program: unshare(0x64000000) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000040), 0x0, 0x258, &(0x7f0000000780)="$eJzs3UFoHFUYB/BvZneNSRaJehEEFUREAyHeBD3Ei0JAYpAgqBAR8aIkQkzwlnjqpYf23Jacegmlt6Y9llxCLy2FntI2h/RSaEMPDT20hy2TSUrabLqlu90pmd8Php3ZmTffG2b/b/YyvABKayAiRiKiEhGDEVGLiGTvAR/ly8DO5mLv6mREo/HjvWT7uHw7t9uuPyIWIuLLiFhJk/irGjG3/MvGg7XvPj06W/vk9PLPvV29yB2bG+vfb50aO3Ju9Iu5K9fujCUxEvWnrqvzkibfVZOId15FsddEUi26B7yI8f/OXs9y/25EfLyd/1qkkd+8YzNvrNTi85MHtT1+9+r73ewr0HmNRi17Bi40gNJJI6IeSToUEfl6mg4N5f/hb1T60r+nZ/4d/HN6duqPokcqoFPqEevfXug53/9M/m9X8vwDh1eW/4nxpZvZ+lal6N4A3ZTlf/C3+c/igPy/WUCfgE5Jn7u3Vf6Bw0v+obzkH8qrM/nv72ifgO7w/Ifykn845L4+eJf8Q3nJP5SX/EN57c0/AFAujZ6i30AGilL0+AMAAAAAAAAAAAAAAAAAAOy32Ls6ubt0q+alExGb30REtVn9ys4MZvlMhH33k+ywJ5K8WVt+/bDNE7TpTMFvX791q9j6lz/owEkmfnjppvNTEQv/R8Rwtbr/95e0mEGvtbdb7K/93maBNn31U7H1Hy0VW390LeJiNv4MNxt/0nhv+7P5+FPP7l+b9f952OYJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6JrHAQAA//+wa24f") r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000580)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') symlink(&(0x7f00000000c0)='mnt/encrypted_dir\x00', &(0x7f0000000100)='./file0\x00') ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000002d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x820}}, {{&(0x7f0000001580)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40042}}], 0x2, 0x20000000) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r3, r5, 0xd, 0x0, @void}, 0x10) r6 = socket$nl_rdma(0x10, 0x3, 0x14) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r7, &(0x7f0000000340)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec970000e01100e18000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) [ 88.511369][ T47] Bluetooth: hci0: command tx timeout [ 88.691733][ T5346] loop0: detected capacity change from 0 to 128 [ 88.780439][ T5346] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 88.818827][ T5346] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 88.879847][ T5346] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 88.911510][ T5346] fscrypt: loop0: 1 inode(s) still busy after removing key with identifier 69b2f6edeee720cce0577937eb8a6751, including ino 12 [ 88.969060][ T5345] syz.0.0 uses obsolete (PF_INET,SOCK_PACKET) [ 89.039707][ T5346] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 89.060102][ T5346] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 89.202732][ T78] [ 89.203809][ T78] ====================================================== [ 89.206881][ T78] WARNING: possible circular locking dependency detected [ 89.209621][ T78] syzkaller #0 Not tainted [ 89.211553][ T78] ------------------------------------------------------ [ 89.214576][ T78] kswapd0/78 is trying to acquire lock: [ 89.217025][ T78] ffff888042e2f098 (&type->lock_class){+.+.}-{4:4}, at: keyring_clear+0xaf/0x240 [ 89.221005][ T78] [ 89.221005][ T78] but task is already holding lock: [ 89.224119][ T78] ffffffff8e2517c0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x92a/0x2820 [ 89.227726][ T78] [ 89.227726][ T78] which lock already depends on the new lock. [ 89.227726][ T78] [ 89.232266][ T78] [ 89.232266][ T78] the existing dependency chain (in reverse order) is: [ 89.236002][ T78] [ 89.236002][ T78] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 89.239251][ T78] fs_reclaim_acquire+0x72/0x100 [ 89.241650][ T78] __kmalloc_cache_noprof+0x40/0x700 [ 89.244081][ T78] assoc_array_insert+0x92/0x2f90 [ 89.246529][ T78] __key_link_begin+0xd6/0x1f0 [ 89.248785][ T78] __key_create_or_update+0x41a/0xa30 [ 89.251220][ T78] key_create_or_update+0x42/0x60 [ 89.253564][ T78] x509_load_certificate_list+0x145/0x280 [ 89.256357][ T78] do_one_initcall+0x1fb/0x820 [ 89.258892][ T78] do_initcall_level+0x104/0x190 [ 89.261376][ T78] do_initcalls+0x59/0xa0 [ 89.263634][ T78] kernel_init_freeable+0x334/0x4b0 [ 89.266230][ T78] kernel_init+0x1d/0x1d0 [ 89.268582][ T78] ret_from_fork+0x599/0xb30 [ 89.270929][ T78] ret_from_fork_asm+0x1a/0x30 [ 89.273217][ T78] [ 89.273217][ T78] -> #0 (&type->lock_class){+.+.}-{4:4}: [ 89.276707][ T78] __lock_acquire+0x15a6/0x2cf0 [ 89.278956][ T78] lock_acquire+0x117/0x340 [ 89.281156][ T78] down_write+0x96/0x1f0 [ 89.282927][ T78] keyring_clear+0xaf/0x240 [ 89.284840][ T78] fscrypt_put_master_key+0xca/0x190 [ 89.287213][ T78] put_crypt_info+0x26d/0x310 [ 89.289376][ T78] fscrypt_put_encryption_info+0xf6/0x140 [ 89.291959][ T78] ext4_clear_inode+0x170/0x2f0 [ 89.294252][ T78] ext4_evict_inode+0x9f6/0xe60 [ 89.296556][ T78] evict+0x5f4/0xae0 [ 89.298452][ T78] __dentry_kill+0x209/0x660 [ 89.300447][ T78] shrink_kill+0xa9/0x2c0 [ 89.302497][ T78] shrink_dentry_list+0x2e0/0x5e0 [ 89.304827][ T78] prune_dcache_sb+0x10e/0x180 [ 89.307101][ T78] super_cache_scan+0x369/0x4b0 [ 89.310074][ T78] do_shrink_slab+0x6df/0x10d0 [ 89.312686][ T78] shrink_slab+0x7ef/0x10d0 [ 89.314921][ T78] shrink_one+0x2d9/0x720 [ 89.317015][ T78] shrink_node+0x2f7d/0x35b0 [ 89.319099][ T78] kswapd+0x145a/0x2820 [ 89.320976][ T78] kthread+0x711/0x8a0 [ 89.322725][ T78] ret_from_fork+0x599/0xb30 [ 89.324572][ T78] ret_from_fork_asm+0x1a/0x30 [ 89.326640][ T78] [ 89.326640][ T78] other info that might help us debug this: [ 89.326640][ T78] [ 89.330593][ T78] Possible unsafe locking scenario: [ 89.330593][ T78] [ 89.333642][ T78] CPU0 CPU1 [ 89.335845][ T78] ---- ---- [ 89.338018][ T78] lock(fs_reclaim); [ 89.339635][ T78] lock(&type->lock_class); [ 89.342604][ T78] lock(fs_reclaim); [ 89.345355][ T78] lock(&type->lock_class); [ 89.347473][ T78] [ 89.347473][ T78] *** DEADLOCK *** [ 89.347473][ T78] [ 89.351096][ T78] 2 locks held by kswapd0/78: [ 89.353192][ T78] #0: ffffffff8e2517c0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x92a/0x2820 [ 89.356945][ T78] #1: ffff8880433cc0e0 (&type->s_umount_key#32){++++}-{4:4}, at: super_cache_scan+0x91/0x4b0 [ 89.361516][ T78] [ 89.361516][ T78] stack backtrace: [ 89.364071][ T78] CPU: 0 UID: 0 PID: 78 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 89.364081][ T78] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 89.364086][ T78] Call Trace: [ 89.364092][ T78] [ 89.364097][ T78] dump_stack_lvl+0x189/0x250 [ 89.364113][ T78] ? __pfx_dump_stack_lvl+0x10/0x10 [ 89.364124][ T78] ? __pfx__printk+0x10/0x10 [ 89.364138][ T78] ? print_lock_name+0xde/0x100 [ 89.364150][ T78] print_circular_bug+0x2e2/0x300 [ 89.364163][ T78] check_noncircular+0x12e/0x150 [ 89.364175][ T78] __lock_acquire+0x15a6/0x2cf0 [ 89.364191][ T78] ? keyring_clear+0xaf/0x240 [ 89.364201][ T78] lock_acquire+0x117/0x340 [ 89.364207][ T78] ? keyring_clear+0xaf/0x240 [ 89.364215][ T78] down_write+0x96/0x1f0 [ 89.364223][ T78] ? keyring_clear+0xaf/0x240 [ 89.364230][ T78] ? __pfx_down_write+0x10/0x10 [ 89.364237][ T78] keyring_clear+0xaf/0x240 [ 89.364245][ T78] ? __pfx_keyring_clear+0x10/0x10 [ 89.364257][ T78] fscrypt_put_master_key+0xca/0x190 [ 89.364272][ T78] put_crypt_info+0x26d/0x310 [ 89.364282][ T78] fscrypt_put_encryption_info+0xf6/0x140 [ 89.364292][ T78] ext4_clear_inode+0x170/0x2f0 [ 89.364308][ T78] ext4_evict_inode+0x9f6/0xe60 [ 89.364318][ T78] ? inode_wait_for_writeback+0x14d/0x370 [ 89.364329][ T78] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 89.364337][ T78] ? __pfx_ext4_evict_inode+0x10/0x10 [ 89.364343][ T78] ? do_raw_spin_unlock+0x4d/0x240 [ 89.364351][ T78] ? __pfx_ext4_evict_inode+0x10/0x10 [ 89.364358][ T78] evict+0x5f4/0xae0 [ 89.364372][ T78] ? __pfx_evict+0x10/0x10 [ 89.364390][ T78] ? _raw_spin_unlock+0x28/0x50 [ 89.364402][ T78] ? iput+0xcc6/0x1030 [ 89.364414][ T78] __dentry_kill+0x209/0x660 [ 89.364428][ T78] ? shrink_kill+0x8d/0x2c0 [ 89.364438][ T78] shrink_kill+0xa9/0x2c0 [ 89.364447][ T78] shrink_dentry_list+0x2e0/0x5e0 [ 89.364458][ T78] prune_dcache_sb+0x10e/0x180 [ 89.364468][ T78] ? __pfx_prune_dcache_sb+0x10/0x10 [ 89.364478][ T78] ? list_lru_count_one+0x27/0x2c0 [ 89.364493][ T78] ? list_lru_count_one+0x264/0x2c0 [ 89.364507][ T78] super_cache_scan+0x369/0x4b0 [ 89.364523][ T78] do_shrink_slab+0x6df/0x10d0 [ 89.364534][ T78] shrink_slab+0x7ef/0x10d0 [ 89.364542][ T78] ? shrink_slab+0x1e8/0x10d0 [ 89.364551][ T78] ? __pfx_shrink_slab+0x10/0x10 [ 89.364564][ T78] shrink_one+0x2d9/0x720 [ 89.364580][ T78] ? shrink_node+0x2d3f/0x35b0 [ 89.364592][ T78] shrink_node+0x2f7d/0x35b0 [ 89.364612][ T78] ? shrink_node+0x2d3f/0x35b0 [ 89.364625][ T78] ? __lock_acquire+0x6b6/0x2cf0 [ 89.364635][ T78] ? percpu_ref_put+0x19/0x180 [ 89.364646][ T78] ? __pfx_shrink_node+0x10/0x10 [ 89.364658][ T78] ? percpu_ref_put+0x19/0x180 [ 89.364668][ T78] ? mem_cgroup_iter+0x420/0x460 [ 89.364680][ T78] ? mem_cgroup_iter+0x3b/0x460 [ 89.364691][ T78] kswapd+0x145a/0x2820 [ 89.364706][ T78] ? kswapd+0x92a/0x2820 [ 89.364715][ T78] ? __pfx_kswapd+0x10/0x10 [ 89.364722][ T78] ? do_raw_spin_lock+0x121/0x290 [ 89.364729][ T78] ? raw_spin_rq_lock_nested+0x2a/0x140 [ 89.364736][ T78] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 89.364746][ T78] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 89.364754][ T78] ? _raw_spin_lock_bh+0x30/0x50 [ 89.364762][ T78] ? __pfx_autoremove_wake_function+0x10/0x10 [ 89.364771][ T78] ? __pfx_set_cpus_allowed_ptr+0x10/0x10 [ 89.364779][ T78] ? __kthread_parkme+0x7b/0x200 [ 89.364786][ T78] ? __kthread_parkme+0x1a1/0x200 [ 89.364793][ T78] kthread+0x711/0x8a0 [ 89.364801][ T78] ? __pfx_kswapd+0x10/0x10 [ 89.364807][ T78] ? __pfx_kthread+0x10/0x10 [ 89.364814][ T78] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.364822][ T78] ? lockdep_hardirqs_on+0x98/0x140