program: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0xd0009412, &(0x7f0000001480)={{r0}, 0x0, 0x0, @inherit={0x0, 0x0}, @subvolid}) openat(r0, &(0x7f0000000000)='mtd0\x00', 0x0, 0x11c) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5000000002060500000000000000000000000000050005000a000000050004000004000005000100070000000900006222a07a310000000015000300686173683a69702c706fdab358ce657400000000fe6371bf1fab3e7b2d210d0050f91bd5980d299272ed178fae642b58e80027cc424bb21ee249baad14e5989306a8db8b8ec72c3b9adb0284f2609fdc3fab39"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) r3 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") getdents(r3, &(0x7f0000001fc0)=""/184, 0x18) [ 109.693561][ T4653] Bluetooth: hci0: command tx timeout [ 109.769787][ T5334] jffs2: notice: (5334) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 110.035206][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 110.193278][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 110.198295][ T10] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 110.201736][ T10] usb 5-1: config 179 has no interface number 0 [ 110.204591][ T10] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 110.209218][ T10] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 110.216561][ T10] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 110.221648][ T10] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 110.226894][ T10] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 110.233571][ T10] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 110.237633][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.255007][ T5334] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 110.490385][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:179.65/input/input5 [ 110.798575][ T5334] loop0: detected capacity change from 0 to 2048 [ 110.853122][ T5334] loop0: p2 p3 < > p4 < p5 > [ 110.861745][ T5334] loop0: partition table partially beyond EOD, truncated [ 110.894028][ T5334] loop0: p3 start 4225 is beyond EOD, truncated [ 110.971132][ T75] [ 110.972221][ T75] ====================================================== [ 110.975162][ T75] WARNING: possible circular locking dependency detected [ 110.978479][ T75] syzkaller #0 Not tainted [ 110.980378][ T75] ------------------------------------------------------ [ 110.983171][ T75] kswapd0/75 is trying to acquire lock: [ 110.985419][ T75] ffff8880123a7760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 110.989252][ T75] [ 110.989252][ T75] but task is already holding lock: [ 110.992244][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 110.995674][ T75] [ 110.995674][ T75] which lock already depends on the new lock. [ 110.995674][ T75] [ 111.000045][ T75] [ 111.000045][ T75] the existing dependency chain (in reverse order) is: [ 111.003354][ T75] [ 111.003354][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 111.006210][ T75] fs_reclaim_acquire+0x71/0x100 [ 111.008506][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 111.010912][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 111.013359][ T75] jffs2_iget+0x228/0xcc0 [ 111.015378][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 111.017820][ T75] mtd_get_sb+0x18a/0x410 [ 111.019957][ T75] get_tree_mtd+0x597/0x7d0 [ 111.022142][ T75] vfs_get_tree+0x92/0x2a0 [ 111.024271][ T75] do_new_mount+0x319/0xdc0 [ 111.026385][ T75] __se_sys_mount+0x31d/0x420 [ 111.028635][ T75] do_syscall_64+0x174/0x580 [ 111.030770][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.033432][ T75] [ 111.033432][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 111.036244][ T75] __lock_acquire+0x1520/0x2cf0 [ 111.038474][ T75] lock_acquire+0x106/0x350 [ 111.040650][ T75] __mutex_lock+0x19d/0x1550 [ 111.042809][ T75] jffs2_do_clear_inode+0x62/0x390 [ 111.045018][ T75] evict+0x624/0xb50 [ 111.046857][ T75] prune_icache_sb+0x223/0x2d0 [ 111.049056][ T75] super_cache_scan+0x38d/0x4a0 [ 111.051167][ T75] do_shrink_slab+0x6d0/0x10e0 [ 111.053349][ T75] shrink_slab+0x838/0x1220 [ 111.055340][ T75] shrink_one+0x2a2/0x730 [ 111.057346][ T75] shrink_node+0x3303/0x3b60 [ 111.059302][ T75] kswapd+0x17b6/0x31c0 [ 111.061226][ T75] kthread+0x388/0x470 [ 111.063229][ T75] ret_from_fork+0x514/0xb70 [ 111.065547][ T75] ret_from_fork_asm+0x1a/0x30 [ 111.067890][ T75] [ 111.067890][ T75] other info that might help us debug this: [ 111.067890][ T75] [ 111.072076][ T75] Possible unsafe locking scenario: [ 111.072076][ T75] [ 111.075212][ T75] CPU0 CPU1 [ 111.077475][ T75] ---- ---- [ 111.079638][ T75] lock(fs_reclaim); [ 111.081280][ T75] lock(&f->sem); [ 111.083768][ T75] lock(fs_reclaim); [ 111.086453][ T75] lock(&f->sem); [ 111.088073][ T75] [ 111.088073][ T75] *** DEADLOCK *** [ 111.088073][ T75] [ 111.091385][ T75] 2 locks held by kswapd0/75: [ 111.093378][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 111.096966][ T75] #1: ffff888036a0a0d8 (&type->s_umount_key#52){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 111.100870][ T75] [ 111.100870][ T75] stack backtrace: [ 111.103220][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 111.103233][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.103239][ T75] Call Trace: [ 111.103246][ T75] [ 111.103251][ T75] dump_stack_lvl+0xe8/0x150 [ 111.103269][ T75] print_circular_bug+0x2e1/0x300 [ 111.103281][ T75] check_noncircular+0x12e/0x150 [ 111.103292][ T75] __lock_acquire+0x1520/0x2cf0 [ 111.103310][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 111.103320][ T75] lock_acquire+0x106/0x350 [ 111.103332][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 111.103342][ T75] ? __might_resched+0xfb/0x4d0 [ 111.103365][ T75] __mutex_lock+0x19d/0x1550 [ 111.103378][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 111.103388][ T75] ? __pfx___schedule+0x10/0x10 [ 111.103397][ T75] ? irqentry_exit+0x218/0x8f0 [ 111.103409][ T75] ? trace_irq_disable+0x3b/0x140 [ 111.103422][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 111.103432][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 111.103444][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 111.103459][ T75] jffs2_do_clear_inode+0x62/0x390 [ 111.103469][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 111.103480][ T75] evict+0x624/0xb50 [ 111.103490][ T75] ? __pfx_evict+0x10/0x10 [ 111.103498][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 111.103510][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 111.103521][ T75] ? list_lru_walk_one+0x3c/0x50 [ 111.103533][ T75] prune_icache_sb+0x223/0x2d0 [ 111.103546][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 111.103556][ T75] ? list_lru_count_one+0x27/0x2c0 [ 111.103567][ T75] ? list_lru_count_one+0x27/0x2c0 [ 111.103578][ T75] ? list_lru_count_one+0x27/0x2c0 [ 111.103589][ T75] ? list_lru_count_one+0x264/0x2c0 [ 111.103600][ T75] super_cache_scan+0x38d/0x4a0 [ 111.103616][ T75] do_shrink_slab+0x6d0/0x10e0 [ 111.103631][ T75] shrink_slab+0x838/0x1220 [ 111.103643][ T75] ? shrink_slab+0x1e9/0x1220 [ 111.103656][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 111.103667][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 111.103680][ T75] ? shrink_node+0x2ed4/0x3b60 [ 111.103692][ T75] shrink_one+0x2a2/0x730 [ 111.103703][ T75] ? shrink_node+0x2ed4/0x3b60 [ 111.103714][ T75] shrink_node+0x3303/0x3b60 [ 111.103728][ T75] ? shrink_node+0x2ed4/0x3b60 [ 111.103740][ T75] ? percpu_ref_put+0x19/0x180 [ 111.103754][ T75] ? percpu_ref_put+0x19/0x180 [ 111.103767][ T75] ? __pfx_shrink_node+0x10/0x10 [ 111.103778][ T75] ? percpu_ref_put+0x19/0x180 [ 111.103789][ T75] ? percpu_ref_put+0x19/0x180 [ 111.103832][ T75] ? mem_cgroup_iter+0x410/0x440 [ 111.103847][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 111.103860][ T75] kswapd+0x17b6/0x31c0 [ 111.103879][ T75] ? kswapd+0x9b6/0x31c0 [ 111.103893][ T75] ? __pfx_kswapd+0x10/0x10 [ 111.103906][ T75] ? trace_contention_end+0x3d/0x140 [ 111.103917][ T75] ? __lock_acquire+0x683/0x2cf0 [ 111.103931][ T75] ? kthread_affine_node+0x2b2/0x360 [ 111.103944][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 111.103960][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 111.103971][ T75] ? __kthread_parkme+0x71/0x1f0 [ 111.103983][ T75] ? __kthread_parkme+0x196/0x1f0 [ 111.103995][ T75] kthread+0x388/0x470 [ 111.104008][ T75] ? __pfx_kswapd+0x10/0x10 [ 111.104020][ T75] ? __pfx_kthread+0x10/0x10 [ 111.104033][ T75] ret_from_fork+0x514/0xb70 [ 111.104047][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 111.104061][ T75] ? __switch_to+0xc89/0x1420 [ 111.104073][ T75] ? __pfx_kthread+0x10/0x10 [ 111.104086][ T75] ret_from_fork_asm+0x1a/0x30 [ 111.104100][ T75] [ 111.270217][ T9] usb 5-1: USB disconnect, device number 2 [ 111.270283][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 111.270303][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19