program: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r1 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") getdents(r1, &(0x7f0000001fc0)=""/184, 0x18) syz_usb_control_io(r0, 0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_TEST(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723020001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$netlink(r6, 0x10e, 0x6, 0x0, &(0x7f0000000000)) sendmsg$IPSET_CMD_TEST(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x5c, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x84}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}}, 0x4800) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0xf, &(0x7f00000004c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0xba}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1f, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) [ 150.821329][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 150.824068][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 150.827929][ T5287] Bluetooth: hci0: command tx timeout [ 151.145783][ T4690] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 151.300175][ T4690] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 151.304358][ T4690] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 151.308661][ T4690] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.345041][ T4690] as10x_usb: device has been detected [ 151.355011][ T4690] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 151.391343][ T4690] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 151.424134][ T4690] as10x_usb: error during firmware upload part1 [ 151.427648][ T4690] Registered device Abilis Systems DVB-Titan [ 152.600295][ T5329] jffs2: notice: (5329) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 152.648276][ T5329] loop0: detected capacity change from 0 to 2048 [ 152.671326][ T5329] loop0: p2 p3 < > p4 < p5 > [ 152.674606][ T5329] loop0: partition table partially beyond EOD, truncated [ 152.683772][ T5329] loop0: p3 start 4225 is beyond EOD, truncated [ 152.752582][ T4691] loop0: p2 p3 < > p4 < p5 > [ 152.756894][ T4691] loop0: partition table partially beyond EOD, truncated [ 152.761312][ T4691] loop0: p3 start 4225 is beyond EOD, truncated [ 152.897333][ T5287] Bluetooth: hci0: command tx timeout [ 152.975265][ T75] [ 152.976367][ T75] ====================================================== [ 152.979550][ T75] WARNING: possible circular locking dependency detected [ 152.982505][ T75] syzkaller #0 Not tainted [ 152.984418][ T75] ------------------------------------------------------ [ 152.987328][ T75] kswapd0/75 is trying to acquire lock: [ 152.989597][ T75] ffff88801ad07760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 152.993253][ T75] [ 152.993253][ T75] but task is already holding lock: [ 152.996250][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 152.999635][ T75] [ 152.999635][ T75] which lock already depends on the new lock. [ 152.999635][ T75] [ 153.004198][ T75] [ 153.004198][ T75] the existing dependency chain (in reverse order) is: [ 153.008257][ T75] [ 153.008257][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 153.011358][ T75] fs_reclaim_acquire+0x71/0x100 [ 153.013801][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 153.016339][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 153.018771][ T75] jffs2_iget+0x228/0xcc0 [ 153.020988][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 153.023404][ T75] mtd_get_sb+0x18a/0x410 [ 153.025430][ T75] get_tree_mtd+0x597/0x7d0 [ 153.027655][ T75] vfs_get_tree+0x92/0x2a0 [ 153.029833][ T75] do_new_mount+0x319/0xdc0 [ 153.031981][ T75] __se_sys_mount+0x31d/0x420 [ 153.034204][ T75] do_syscall_64+0x174/0x580 [ 153.036482][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.039254][ T75] [ 153.039254][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 153.042013][ T75] __lock_acquire+0x1520/0x2cf0 [ 153.044143][ T75] lock_acquire+0x106/0x350 [ 153.046080][ T75] __mutex_lock+0x19d/0x1550 [ 153.048205][ T75] jffs2_do_clear_inode+0x62/0x390 [ 153.050610][ T75] evict+0x624/0xb50 [ 153.052577][ T75] prune_icache_sb+0x223/0x2d0 [ 153.054876][ T75] super_cache_scan+0x38d/0x4a0 [ 153.057168][ T75] do_shrink_slab+0x6d0/0x10e0 [ 153.059567][ T75] shrink_slab+0x838/0x1220 [ 153.061837][ T75] shrink_one+0x2a2/0x730 [ 153.063907][ T75] shrink_node+0x3303/0x3b60 [ 153.066110][ T75] kswapd+0x17b6/0x31c0 [ 153.068082][ T75] kthread+0x388/0x470 [ 153.070052][ T75] ret_from_fork+0x514/0xb70 [ 153.072346][ T75] ret_from_fork_asm+0x1a/0x30 [ 153.074544][ T75] [ 153.074544][ T75] other info that might help us debug this: [ 153.074544][ T75] [ 153.078720][ T75] Possible unsafe locking scenario: [ 153.078720][ T75] [ 153.081970][ T75] CPU0 CPU1 [ 153.084252][ T75] ---- ---- [ 153.086448][ T75] lock(fs_reclaim); [ 153.088132][ T75] lock(&f->sem); [ 153.090945][ T75] lock(fs_reclaim); [ 153.093685][ T75] lock(&f->sem); [ 153.095347][ T75] [ 153.095347][ T75] *** DEADLOCK *** [ 153.095347][ T75] [ 153.098864][ T75] 2 locks held by kswapd0/75: [ 153.100976][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 153.104595][ T75] #1: ffff8880121760d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 153.109046][ T75] [ 153.109046][ T75] stack backtrace: [ 153.111444][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 153.111458][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 153.111465][ T75] Call Trace: [ 153.111472][ T75] [ 153.111478][ T75] dump_stack_lvl+0xe8/0x150 [ 153.111496][ T75] print_circular_bug+0x2e1/0x300 [ 153.111513][ T75] check_noncircular+0x12e/0x150 [ 153.111527][ T75] __lock_acquire+0x1520/0x2cf0 [ 153.111540][ T75] ? ret_from_fork_asm+0x1a/0x30 [ 153.111557][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 153.111571][ T75] lock_acquire+0x106/0x350 [ 153.111582][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 153.111597][ T75] __mutex_lock+0x19d/0x1550 [ 153.111610][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 153.111630][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 153.111641][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 153.111653][ T75] ? do_raw_spin_lock+0x12b/0x2f0 [ 153.111664][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 153.111675][ T75] ? lockdep_hardirqs_on+0x7a/0x110 [ 153.111685][ T75] jffs2_do_clear_inode+0x62/0x390 [ 153.111698][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 153.111710][ T75] evict+0x624/0xb50 [ 153.111726][ T75] ? __pfx_evict+0x10/0x10 [ 153.111737][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 153.111748][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 153.111758][ T75] ? list_lru_walk_one+0x3c/0x50 [ 153.111768][ T75] prune_icache_sb+0x223/0x2d0 [ 153.111778][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 153.111787][ T75] ? list_lru_count_one+0x27/0x2c0 [ 153.111797][ T75] ? list_lru_count_one+0x27/0x2c0 [ 153.111807][ T75] ? list_lru_count_one+0x27/0x2c0 [ 153.111817][ T75] ? list_lru_count_one+0x264/0x2c0 [ 153.111827][ T75] super_cache_scan+0x38d/0x4a0 [ 153.111840][ T75] do_shrink_slab+0x6d0/0x10e0 [ 153.111856][ T75] shrink_slab+0x838/0x1220 [ 153.111866][ T75] ? shrink_slab+0x1e9/0x1220 [ 153.111877][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 153.111888][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 153.111900][ T75] ? shrink_node+0x2ed4/0x3b60 [ 153.111910][ T75] shrink_one+0x2a2/0x730 [ 153.111920][ T75] ? shrink_node+0x2ed4/0x3b60 [ 153.111929][ T75] shrink_node+0x3303/0x3b60 [ 153.111942][ T75] ? shrink_node+0x2ed4/0x3b60 [ 153.111954][ T75] ? percpu_ref_put+0x19/0x180 [ 153.111967][ T75] ? percpu_ref_put+0x19/0x180 [ 153.111977][ T75] ? __pfx_shrink_node+0x10/0x10 [ 153.111986][ T75] ? percpu_ref_put+0x19/0x180 [ 153.111996][ T75] ? percpu_ref_put+0x19/0x180 [ 153.112008][ T75] ? mem_cgroup_iter+0x410/0x440 [ 153.112022][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 153.112034][ T75] kswapd+0x17b6/0x31c0 [ 153.112051][ T75] ? kswapd+0x9b6/0x31c0 [ 153.112065][ T75] ? __pfx_kswapd+0x10/0x10 [ 153.112076][ T75] ? trace_contention_end+0x3d/0x140 [ 153.112085][ T75] ? __lock_acquire+0x683/0x2cf0 [ 153.112098][ T75] ? kthread_affine_node+0x2b2/0x360 [ 153.112110][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 153.112125][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 153.112136][ T75] ? __kthread_parkme+0x71/0x1f0 [ 153.112146][ T75] ? __kthread_parkme+0x196/0x1f0 [ 153.112157][ T75] kthread+0x388/0x470 [ 153.112170][ T75] ? __pfx_kswapd+0x10/0x10 [ 153.112181][ T75] ? __pfx_kthread+0x10/0x10 [ 153.112191][ T75] ret_from_fork+0x514/0xb70 [ 153.112205][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 153.112217][ T75] ? __switch_to+0xc89/0x1420 [ 153.112229][ T75] ? __pfx_kthread+0x10/0x10 [ 153.112241][ T75] ret_from_fork_asm+0x1a/0x30 [ 153.112257][ T75] [ 153.502234][ T10] usb 5-1: USB disconnect, device number 2 [ 153.531255][ T10] Unregistered device Abilis Systems DVB-Titan [ 153.533723][ T10] as10x_usb: device has been disconnected