program: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="02010002070000000000000000000000030005000000000002000000000000000000000200100000000000ff"], 0x38}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414000800080004"], 0x2c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r3 = openat(r1, &(0x7f0000000400)='./file0\x00', 0x80002, 0x1a4) write(r3, &(0x7f0000000100)='+p', 0x2) mkdirat(r1, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000380)='10000', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r6, &(0x7f0000000280)='0', 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), r3) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="2400f795ff0000", @ANYRES16=r7, @ANYBLOB="000829bd7000170000000d00000008000500060000000800050002000000"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x8000) openat(0xffffffffffffff9c, 0x0, 0x682403, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./sys\x00') [ 117.526531][ T46] Bluetooth: hci0: command tx timeout [ 117.712274][ T5335] jffs2: notice: (5335) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 117.797309][ T71] [ 117.798446][ T71] ====================================================== [ 117.801362][ T71] WARNING: possible circular locking dependency detected [ 117.804252][ T71] syzkaller #0 Not tainted [ 117.806135][ T71] ------------------------------------------------------ [ 117.809087][ T71] kswapd0/71 is trying to acquire lock: [ 117.811471][ T71] ffff888013247760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 117.815535][ T71] [ 117.815535][ T71] but task is already holding lock: [ 117.818602][ T71] ffffffff8ee92540 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0xa08/0x32c0 [ 117.821959][ T71] [ 117.821959][ T71] which lock already depends on the new lock. [ 117.821959][ T71] [ 117.826279][ T71] [ 117.826279][ T71] the existing dependency chain (in reverse order) is: [ 117.830108][ T71] [ 117.830108][ T71] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 117.833135][ T71] fs_reclaim_acquire+0x71/0x100 [ 117.835393][ T71] kmem_cache_alloc_noprof+0x5f/0x600 [ 117.837906][ T71] jffs2_do_read_inode+0x33f/0x6a0 [ 117.840309][ T71] jffs2_iget+0x228/0xcc0 [ 117.842392][ T71] jffs2_do_fill_super+0x59d/0xc50 [ 117.844801][ T71] mtd_get_sb+0x18a/0x410 [ 117.846810][ T71] get_tree_mtd+0x597/0x7d0 [ 117.848824][ T71] vfs_get_tree+0x92/0x2a0 [ 117.850920][ T71] do_new_mount+0x319/0xdc0 [ 117.853092][ T71] __se_sys_mount+0x31d/0x420 [ 117.855348][ T71] do_syscall_64+0x166/0x520 [ 117.857515][ T71] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.860196][ T71] [ 117.860196][ T71] -> #0 (&f->sem){+.+.}-{4:4}: [ 117.862918][ T71] __lock_acquire+0x164c/0x2de0 [ 117.865100][ T71] lock_acquire+0x115/0x350 [ 117.867120][ T71] __mutex_lock+0x19d/0x1550 [ 117.869245][ T71] jffs2_do_clear_inode+0x62/0x390 [ 117.871740][ T71] evict+0x624/0xb50 [ 117.873665][ T71] prune_icache_sb+0x223/0x2d0 [ 117.876015][ T71] super_cache_scan+0x390/0x4a0 [ 117.878362][ T71] do_shrink_slab+0x6d0/0x10e0 [ 117.880792][ T71] shrink_slab+0x838/0x1220 [ 117.883023][ T71] shrink_one+0x2a2/0x730 [ 117.885145][ T71] shrink_node+0x35d0/0x3e30 [ 117.887441][ T71] kswapd+0x185e/0x32c0 [ 117.889379][ T71] kthread+0x38b/0x480 [ 117.891380][ T71] ret_from_fork+0x514/0xb70 [ 117.893473][ T71] ret_from_fork_asm+0x1a/0x30 [ 117.895593][ T71] [ 117.895593][ T71] other info that might help us debug this: [ 117.895593][ T71] [ 117.899787][ T71] Possible unsafe locking scenario: [ 117.899787][ T71] [ 117.903942][ T71] CPU0 CPU1 [ 117.906203][ T71] ---- ---- [ 117.908538][ T71] lock(fs_reclaim); [ 117.910388][ T71] lock(&f->sem); [ 117.913097][ T71] lock(fs_reclaim); [ 117.915927][ T71] lock(&f->sem); [ 117.917584][ T71] [ 117.917584][ T71] *** DEADLOCK *** [ 117.917584][ T71] [ 117.921043][ T71] locks held by kswapd0/71: 2, last CPU#0: [ 117.923570][ T71] #0: ffffffff8ee92540 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0xa08/0x32c0 [ 117.927143][ T71] #1: ffff88803ed3c0e8 (&type->s_umount_key#54){.+.+}-{4:4}, at: super_cache_scan+0x94/0x4a0 [ 117.931283][ T71] [ 117.931283][ T71] stack backtrace: [ 117.933736][ T71] CPU: 0 UID: 0 PID: 71 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 117.937263][ T71] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.941626][ T71] Call Trace: [ 117.943056][ T71] [ 117.944351][ T71] dump_stack_lvl+0xe8/0x150 [ 117.946385][ T71] print_circular_bug+0x2e2/0x300 [ 117.948596][ T71] check_noncircular+0x12f/0x150 [ 117.950791][ T71] __lock_acquire+0x164c/0x2de0 [ 117.952835][ T71] lock_acquire+0x115/0x350 [ 117.954773][ T71] ? jffs2_do_clear_inode+0x62/0x390 [ 117.957085][ T71] __mutex_lock+0x19d/0x1550 [ 117.959019][ T71] ? jffs2_do_clear_inode+0x62/0x390 [ 117.961396][ T71] ? do_raw_spin_lock+0x12b/0x2f0 [ 117.963570][ T71] ? lock_acquire+0x115/0x350 [ 117.965580][ T71] ? jffs2_do_clear_inode+0x62/0x390 [ 117.967826][ T71] ? __pfx___mutex_lock+0x10/0x10 [ 117.970035][ T71] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 117.972551][ T71] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 117.974941][ T71] jffs2_do_clear_inode+0x62/0x390 [ 117.977042][ T71] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 117.979423][ T71] evict+0x624/0xb50 [ 117.981117][ T71] ? __pfx_evict+0x10/0x10 [ 117.983050][ T71] ? __pfx_inode_lru_isolate+0x10/0x10 [ 117.985374][ T71] ? __pfx_inode_lru_isolate+0x10/0x10 [ 117.987583][ T71] ? list_lru_walk_one+0x3c/0x50 [ 117.989722][ T71] prune_icache_sb+0x223/0x2d0 [ 117.992015][ T71] ? __pfx_prune_icache_sb+0x10/0x10 [ 117.994348][ T71] ? list_lru_count_one+0x27/0x2c0 [ 117.996534][ T71] ? list_lru_count_one+0x27/0x2c0 [ 117.998776][ T71] ? list_lru_count_one+0x27/0x2c0 [ 118.001004][ T71] ? list_lru_count_one+0x264/0x2c0 [ 118.003262][ T71] super_cache_scan+0x390/0x4a0 [ 118.005344][ T71] do_shrink_slab+0x6d0/0x10e0 [ 118.007458][ T71] shrink_slab+0x838/0x1220 [ 118.009454][ T71] ? shrink_slab+0x1e9/0x1220 [ 118.011487][ T71] ? __pfx_shrink_slab+0x10/0x10 [ 118.013594][ T71] shrink_one+0x2a2/0x730 [ 118.015518][ T71] ? shrink_node+0x31a1/0x3e30 [ 118.017515][ T71] shrink_node+0x35d0/0x3e30 [ 118.019554][ T71] ? shrink_node+0x31a1/0x3e30 [ 118.021700][ T71] ? __lock_acquire+0x747/0x2de0 [ 118.023858][ T71] ? lock_acquire+0x115/0x350 [ 118.025944][ T71] ? percpu_ref_put+0x19/0x180 [ 118.028107][ T71] ? __pfx_shrink_node+0x10/0x10 [ 118.030311][ T71] ? percpu_ref_put+0x19/0x180 [ 118.032568][ T71] ? percpu_ref_put+0x19/0x180 [ 118.034636][ T71] ? mem_cgroup_iter+0x410/0x440 [ 118.036867][ T71] ? mem_cgroup_iter+0x3b/0x440 [ 118.039103][ T71] kswapd+0x185e/0x32c0 [ 118.040973][ T71] ? kswapd+0xa08/0x32c0 [ 118.042835][ T71] ? __pfx_kswapd+0x10/0x10 [ 118.044763][ T71] ? __lock_acquire+0x747/0x2de0 [ 118.046904][ T71] ? __mutex_unlock_slowpath+0x731/0x900 [ 118.049393][ T71] ? __pfx_autoremove_wake_function+0x10/0x10 [ 118.051959][ T71] ? __kthread_parkme+0x71/0x1f0 [ 118.054022][ T71] ? __kthread_parkme+0x199/0x1f0 [ 118.056121][ T71] kthread+0x38b/0x480 [ 118.057873][ T71] ? __pfx_kswapd+0x10/0x10 [ 118.059842][ T71] ? __pfx_kthread+0x10/0x10 [ 118.061831][ T71] ret_from_fork+0x514/0xb70 [ 118.063769][ T71] ? __pfx_ret_from_fork+0x10/0x10 [ 118.065649][ T71] ? __switch_to+0xc89/0x1420 [ 118.067519][ T71] ? __pfx_kthread+0x10/0x10 [ 118.069424][ T71] ret_from_fork_asm+0x1a/0x30 [ 118.071448][ T71]