[ 71.318180][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.318252][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.440489][ T859] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:55825' (ED25519) to the list of known hosts. [*] Starting reproducer for possible deadlock in jffs2_xattr_delete_inode... [+] mkdir /tmp/jffs2_mnt successful. [+] mkdir /tmp/ovl_lower successful. [+] mkdir /tmp/ovl_mnt successful. [+] Discovered MTD device from /proc/mtd: mtd0 (size=131072, erasesize=4096) [+] mknod /dev/mtd0 (chr 90,0) successful. [+] mknod /dev/mtdblock0 (blk 31,0) successful. [+] Opened /dev/mtd0 successfully. [+] ioctl MEMGETINFO on /dev/mtd0 successful: size=131072, erasesize=4096 [+] ioctl MEMERASE on /dev/mtd0 successful. [+] Written cleanmarkers to /dev/mtd0. [+] mount mtd0 on /tmp/jffs2_mnt successful. [+] JFFS2 mounted successfully on /tmp/jffs2_mnt. [+] open /tmp/jffs2_mnt/init_xattr successful. [ 77.379691][ T6136] jffs2: notice: (6136) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [+] fsetxattr on /tmp/jffs2_mnt/init_xattr successful (dependency &c->xattr_sem -> fs_reclaim registered). [+] mkdir /tmp/jffs2_mnt/upper successful. [+] mkdir /tmp/jffs2_mnt/work successful. [ 77.392300][ T6136] overlayfs: upper fs does not support tmpfile. [+] mount overlay on /tmp/ovl_mnt successful. [ 77.393633][ T6136] overlayfs: upper fs does not support RENAME_WHITEOUT. [+] Set sysctl /proc/sys/vm/vfs_cache_pressure to 100000 [+] Set sysctl /proc/sys/vm/min_free_kbytes to 131072 [*] Creating files on OverlayFS and unlinking on JFFS2 upper... [+] 60 files created on OverlayFS and unlinked on JFFS2 upper. [*] Injecting 1000 negative dentries into OverlayFS dcache LRU... [+] 1000 negative dentries populated into OverlayFS dcache. [*] Round 0: Setting up sustained 2-stage memory pressure... [+] Set sysctl /proc/self/oom_score_adj to -1000 [ 80.119605][ T116] [ 80.120642][ T116] ====================================================== [ 80.123239][ T116] WARNING: possible circular locking dependency detected [ 80.125959][ T116] syzkaller #0 Not tainted [ 80.127890][ T116] ------------------------------------------------------ [ 80.130802][ T116] kswapd0/116 is trying to acquire lock: [ 80.133173][ T116] ffff8880143729d8 (&c->xattr_sem){++++}-{4:4}, at: jffs2_xattr_delete_inode+0x83/0x130 [ 80.137122][ T116] [ 80.137122][ T116] but task is already holding lock: [ 80.140428][ T116] ffffffff901caa00 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x243/0x1f00 [ 80.144237][ T116] [ 80.144237][ T116] which lock already depends on the new lock. [ 80.144237][ T116] [ 80.148580][ T116] [ 80.148580][ T116] the existing dependency chain (in reverse order) is: [ 80.152308][ T116] [ 80.152308][ T116] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 80.155384][ T116] lock_acquire+0x1d1/0x380 [ 80.157676][ T116] fs_reclaim_acquire+0xc4/0x100 [ 80.160314][ T116] kmem_cache_alloc_noprof+0x63/0x6a0 [ 80.163201][ T116] jffs2_alloc_xattr_datum+0x1c/0xe0 [ 80.165921][ T116] do_jffs2_setxattr+0x6f0/0x1610 [ 80.168736][ T116] __vfs_setxattr+0x175/0x1e0 [ 80.171102][ T116] __vfs_setxattr_noperm+0x127/0x660 [ 80.173697][ T116] __vfs_setxattr_locked+0x127/0x2b0 [ 80.176240][ T116] vfs_setxattr+0x14a/0x390 [+] Holder child pinned bulk memory. Free RAM is low. [ 80.178231][ T116] do_setxattr+0x145/0x180 [+] 4 pushers forked and actively driving direct reclaim. [+] Set sysctl /proc/self/oom_score_adj to 1000 [ 80.180532][ T116] file_setxattr+0x139/0x1b0 [+] Set sysctl /proc/self/oom_score_adj to 1000 [+] Set sysctl /proc/self/oom_score_adj to 1000 [ 80.183062][ T116] path_setxattrat+0x335/0x3b0 [+] Set sysctl /proc/self/oom_score_adj to 1000 [ 80.185669][ T116] __ia32_sys_fsetxattr+0xc4/0x140 [ 80.189232][ T116] __do_fast_syscall_32+0x14b/0x8c0 [ 80.191635][ T116] do_fast_syscall_32+0x32/0x70 [ 80.194137][ T116] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 80.197279][ T116] [ 80.197279][ T116] -> #0 (&c->xattr_sem){++++}-{4:4}: [ 80.200798][ T116] check_prev_add+0xeb/0xe60 [ 80.203188][ T116] __lock_acquire+0x1528/0x1f40 [ 80.205610][ T116] lock_acquire+0x1d1/0x380 [ 80.207842][ T116] down_write+0x86/0x1f0 [ 80.209958][ T116] jffs2_xattr_delete_inode+0x83/0x130 [ 80.212411][ T116] jffs2_do_clear_inode+0x50/0x470 [ 80.214772][ T116] evict+0x3c2/0xad0 [ 80.216868][ T116] iput.part.0+0x989/0x1050 [ 80.219081][ T116] iput+0x30/0x40 [ 80.220892][ T116] dentry_unlink_inode+0x403/0x4d0 [ 80.223090][ T116] dentry_kill+0x25d/0xca0 [ 80.225064][ T116] dput.part.0+0xd2/0x240 [ 80.226995][ T116] dput+0x1f/0x30 [ 80.228741][ T116] ovl_destroy_inode+0x3e/0x190 [ 80.231173][ T116] destroy_inode+0xcb/0x1c0 [ 80.233337][ T116] evict+0x599/0xad0 [ 80.235096][ T116] iput.part.0+0x989/0x1050 [ 80.237155][ T116] iput+0x30/0x40 [ 80.239083][ T116] dentry_unlink_inode+0x403/0x4d0 [ 80.241701][ T116] dentry_kill+0x25d/0xca0 [ 80.244039][ T116] shrink_dentry_list+0x1e8/0x310 [ 80.247473][ T116] prune_dcache_sb+0xea/0x150 [ 80.250801][ T116] super_cache_scan+0x32b/0x550 [ 80.253773][ T116] do_shrink_slab+0x411/0x1200 [ 80.256183][ T116] shrink_slab+0x171/0x12e0 [ 80.258704][ T116] shrink_one+0x398/0x850 [ 80.261087][ T116] shrink_node+0x2b1b/0x4310 [ 80.263365][ T116] balance_pgdat+0xb20/0x1f00 [ 80.265659][ T116] kswapd+0x556/0xb50 [ 80.267822][ T116] kthread+0x373/0x450 [ 80.270157][ T116] ret_from_fork+0x730/0xd60 [ 80.272801][ T116] ret_from_fork_asm+0x1a/0x30 [ 80.275770][ T116] [ 80.275770][ T116] other info that might help us debug this: [ 80.275770][ T116] [ 80.280090][ T116] Possible unsafe locking scenario: [ 80.280090][ T116] [ 80.282823][ T116] CPU0 CPU1 [ 80.284822][ T116] ---- ---- [ 80.287069][ T116] lock(fs_reclaim); [ 80.288726][ T116] lock(&c->xattr_sem); [ 80.291185][ T116] lock(fs_reclaim); [ 80.293577][ T116] lock(&c->xattr_sem); [ 80.295377][ T116] [ 80.295377][ T116] *** DEADLOCK *** [ 80.295377][ T116] [ 80.299861][ T116] locks held by kswapd0/116: 2, last CPU#0: [ 80.302623][ T116] #0: ffffffff901caa00 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x243/0x1f00 [ 80.306446][ T116] #1: ffff88804f2ec0e8 (&type->s_umount_key#57){.+.+}-{4:4}, at: super_cache_scan+0x9b/0x550 [ 80.310807][ T116] [ 80.310807][ T116] stack backtrace: [ 80.313832][ T116] CPU: 0 UID: 0 PID: 116 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 80.318720][ T116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.324388][ T116] Call Trace: [ 80.326518][ T116] [ 80.328225][ T116] dump_stack_lvl+0x100/0x190 [ 80.330852][ T116] print_circular_bug.cold+0x178/0x1be [ 80.333670][ T116] check_noncircular+0x146/0x160 [ 80.336040][ T116] check_prev_add+0xeb/0xe60 [ 80.338472][ T116] __lock_acquire+0x1528/0x1f40 [ 80.341095][ T116] lock_acquire+0x1d1/0x380 [ 80.344040][ T116] ? jffs2_xattr_delete_inode+0x83/0x130 [ 80.346881][ T116] ? __pfx___might_resched+0x10/0x10 [ 80.349248][ T116] ? lockdep_hardirqs_on+0x7d/0x110 [ 80.351743][ T116] down_write+0x86/0x1f0 [ 80.353777][ T116] ? jffs2_xattr_delete_inode+0x83/0x130 [ 80.356121][ T116] ? __pfx_down_write+0x10/0x10 [ 80.358475][ T116] jffs2_xattr_delete_inode+0x83/0x130 [ 80.361834][ T116] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 80.364768][ T116] jffs2_do_clear_inode+0x50/0x470 [ 80.367688][ T116] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 80.370008][ T116] evict+0x3c2/0xad0 [ 80.371649][ T116] ? fsnotify_grab_connector+0x4b/0x290 [ 80.373970][ T116] ? __pfx_evict+0x10/0x10 [ 80.375905][ T116] ? lock_acquire+0x1d1/0x380 [ 80.377890][ T116] ? iput.part.0+0x981/0x1050 [ 80.379883][ T116] iput.part.0+0x989/0x1050 [ 80.381775][ T116] iput+0x30/0x40 [ 80.383268][ T116] dentry_unlink_inode+0x403/0x4d0 [ 80.385654][ T116] dentry_kill+0x25d/0xca0 [ 80.387851][ T116] ? __pfx_ovl_destroy_inode+0x10/0x10 [ 80.390066][ T116] dput.part.0+0xd2/0x240 [ 80.391692][ T116] ? __pfx_ovl_destroy_inode+0x10/0x10 [ 80.393702][ T116] dput+0x1f/0x30 [ 80.395169][ T116] ovl_destroy_inode+0x3e/0x190 [ 80.397198][ T116] ? __pfx_ovl_destroy_inode+0x10/0x10 [ 80.399558][ T116] destroy_inode+0xcb/0x1c0 [ 80.401401][ T116] evict+0x599/0xad0 [ 80.402868][ T116] ? __pfx_evict+0x10/0x10 [ 80.404477][ T116] ? lock_acquire+0x1d1/0x380 [ 80.406471][ T116] ? iput.part.0+0x981/0x1050 [ 80.408308][ T116] iput.part.0+0x989/0x1050 [ 80.410013][ T116] iput+0x30/0x40 [ 80.411409][ T116] dentry_unlink_inode+0x403/0x4d0 [ 80.413342][ T116] dentry_kill+0x25d/0xca0 [ 80.415020][ T116] shrink_dentry_list+0x1e8/0x310 [ 80.417151][ T116] prune_dcache_sb+0xea/0x150 [ 80.419205][ T116] ? list_lru_count_one+0x147/0x320 [ 80.421374][ T116] ? __pfx_prune_dcache_sb+0x10/0x10 [ 80.423578][ T116] super_cache_scan+0x32b/0x550 [ 80.425636][ T116] do_shrink_slab+0x411/0x1200 [ 80.427699][ T116] shrink_slab+0x171/0x12e0 [ 80.429353][ T116] ? try_to_shrink_lruvec+0x688/0x830 [ 80.431314][ T116] ? __pfx_shrink_slab+0x10/0x10 [ 80.433231][ T116] ? lock_acquire+0x1d1/0x380 [ 80.435017][ T116] shrink_one+0x398/0x850 [ 80.436814][ T116] ? shrink_node+0x2a20/0x4310 [ 80.438857][ T116] ? shrink_node+0x2afb/0x4310 [ 80.440943][ T116] shrink_node+0x2b1b/0x4310 [ 80.442973][ T116] ? shrink_node+0x2869/0x4310 [ 80.445046][ T116] ? __pfx_shrink_node+0x10/0x10 [ 80.447055][ T116] ? find_held_lock+0x2b/0x80 [ 80.449055][ T116] ? balance_pgdat+0xb20/0x1f00 [ 80.451105][ T116] balance_pgdat+0xb20/0x1f00 [ 80.453139][ T116] ? __pfx_balance_pgdat+0x10/0x10 [ 80.455283][ T116] ? rcu_is_watching+0x13/0xc0 [ 80.457227][ T116] ? lockdep_hardirqs_on+0x7d/0x110 [ 80.459641][ T116] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 80.462288][ T116] ? rcu_is_watching+0x13/0xc0 [ 80.464434][ T116] ? trace_sched_exit_tp+0x120/0x160 [ 80.466620][ T116] ? __schedule+0x1270/0x6990 [ 80.468637][ T116] ? __lock_acquire+0x5c0/0x1f40 [ 80.470715][ T116] ? schedule+0x225/0x2c0 [ 80.472657][ T116] ? set_pgdat_percpu_threshold+0xcb/0x2f0 [ 80.475098][ T116] ? __pfx_calculate_pressure_threshold+0x10/0x10 [ 80.477864][ T116] kswapd+0x556/0xb50 [ 80.479630][ T116] ? __pfx_kswapd+0x10/0x10 [ 80.481577][ T116] ? __pfx_rcu_is_watching+0x10/0x10 [ 80.483807][ T116] ? __pfx_autoremove_wake_function+0x10/0x10 [ 80.486404][ T116] ? __kthread_parkme+0x18f/0x230 [ 80.488656][ T116] ? kthread+0x13a/0x450 [ 80.491210][ T116] ? __pfx_kswapd+0x10/0x10 [ 80.493393][ T116] kthread+0x373/0x450 [ 80.495105][ T116] ? __pfx_kthread+0x10/0x10 [ 80.497053][ T116] ret_from_fork+0x730/0xd60 [ 80.499015][ T116] ? __pfx_ret_from_fork+0x10/0x10 [ 80.501353][ T116] ? __switch_to+0x800/0x10e0 [ 80.503336][ T116] ? __pfx_kthread+0x10/0x10 [ 80.505284][ T116] ret_from_fork_asm+0x1a/0x30 [ 80.507328][ T116] [+] Pusher 0 stopped (status=0x9, signaled=1). [+] Pusher 1 stopped (status=0x9, signaled=1). [+] Pusher 2 stopped (status=0x9, signaled=1). [+] Pusher 3 stopped (status=0x9, signaled=1). [+] Holder child terminated and memory freed. [*] Round 1: Setting up sustained 2-stage memory pressure... [+] Set sysctl /proc/self/oom_score_adj to -1000 [+] Holder child pinned bulk memory. Free RAM is low. [+] Set sysctl /proc/self/oom_score_adj to 1000 [+] Set sysctl /proc/self/oom_score_adj to 1000 [+] 4 pushers forked and actively driving direct reclaim. [+] Set sysctl /proc/self/oom_score_adj to 1000 [+] Set sysctl /proc/self/oom_score_adj to 1000 [+] Pusher 0 stopped (status=0x9, signaled=1). [+] Pusher 1 stopped (status=0x9, signaled=1). [+] Pusher 2 stopped (status=0x9, signaled=1). [+] Pusher 3 stopped (status=0x9, signaled=1). [+] Holder child terminated and memory freed. [*] Waiting for asynchronous kernel tasks...