program: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) r0 = syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x0, &(0x7f0000000c00), 0x1, 0xb80, &(0x7f0000000c40)="$eJzs3MtrXFUYAPDv3jyaNrGTiqgtggGpFcVp2hSFrlrXooIuuuyYTErI9GEmggldpHWvLkRcFKR/guDeunAluKgLrX9BEYsU3bQuInce6dBkktjO9PTx+8GZe86c6XzfN5fOPQfmJoAn1kTxkEfsjYiTWUSp9XweEcON3kjESvN1t2+eny5aFqur7/+VRRYRt26en26/V9Y6jrYGIxFx9a0snv50fdz60vJ8pVarLrTGBxdPnztYX1p+fe505VT1VPXMkak3j0y9MTXVw1qvn/vw6xd+eefli5c/m3z3q90/ZXEsxlpznXX0ykRMrH0mnQYjotLrYIkMtOrprDMbTJgQAACbyjvWcM9GKQbizuKtFD/+mjQ5AAAAoCdWByJWAQAAgMdcZv8PAAAAj7n27wBu3Tw/3W5pf5HwYN04HhHjzfrb9zc3ZwZjpXEciaGI2PV3Fp23tWbNf3bfJopI3/1cLVr06T7kzaxciIjnNzr/WaP+8cZd3OvrzyNisgfxJ+4aP0r1H+tB/NT1A/BkunK8eSFbf/3L19Y/scH1b3CDa9e9SH39a6//bq9b/92pf6DL+u+9bcbY9++rV7vNda7/Tnz++0wRvzjeV1H/w40LEfsGN6o/W6s/61L/yW3GGJ2+fqnbXFF/UW+7Pej6Vy9H7I+N62/LNvv7RAdn52rVyeZjlxj7fzhxoFv8zvNftCJ+ey/wIBTnf1eX+rc6/+e2GWP8uT/3dpvbuv78j+Hsg0ZvuPXMJ5XFxYVDEcPZ2+ufP7x5Lu3XtN+jqP+Vlzb//79R/cV3wkrrcyj2Ahdax2J88a6Yo/sPf3vv9fdXUf/MPZ7/L7YZ45vvL33UbS51/QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8GvKIGIssL6/187xcjhiNiGdiV147W198bfbsx2dmirmI8RjKZ+dq1cmIKDXHWTE+1OjfGR++azwVEXsi4svSzsa4PH22NpO6eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaMRsRYZHk5IvKI+KeU5+Vy6qwAAACAnhtPnQAAAADQd/b/AAAA8Piz/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDP9rx45VoWEStHdzZaYbg1N5Q0M6Df8tQJAMkMpE4ASGYwdQJAMvb4QLbF/EjXmR09zwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh9eBvVeuZRGxcnRnoxWGW3NDSTMD+i1PnQCQzEDqBIBkBlMnACRjjw9kW8yPdJ3Z0fNcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHh4jTValpcjIm/087xcjngqIsZjKJudq1UnI2J3RPxWGtpRjA+lThoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICeqy8tz1dqteqCjo6Ozlon9TcTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp1JeW5yu1WnWhnjoTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAILX60vJ8pVarLvSxk7pGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADS+S8AAP//szUGGQ==") mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0, 0x0) open_by_handle_at(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="080000000200010008"], 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000180)={'rti800\x00', [0x100, 0x3ff, 0x1, 0xfffffffe, 0x4, 0x1000, 0xfffffffd, 0x20000004, 0x4, 0xa, 0x0, 0x6, 0x5, 0x1, 0x9, 0xffffffff, 0x6, 0x10009, 0xfe9, 0x401, 0xa, 0x6, 0x8004, 0x9, 0x44, 0x4, 0x80, 0x0, 0x43, 0x5, 0x1]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x109040, 0x0) ioctl$COMEDI_CMD(r3, 0x80506409, &(0x7f0000000180)={0x1, 0x80, 0x80, 0xd, 0xffffffff, 0x3e8, 0x2, 0x0, 0x2, 0x1, 0x20, 0xffffffff, &(0x7f0000000600)=[0x7], 0x1, 0x0}) ioctl$COMEDI_BUFINFO(r3, 0xc02c640e, &(0x7f0000000080)={0x1, 0x3, 0x2, 0x6, 0x2000}) setxattr$incfs_size(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, 0x0, 0x1) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_INSN(r4, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x80000000}) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$binfmt_format(r1, &(0x7f0000000280)='-1\x00', 0x3) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='mtd0\x00', r1, 0x4000, r0}, 0x18) syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000be6000/0x400000)=nil) lsetxattr$security_evm(&(0x7f00000002c0)='mtd0\x00', &(0x7f0000000340), &(0x7f0000000440)=@v2={0x3, 0x2, 0x14, 0xa, 0x7e, "4d883f87580a22e3753e1f28fa39f1b912a61b951f2e889aa2f409bb5418a432c594960089bbf147bf52f34fcdc371712bf6360da63883e9046551de69aa0a1e25042bd41eadde5746281791df9443ccbc75fb6a4701d9ddda2876294f784d39d7aec4579879c259d82b5e95d382ecf053007c09ca6e2275563f2a8e3390"}, 0x87, 0x3) [ 94.886762][ T4643] Bluetooth: hci0: command tx timeout [ 95.088012][ T5315] loop0: detected capacity change from 0 to 4096 [ 95.155574][ T5315] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 95.174455][ T5315] jffs2: notice: (5315) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 95.229640][ T75] [ 95.230994][ T75] ====================================================== [ 95.234766][ T75] WARNING: possible circular locking dependency detected [ 95.238279][ T75] syzkaller #0 Not tainted [ 95.240398][ T75] ------------------------------------------------------ [ 95.243620][ T75] kswapd0/75 is trying to acquire lock: [ 95.246593][ T75] ffff88801f9d7760 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 95.251175][ T75] [ 95.251175][ T75] but task is already holding lock: [ 95.254753][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 95.258726][ T75] [ 95.258726][ T75] which lock already depends on the new lock. [ 95.258726][ T75] [ 95.264159][ T75] [ 95.264159][ T75] the existing dependency chain (in reverse order) is: [ 95.268439][ T75] [ 95.268439][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 95.271770][ T75] fs_reclaim_acquire+0x71/0x100 [ 95.274613][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 95.277816][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 95.280082][ T75] jffs2_iget+0x228/0xcc0 [ 95.282412][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 95.285321][ T75] mtd_get_sb+0x18a/0x410 [ 95.287636][ T75] get_tree_mtd+0x597/0x7d0 [ 95.290185][ T75] vfs_get_tree+0x92/0x2a0 [ 95.292710][ T75] do_new_mount+0x319/0xdc0 [ 95.295319][ T75] __se_sys_mount+0x31d/0x420 [ 95.297860][ T75] do_syscall_64+0x174/0x580 [ 95.300457][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.303444][ T75] [ 95.303444][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 95.306949][ T75] __lock_acquire+0x1520/0x2cf0 [ 95.309618][ T75] lock_acquire+0x106/0x350 [ 95.312324][ T75] __mutex_lock+0x19d/0x1550 [ 95.315009][ T75] jffs2_do_clear_inode+0x62/0x390 [ 95.317775][ T75] evict+0x624/0xb50 [ 95.319939][ T75] prune_icache_sb+0x223/0x2d0 [ 95.322565][ T75] super_cache_scan+0x38d/0x4a0 [ 95.325209][ T75] do_shrink_slab+0x6d0/0x10e0 [ 95.327706][ T75] shrink_slab+0x838/0x1220 [ 95.330143][ T75] shrink_one+0x2a2/0x730 [ 95.332277][ T75] shrink_node+0x3303/0x3b60 [ 95.334781][ T75] kswapd+0x17b6/0x31c0 [ 95.337140][ T75] kthread+0x388/0x470 [ 95.339491][ T75] ret_from_fork+0x514/0xb70 [ 95.342086][ T75] ret_from_fork_asm+0x1a/0x30 [ 95.344735][ T75] [ 95.344735][ T75] other info that might help us debug this: [ 95.344735][ T75] [ 95.349391][ T75] Possible unsafe locking scenario: [ 95.349391][ T75] [ 95.352832][ T75] CPU0 CPU1 [ 95.356431][ T75] ---- ---- [ 95.359400][ T75] lock(fs_reclaim); [ 95.361932][ T75] lock(&f->sem); [ 95.365527][ T75] lock(fs_reclaim); [ 95.368630][ T75] lock(&f->sem); [ 95.370324][ T75] [ 95.370324][ T75] *** DEADLOCK *** [ 95.370324][ T75] [ 95.374431][ T75] 2 locks held by kswapd0/75: [ 95.376900][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 95.381135][ T75] #1: ffff8880343840d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 95.386116][ T75] [ 95.386116][ T75] stack backtrace: [ 95.389075][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 95.389098][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.389107][ T75] Call Trace: [ 95.389117][ T75] [ 95.389125][ T75] dump_stack_lvl+0xe8/0x150 [ 95.389151][ T75] print_circular_bug+0x2e1/0x300 [ 95.389177][ T75] check_noncircular+0x12e/0x150 [ 95.389198][ T75] __lock_acquire+0x1520/0x2cf0 [ 95.389214][ T75] ? ret_from_fork_asm+0x1a/0x30 [ 95.389236][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.389252][ T75] lock_acquire+0x106/0x350 [ 95.389266][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.389283][ T75] __mutex_lock+0x19d/0x1550 [ 95.389300][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.389317][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.389332][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 95.389345][ T75] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.389358][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 95.389372][ T75] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.389387][ T75] jffs2_do_clear_inode+0x62/0x390 [ 95.389402][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 95.389417][ T75] evict+0x624/0xb50 [ 95.389435][ T75] ? __pfx_evict+0x10/0x10 [ 95.389450][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 95.389463][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 95.389474][ T75] ? list_lru_walk_one+0x3c/0x50 [ 95.389489][ T75] prune_icache_sb+0x223/0x2d0 [ 95.389502][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 95.389513][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.389525][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.389537][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.389558][ T75] ? list_lru_count_one+0x264/0x2c0 [ 95.389571][ T75] super_cache_scan+0x38d/0x4a0 [ 95.389588][ T75] do_shrink_slab+0x6d0/0x10e0 [ 95.389605][ T75] shrink_slab+0x838/0x1220 [ 95.389618][ T75] ? shrink_slab+0x1e9/0x1220 [ 95.389631][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 95.389646][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 95.389658][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.389671][ T75] shrink_one+0x2a2/0x730 [ 95.389684][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.389695][ T75] shrink_node+0x3303/0x3b60 [ 95.389709][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.389724][ T75] ? percpu_ref_put+0x19/0x180 [ 95.389739][ T75] ? percpu_ref_put+0x19/0x180 [ 95.389754][ T75] ? __pfx_shrink_node+0x10/0x10 [ 95.389767][ T75] ? percpu_ref_put+0x19/0x180 [ 95.389780][ T75] ? percpu_ref_put+0x19/0x180 [ 95.389795][ T75] ? mem_cgroup_iter+0x410/0x440 [ 95.389812][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 95.389828][ T75] kswapd+0x17b6/0x31c0 [ 95.389850][ T75] ? kswapd+0x9b6/0x31c0 [ 95.389868][ T75] ? __pfx_kswapd+0x10/0x10 [ 95.389882][ T75] ? trace_contention_end+0x3d/0x140 [ 95.389894][ T75] ? __lock_acquire+0x683/0x2cf0 [ 95.389909][ T75] ? kthread_affine_node+0x2b2/0x360 [ 95.389924][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 95.389946][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.389959][ T75] ? __kthread_parkme+0x71/0x1f0 [ 95.389973][ T75] ? __kthread_parkme+0x196/0x1f0 [ 95.389987][ T75] kthread+0x388/0x470 [ 95.390002][ T75] ? __pfx_kswapd+0x10/0x10 [ 95.390016][ T75] ? __pfx_kthread+0x10/0x10 [ 95.390031][ T75] ret_from_fork+0x514/0xb70 [ 95.390048][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 95.390063][ T75] ? __switch_to+0xc89/0x1420 [ 95.390078][ T75] ? __pfx_kthread+0x10/0x10 [ 95.390093][ T75] ret_from_fork_asm+0x1a/0x30 [ 95.390115][ T75]