program: syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f00000000c0)={[{@orlov}, {@errors_remount}]}, 0x3, 0x5eb, &(0x7f0000000c00)="$eJzs3ctvFEcaAPCvxw9sjNYDWu0ue1gsrVYg7WJjAysU5QDXCFnkoVxyiYMNIRiwsKPEJBJGIpdIUS5RFCmnHEL+iwSFK6fklEMuOUVIKIk4RspEPdNtPHaPX9jTiP79pGG6q6Zd1djfVHVNVU8AlTWS/lOLOBgRc0nEcLK0nNcbWeZI63WPfnv/fPpIotF4+Zckkiwtf32SPQ9lBw9ExHffJnGgZ22584s3Lk/Nzs5cz/bHFq7Mjc0v3jh66crUxZmLM1cn/j9x6uSJk6fGj23rvG4WpJ29/dY7wx9Ovvbl578n41/9OJnE6Xghe+HK89gpIzHS/D9J1mYNndrpwkrSk/2dNBqNRp6W9JZbJzYv//31RcTfYzh64vEvbzg+eLHUygG7qpG03ruBKkrEP1RU3g/Ir+1XXwfXSumVAN3w8ExrAGBt/Pe2xgZjoDk2sPdREiuHdZKI2N7IXLt9EXH/3uTtC/cmb8cujcMBxZZuRcQ/iuI/acZ/PQai3oz/Wlv8p/2Cc9lzmv7SNstfPVQs/qF7WvE/sG78R4f4fz19vtmK4Te2WX798eabg23xP7jdUwIAAAAAAIDKunsmIv5X9Pl/bXn+TxTM/xmKiNM7UP7Iqv21n//XHuxAMUCBh2cini+c/1vLZ//We1YsYa1HX3Lh0uzMsYj4S0Qcib496f74OmUc/ejAZ53yRrL5f/kjLf9+Nhcwq8eD3j3tx0xPLUw9wSkDmYe3Iv5ZOP83WW7/k4L2P31nmNtkGQf+c+dcp7yN4x/YLY0vIg4Xtv+P71qRrH9/jrFmf2As7xWs9a/3Pv66U/nbjX+3mIAnl7b/e9eP/3qy8n4981sv4/hib6NT3nb7//3JK827CvVnae9OLSxcH4/oT872pKlt6RNbrzM8i/J4yOMljf8j/15//K+o/z8YEUurfnbya/ua4tzf/hj6qVN99P+hPGn8T2+p/d/6xsSd+jedyt9c+3+i2dYfyVKM/0HLp3mY9renF4Rjb1FWt+sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+CWkTsi6Q2urxdq42ORgxFxF9jb2322vzCfy9ce/vqdJrX/P7/Wv5Nv8Ot/ST//v/6iv2JVfvHI2J/RHzSM9jcHz1/bXa67JMHAAAAAAAAAAAAAAAAAACAp8RQh/X/qZ97yq4dsOt6y64AUJqC+P++jHoA3af9h+oS/1Bd4h+qS/xDdYl/qC7xD9Ul/qG6xD8AAAAAADxT9h+6+0MSEUvPDTYfqf4sr6/UmgG7rVZ2BYDSuMUPVJepP1BdrvGBZIP8gY4HbXTkeubOP8HBAAAAAAAAAAAAAFA5hw9a/w9VZf0/VJf1/1Bd+fr/QyXXA+g+1/hAbLCSv3D9/4ZHAQAAAAAAAAAAAAA7aX7xxuWp2dmZ6zZefTqq0c2NRqNxM/0reFrqs/MbSTZDvSuF5lPhu3+m/Zs5wXyt3+Z+cnnvSQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQLs/AwAA//+JjCTl") mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) rename(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) [ 109.078119][ T5279] Bluetooth: hci0: command tx timeout [ 109.198171][ T5321] loop0: detected capacity change from 0 to 1024 [ 109.323397][ T5321] EXT4-fs: Ignoring removed orlov option [ 109.436221][ T5321] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.471980][ T5321] jffs2: notice: (5321) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 109.516564][ T75] [ 109.517773][ T75] ====================================================== [ 109.521009][ T75] WARNING: possible circular locking dependency detected [ 109.523944][ T75] syzkaller #0 Not tainted [ 109.525763][ T75] ------------------------------------------------------ [ 109.528636][ T75] kswapd0/75 is trying to acquire lock: [ 109.531213][ T75] ffff88801f4931e0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 109.535206][ T75] [ 109.535206][ T75] but task is already holding lock: [ 109.538787][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 109.541992][ T75] [ 109.541992][ T75] which lock already depends on the new lock. [ 109.541992][ T75] [ 109.546245][ T75] [ 109.546245][ T75] the existing dependency chain (in reverse order) is: [ 109.550614][ T75] [ 109.550614][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 109.553753][ T75] fs_reclaim_acquire+0x71/0x100 [ 109.556037][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 109.558582][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 109.560984][ T75] jffs2_iget+0x228/0xcc0 [ 109.563168][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 109.565533][ T75] mtd_get_sb+0x18a/0x410 [ 109.567663][ T75] get_tree_mtd+0x597/0x7d0 [ 109.569877][ T75] vfs_get_tree+0x92/0x2a0 [ 109.572089][ T75] do_new_mount+0x319/0xdc0 [ 109.574339][ T75] __se_sys_mount+0x31d/0x420 [ 109.576729][ T75] do_syscall_64+0x174/0x580 [ 109.579057][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.581906][ T75] [ 109.581906][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 109.584940][ T75] __lock_acquire+0x1520/0x2cf0 [ 109.587435][ T75] lock_acquire+0x106/0x350 [ 109.589729][ T75] __mutex_lock+0x19d/0x1550 [ 109.591976][ T75] jffs2_do_clear_inode+0x62/0x390 [ 109.594466][ T75] evict+0x624/0xb50 [ 109.596213][ T75] prune_icache_sb+0x223/0x2d0 [ 109.598370][ T75] super_cache_scan+0x38d/0x4a0 [ 109.600399][ T75] do_shrink_slab+0x6d0/0x10e0 [ 109.602591][ T75] shrink_slab+0x838/0x1220 [ 109.604632][ T75] shrink_one+0x2a2/0x730 [ 109.606900][ T75] shrink_node+0x3303/0x3b60 [ 109.609047][ T75] kswapd+0x17b6/0x31c0 [ 109.611067][ T75] kthread+0x388/0x470 [ 109.613009][ T75] ret_from_fork+0x514/0xb70 [ 109.615333][ T75] ret_from_fork_asm+0x1a/0x30 [ 109.617896][ T75] [ 109.617896][ T75] other info that might help us debug this: [ 109.617896][ T75] [ 109.622369][ T75] Possible unsafe locking scenario: [ 109.622369][ T75] [ 109.625442][ T75] CPU0 CPU1 [ 109.627608][ T75] ---- ---- [ 109.629942][ T75] lock(fs_reclaim); [ 109.631658][ T75] lock(&f->sem); [ 109.634191][ T75] lock(fs_reclaim); [ 109.636968][ T75] lock(&f->sem); [ 109.638679][ T75] [ 109.638679][ T75] *** DEADLOCK *** [ 109.638679][ T75] [ 109.642117][ T75] 2 locks held by kswapd0/75: [ 109.644037][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 109.647455][ T75] #1: ffff8880123d00d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 109.651672][ T75] [ 109.651672][ T75] stack backtrace: [ 109.654235][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 109.654253][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.654261][ T75] Call Trace: [ 109.654268][ T75] [ 109.654274][ T75] dump_stack_lvl+0xe8/0x150 [ 109.654295][ T75] print_circular_bug+0x2e1/0x300 [ 109.654315][ T75] check_noncircular+0x12e/0x150 [ 109.654332][ T75] __lock_acquire+0x1520/0x2cf0 [ 109.654347][ T75] ? ret_from_fork_asm+0x1a/0x30 [ 109.654367][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 109.654382][ T75] lock_acquire+0x106/0x350 [ 109.654395][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 109.654411][ T75] __mutex_lock+0x19d/0x1550 [ 109.654427][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 109.654443][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 109.654457][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 109.654470][ T75] ? do_raw_spin_lock+0x12b/0x2f0 [ 109.654483][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 109.654495][ T75] ? lockdep_hardirqs_on+0x7a/0x110 [ 109.654510][ T75] jffs2_do_clear_inode+0x62/0x390 [ 109.654525][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 109.654541][ T75] evict+0x624/0xb50 [ 109.654558][ T75] ? __pfx_evict+0x10/0x10 [ 109.654572][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 109.654580][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 109.654587][ T75] ? list_lru_walk_one+0x3c/0x50 [ 109.654600][ T75] prune_icache_sb+0x223/0x2d0 [ 109.654612][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 109.654623][ T75] ? list_lru_count_one+0x27/0x2c0 [ 109.654635][ T75] ? list_lru_count_one+0x27/0x2c0 [ 109.654646][ T75] ? list_lru_count_one+0x27/0x2c0 [ 109.654659][ T75] ? list_lru_count_one+0x264/0x2c0 [ 109.654671][ T75] super_cache_scan+0x38d/0x4a0 [ 109.654696][ T75] do_shrink_slab+0x6d0/0x10e0 [ 109.654713][ T75] shrink_slab+0x838/0x1220 [ 109.654726][ T75] ? shrink_slab+0x1e9/0x1220 [ 109.654740][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 109.654753][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 109.654765][ T75] ? shrink_node+0x2ed4/0x3b60 [ 109.654777][ T75] shrink_one+0x2a2/0x730 [ 109.654790][ T75] ? shrink_node+0x2ed4/0x3b60 [ 109.654801][ T75] shrink_node+0x3303/0x3b60 [ 109.654816][ T75] ? shrink_node+0x2ed4/0x3b60 [ 109.654831][ T75] ? percpu_ref_put+0x19/0x180 [ 109.654842][ T75] ? percpu_ref_put+0x19/0x180 [ 109.654851][ T75] ? __pfx_shrink_node+0x10/0x10 [ 109.654858][ T75] ? percpu_ref_put+0x19/0x180 [ 109.654866][ T75] ? percpu_ref_put+0x19/0x180 [ 109.654875][ T75] ? mem_cgroup_iter+0x410/0x440 [ 109.654885][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 109.654895][ T75] kswapd+0x17b6/0x31c0 [ 109.654913][ T75] ? kswapd+0x9b6/0x31c0 [ 109.654928][ T75] ? __pfx_kswapd+0x10/0x10 [ 109.654942][ T75] ? trace_contention_end+0x3d/0x140 [ 109.654953][ T75] ? __lock_acquire+0x683/0x2cf0 [ 109.654967][ T75] ? kthread_affine_node+0x2b2/0x360 [ 109.654982][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 109.655001][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 109.655012][ T75] ? __kthread_parkme+0x71/0x1f0 [ 109.655025][ T75] ? __kthread_parkme+0x196/0x1f0 [ 109.655038][ T75] kthread+0x388/0x470 [ 109.655053][ T75] ? __pfx_kswapd+0x10/0x10 [ 109.655065][ T75] ? __pfx_kthread+0x10/0x10 [ 109.655080][ T75] ret_from_fork+0x514/0xb70 [ 109.655096][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 109.655110][ T75] ? __switch_to+0xc89/0x1420 [ 109.655123][ T75] ? __pfx_kthread+0x10/0x10 [ 109.655136][ T75] ret_from_fork_asm+0x1a/0x30 [ 109.655155][ T75]