec+0x9a6/0xc70 mm/vmscan.c:4799
 shrink_one+0x3b9/0x850 mm/vmscan.c:4844
 shrink_many mm/vmscan.c:4907 [inline]
 lru_gen_shrink_node mm/vmscan.c:4985 [inline]
 shrink_node+0x37c5/0x3e50 mm/vmscan.c:5966
 shrink_zones mm/vmscan.c:6225 [inline]
 do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6287
 try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6537
 __perform_reclaim mm/page_alloc.c:3929 [inline]
 __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951
 __alloc_pages_slowpath+0x764/0x1020 mm/page_alloc.c:4382
 __alloc_pages_noprof+0x49b/0x710 mm/page_alloc.c:4766
 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x9c9/0x1380 mm/vmalloc.c:3846
 vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:4000
 kcov_ioctl+0x56/0x640 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8fb8f8592b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffd6d3ef520 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f8fb8f8592b
RDX: 0000000000100000 RSI: ffffffff80086301 RDI: 00000000000000d7
RBP: 00007f8fb9175f40 R08: 00000000000000dd R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000006 R14: 0000000000000009 R15: 0000000000000000
 </TASK>
syz-executor (5327) used greatest stack depth: 18096 bytes left

final repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0 Not tainted
------------------------------------------------------
syz-executor/5327 is trying to acquire lock:
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_compress mm/zswap.c:931 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_store_page mm/zswap.c:1456 [inline]
ffffe8ffffc37f50 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}, at: zswap_store+0xa3b/0x1c30 mm/zswap.c:1563

but task is already holding lock:
ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline]
ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (fs_reclaim){+.+.}-{0:0}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
       fs_reclaim_acquire+0x88/0x130 mm/page_alloc.c:3867
       might_alloc include/linux/sched/mm.h:318 [inline]
       slab_pre_alloc_hook mm/slub.c:4070 [inline]
       slab_alloc_node mm/slub.c:4148 [inline]
       __kmalloc_cache_node_noprof+0x40/0x3a0 mm/slub.c:4337
       kmalloc_node_noprof include/linux/slab.h:924 [inline]
       zswap_cpu_comp_prepare+0xdc/0x400 mm/zswap.c:828
       cpuhp_invoke_callback+0x415/0x830 kernel/cpu.c:204
       cpuhp_issue_call+0x46f/0x7e0
       __cpuhp_state_add_instance_cpuslocked+0x1ed/0x500 kernel/cpu.c:2437
       __cpuhp_state_add_instance+0x27/0x40 kernel/cpu.c:2458
       cpuhp_state_add_instance include/linux/cpuhotplug.h:386 [inline]
       zswap_pool_create+0x38c/0x680 mm/zswap.c:291
       zswap_setup+0x32a/0x4b0 mm/zswap.c:1811
       do_one_initcall+0x248/0x870 init/main.c:1266
       do_initcall_level+0x157/0x210 init/main.c:1328
       do_initcalls+0x3f/0x80 init/main.c:1344
       kernel_init_freeable+0x435/0x5d0 init/main.c:1577
       kernel_init+0x1d/0x2b0 init/main.c:1466
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
       zswap_compress mm/zswap.c:931 [inline]
       zswap_store_page mm/zswap.c:1456 [inline]
       zswap_store+0xa3b/0x1c30 mm/zswap.c:1563
       swap_writepage+0x647/0xce0 mm/page_io.c:279
       shmem_writepage+0x1248/0x1610 mm/shmem.c:1579
       pageout mm/vmscan.c:696 [inline]
       shrink_folio_list+0x3b68/0x5ca0 mm/vmscan.c:1374
       evict_folios+0x3c92/0x58c0 mm/vmscan.c:4600
       try_to_shrink_lruvec+0x9a6/0xc70 mm/vmscan.c:4799
       shrink_one+0x3b9/0x850 mm/vmscan.c:4844
       shrink_many mm/vmscan.c:4907 [inline]
       lru_gen_shrink_node mm/vmscan.c:4985 [inline]
       shrink_node+0x37c5/0x3e50 mm/vmscan.c:5966
       shrink_zones mm/vmscan.c:6225 [inline]
       do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6287
       try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6537
       __perform_reclaim mm/page_alloc.c:3929 [inline]
       __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951
       __alloc_pages_slowpath+0x764/0x1020 mm/page_alloc.c:4382
       __alloc_pages_noprof+0x49b/0x710 mm/page_alloc.c:4766
       alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
       vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
       __vmalloc_area_node mm/vmalloc.c:3669 [inline]
       __vmalloc_node_range_noprof+0x9c9/0x1380 mm/vmalloc.c:3846
       vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:4000
       kcov_ioctl+0x56/0x640 kernel/kcov.c:716
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(fs_reclaim);
                               lock(&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex);
                               lock(fs_reclaim);
  lock(&per_cpu_ptr(pool->acomp_ctx, cpu)->mutex);

 *** DEADLOCK ***

1 lock held by syz-executor/5327:
 #0: ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline]
 #0: ffffffff8ea36f00 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951

stack backtrace:
CPU: 0 UID: 0 PID: 5327 Comm: syz-executor Not tainted 6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
 acomp_ctx_get_cpu_lock mm/zswap.c:899 [inline]
 zswap_compress mm/zswap.c:931 [inline]
 zswap_store_page mm/zswap.c:1456 [inline]
 zswap_store+0xa3b/0x1c30 mm/zswap.c:1563
 swap_writepage+0x647/0xce0 mm/page_io.c:279
 shmem_writepage+0x1248/0x1610 mm/shmem.c:1579
 pageout mm/vmscan.c:696 [inline]
 shrink_folio_list+0x3b68/0x5ca0 mm/vmscan.c:1374
 evict_folios+0x3c92/0x58c0 mm/vmscan.c:4600
 try_to_shrink_lruvec+0x9a6/0xc70 mm/vmscan.c:4799
 shrink_one+0x3b9/0x850 mm/vmscan.c:4844
 shrink_many mm/vmscan.c:4907 [inline]
 lru_gen_shrink_node mm/vmscan.c:4985 [inline]
 shrink_node+0x37c5/0x3e50 mm/vmscan.c:5966
 shrink_zones mm/vmscan.c:6225 [inline]
 do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6287
 try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6537
 __perform_reclaim mm/page_alloc.c:3929 [inline]
 __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951
 __alloc_pages_slowpath+0x764/0x1020 mm/page_alloc.c:4382
 __alloc_pages_noprof+0x49b/0x710 mm/page_alloc.c:4766
 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x9c9/0x1380 mm/vmalloc.c:3846
 vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:4000
 kcov_ioctl+0x56/0x640 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8fb8f8592b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffd6d3ef520 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f8fb8f8592b
RDX: 0000000000100000 RSI: ffffffff80086301 RDI: 00000000000000d7
RBP: 00007f8fb9175f40 R08: 00000000000000dd R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000006 R14: 0000000000000009 R15: 0000000000000000
 </TASK>
syz-executor (5327) used greatest stack depth: 18096 bytes left