program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) [ 94.326818][ T4652] Bluetooth: hci0: command tx timeout [ 94.424663][ T5327] jffs2: notice: (5327) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 94.495864][ T75] [ 94.496719][ T75] ====================================================== [ 94.498960][ T75] WARNING: possible circular locking dependency detected [ 94.501252][ T75] syzkaller #0 Not tainted [ 94.502712][ T75] ------------------------------------------------------ [ 94.504946][ T75] kswapd0/75 is trying to acquire lock: [ 94.506699][ T75] ffff888013617760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 94.509591][ T75] [ 94.509591][ T75] but task is already holding lock: [ 94.511997][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.514553][ T75] [ 94.514553][ T75] which lock already depends on the new lock. [ 94.514553][ T75] [ 94.517820][ T75] [ 94.517820][ T75] the existing dependency chain (in reverse order) is: [ 94.520665][ T75] [ 94.520665][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 94.523047][ T75] fs_reclaim_acquire+0x71/0x100 [ 94.525029][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 94.527184][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 94.529214][ T75] jffs2_iget+0x228/0xcc0 [ 94.530939][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 94.532880][ T75] mtd_get_sb+0x18a/0x410 [ 94.534547][ T75] get_tree_mtd+0x4bd/0x7d0 [ 94.536375][ T75] vfs_get_tree+0x92/0x2a0 [ 94.538162][ T75] do_new_mount+0x319/0xdc0 [ 94.539968][ T75] __se_sys_mount+0x31d/0x420 [ 94.541796][ T75] do_syscall_64+0x174/0x580 [ 94.543630][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.545782][ T75] [ 94.545782][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 94.548092][ T75] __lock_acquire+0x1520/0x2cf0 [ 94.549857][ T75] lock_acquire+0x106/0x350 [ 94.551523][ T75] __mutex_lock+0x19d/0x1550 [ 94.553188][ T75] jffs2_do_clear_inode+0x62/0x390 [ 94.555017][ T75] evict+0x624/0xb50 [ 94.556538][ T75] prune_icache_sb+0x223/0x2d0 [ 94.558313][ T75] super_cache_scan+0x38d/0x4a0 [ 94.560155][ T75] do_shrink_slab+0x6d0/0x10e0 [ 94.562130][ T75] shrink_slab+0x838/0x1220 [ 94.564015][ T75] shrink_one+0x2a2/0x730 [ 94.565865][ T75] shrink_node+0x3303/0x3b60 [ 94.567672][ T75] kswapd+0x17b6/0x31c0 [ 94.569334][ T75] kthread+0x388/0x470 [ 94.570986][ T75] ret_from_fork+0x514/0xb70 [ 94.572736][ T75] ret_from_fork_asm+0x1a/0x30 [ 94.574547][ T75] [ 94.574547][ T75] other info that might help us debug this: [ 94.574547][ T75] [ 94.578053][ T75] Possible unsafe locking scenario: [ 94.578053][ T75] [ 94.580686][ T75] CPU0 CPU1 [ 94.582475][ T75] ---- ---- [ 94.584312][ T75] lock(fs_reclaim); [ 94.585713][ T75] lock(&f->sem); [ 94.587893][ T75] lock(fs_reclaim); [ 94.590083][ T75] lock(&f->sem); [ 94.591365][ T75] [ 94.591365][ T75] *** DEADLOCK *** [ 94.591365][ T75] [ 94.594080][ T75] 2 locks held by kswapd0/75: [ 94.595687][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 94.598602][ T75] #1: ffff88803f0000d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 94.602044][ T75] [ 94.602044][ T75] stack backtrace: [ 94.604102][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 94.604111][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.604116][ T75] Call Trace: [ 94.604121][ T75] [ 94.604125][ T75] dump_stack_lvl+0xe8/0x150 [ 94.604137][ T75] print_circular_bug+0x2e1/0x300 [ 94.604146][ T75] check_noncircular+0x12e/0x150 [ 94.604153][ T75] __lock_acquire+0x1520/0x2cf0 [ 94.604164][ T75] ? ret_from_fork_asm+0x1a/0x30 [ 94.604173][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 94.604183][ T75] lock_acquire+0x106/0x350 [ 94.604196][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 94.604210][ T75] __mutex_lock+0x19d/0x1550 [ 94.604222][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 94.604230][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 94.604237][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 94.604245][ T75] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.604253][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 94.604264][ T75] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.604272][ T75] jffs2_do_clear_inode+0x62/0x390 [ 94.604279][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 94.604287][ T75] evict+0x624/0xb50 [ 94.604295][ T75] ? __pfx_evict+0x10/0x10 [ 94.604300][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.604309][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 94.604317][ T75] ? list_lru_walk_one+0x3c/0x50 [ 94.604327][ T75] prune_icache_sb+0x223/0x2d0 [ 94.604336][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 94.604343][ T75] ? list_lru_count_one+0x27/0x2c0 [ 94.604351][ T75] ? list_lru_count_one+0x27/0x2c0 [ 94.604359][ T75] ? list_lru_count_one+0x27/0x2c0 [ 94.604367][ T75] ? list_lru_count_one+0x264/0x2c0 [ 94.604376][ T75] super_cache_scan+0x38d/0x4a0 [ 94.604387][ T75] do_shrink_slab+0x6d0/0x10e0 [ 94.604399][ T75] shrink_slab+0x838/0x1220 [ 94.604408][ T75] ? shrink_slab+0x1e9/0x1220 [ 94.604417][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 94.604426][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 94.604435][ T75] ? shrink_node+0x2ed4/0x3b60 [ 94.604443][ T75] shrink_one+0x2a2/0x730 [ 94.604452][ T75] ? shrink_node+0x2ed4/0x3b60 [ 94.604460][ T75] shrink_node+0x3303/0x3b60 [ 94.604473][ T75] ? shrink_node+0x2ed4/0x3b60 [ 94.604486][ T75] ? percpu_ref_put+0x19/0x180 [ 94.604501][ T75] ? percpu_ref_put+0x19/0x180 [ 94.604513][ T75] ? __pfx_shrink_node+0x10/0x10 [ 94.604521][ T75] ? percpu_ref_put+0x19/0x180 [ 94.604530][ T75] ? percpu_ref_put+0x19/0x180 [ 94.604539][ T75] ? mem_cgroup_iter+0x410/0x440 [ 94.604550][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 94.604560][ T75] kswapd+0x17b6/0x31c0 [ 94.604573][ T75] ? kswapd+0x9b6/0x31c0 [ 94.604584][ T75] ? __pfx_kswapd+0x10/0x10 [ 94.604593][ T75] ? trace_contention_end+0x3d/0x140 [ 94.604605][ T75] ? __lock_acquire+0x683/0x2cf0 [ 94.604615][ T75] ? kthread_affine_node+0x2b2/0x360 [ 94.604625][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 94.604636][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.604644][ T75] ? __kthread_parkme+0x71/0x1f0 [ 94.604653][ T75] ? __kthread_parkme+0x196/0x1f0 [ 94.604662][ T75] kthread+0x388/0x470 [ 94.604672][ T75] ? __pfx_kswapd+0x10/0x10 [ 94.604681][ T75] ? __pfx_kthread+0x10/0x10 [ 94.604690][ T75] ret_from_fork+0x514/0xb70 [ 94.604702][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 94.604712][ T75] ? __switch_to+0xc89/0x1420 [ 94.604720][ T75] ? __pfx_kthread+0x10/0x10 [ 94.604732][ T75] ret_from_fork_asm+0x1a/0x30 [ 94.604742][ T75]