program: syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f00000000c0)={[{@orlov}, {@errors_remount}]}, 0x3, 0x5eb, &(0x7f0000000c00)="$eJzs3ctvFEcaAPCvxw9sjNYDWu0ue1gsrVYg7WJjAysU5QDXCFnkoVxyiYMNIRiwsKPEJBJGIpdIUS5RFCmnHEL+iwSFK6fklEMuOUVIKIk4RspEPdNtPHaPX9jTiP79pGG6q6Zd1djfVHVNVU8AlTWS/lOLOBgRc0nEcLK0nNcbWeZI63WPfnv/fPpIotF4+Zckkiwtf32SPQ9lBw9ExHffJnGgZ22584s3Lk/Nzs5cz/bHFq7Mjc0v3jh66crUxZmLM1cn/j9x6uSJk6fGj23rvG4WpJ29/dY7wx9Ovvbl578n41/9OJnE6Xghe+HK89gpIzHS/D9J1mYNndrpwkrSk/2dNBqNRp6W9JZbJzYv//31RcTfYzh64vEvbzg+eLHUygG7qpG03ruBKkrEP1RU3g/Ir+1XXwfXSumVAN3w8ExrAGBt/Pe2xgZjoDk2sPdREiuHdZKI2N7IXLt9EXH/3uTtC/cmb8cujcMBxZZuRcQ/iuI/acZ/PQai3oz/Wlv8p/2Cc9lzmv7SNstfPVQs/qF7WvE/sG78R4f4fz19vtmK4Te2WX798eabg23xP7jdUwIAAAAAAIDKunsmIv5X9Pl/bXn+TxTM/xmKiNM7UP7Iqv21n//XHuxAMUCBh2cini+c/1vLZ//We1YsYa1HX3Lh0uzMsYj4S0Qcib496f74OmUc/ejAZ53yRrL5f/kjLf9+Nhcwq8eD3j3tx0xPLUw9wSkDmYe3Iv5ZOP83WW7/k4L2P31nmNtkGQf+c+dcp7yN4x/YLY0vIg4Xtv+P71qRrH9/jrFmf2As7xWs9a/3Pv66U/nbjX+3mIAnl7b/e9eP/3qy8n4981sv4/hib6NT3nb7//3JK827CvVnae9OLSxcH4/oT872pKlt6RNbrzM8i/J4yOMljf8j/15//K+o/z8YEUurfnbya/ua4tzf/hj6qVN99P+hPGn8T2+p/d/6xsSd+jedyt9c+3+i2dYfyVKM/0HLp3mY9renF4Rjb1FWt+sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+CWkTsi6Q2urxdq42ORgxFxF9jb2322vzCfy9ce/vqdJrX/P7/Wv5Nv8Ot/ST//v/6iv2JVfvHI2J/RHzSM9jcHz1/bXa67JMHAAAAAAAAAAAAAAAAAACAp8RQh/X/qZ97yq4dsOt6y64AUJqC+P++jHoA3af9h+oS/1Bd4h+qS/xDdYl/qC7xD9Ul/qG6xD8AAAAAADxT9h+6+0MSEUvPDTYfqf4sr6/UmgG7rVZ2BYDSuMUPVJepP1BdrvGBZIP8gY4HbXTkeubOP8HBAAAAAAAAAAAAAFA5hw9a/w9VZf0/VJf1/1Bd+fr/QyXXA+g+1/hAbLCSv3D9/4ZHAQAAAAAAAAAAAAA7aX7xxuWp2dmZ6zZefTqq0c2NRqNxM/0reFrqs/MbSTZDvSuF5lPhu3+m/Zs5wXyt3+Z+cnnvSQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQLs/AwAA//+JjCTl") mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1', 0x1) socket(0x10, 0x3, 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r1, &(0x7f0000000f80)=""/4096, 0x1000) [ 95.193992][ T4638] Bluetooth: hci0: command tx timeout [ 95.375941][ T5313] loop0: detected capacity change from 0 to 1024 [ 95.445498][ T5313] EXT4-fs: Ignoring removed orlov option [ 95.513566][ T5313] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 95.542428][ T5313] jffs2: notice: (5313) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 95.641667][ T75] [ 95.642790][ T75] ====================================================== [ 95.645715][ T75] WARNING: possible circular locking dependency detected [ 95.648630][ T75] syzkaller #0 Not tainted [ 95.650497][ T75] ------------------------------------------------------ [ 95.653472][ T75] kswapd0/75 is trying to acquire lock: [ 95.655785][ T75] ffff88801f94b1e0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 [ 95.659569][ T75] [ 95.659569][ T75] but task is already holding lock: [ 95.662632][ T75] ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 95.665905][ T75] [ 95.665905][ T75] which lock already depends on the new lock. [ 95.665905][ T75] [ 95.670178][ T75] [ 95.670178][ T75] the existing dependency chain (in reverse order) is: [ 95.673856][ T75] [ 95.673856][ T75] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 95.676807][ T75] fs_reclaim_acquire+0x71/0x100 [ 95.679131][ T75] kmem_cache_alloc_noprof+0x64/0x5f0 [ 95.681437][ T75] jffs2_do_read_inode+0x33f/0x6a0 [ 95.683745][ T75] jffs2_iget+0x228/0xcc0 [ 95.685849][ T75] jffs2_do_fill_super+0x59d/0xc50 [ 95.688185][ T75] mtd_get_sb+0x18a/0x410 [ 95.690223][ T75] get_tree_mtd+0x597/0x7d0 [ 95.692268][ T75] vfs_get_tree+0x92/0x2a0 [ 95.694112][ T75] do_new_mount+0x319/0xdc0 [ 95.696185][ T75] __se_sys_mount+0x31d/0x420 [ 95.698323][ T75] do_syscall_64+0x174/0x580 [ 95.700423][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.703095][ T75] [ 95.703095][ T75] -> #0 (&f->sem){+.+.}-{4:4}: [ 95.705851][ T75] __lock_acquire+0x1520/0x2cf0 [ 95.708073][ T75] lock_acquire+0x106/0x350 [ 95.710108][ T75] __mutex_lock+0x19d/0x1550 [ 95.712009][ T75] jffs2_do_clear_inode+0x62/0x390 [ 95.714038][ T75] evict+0x624/0xb50 [ 95.715763][ T75] prune_icache_sb+0x223/0x2d0 [ 95.717810][ T75] super_cache_scan+0x38d/0x4a0 [ 95.719927][ T75] do_shrink_slab+0x6d0/0x10e0 [ 95.722057][ T75] shrink_slab+0x838/0x1220 [ 95.724085][ T75] shrink_one+0x2a2/0x730 [ 95.726146][ T75] shrink_node+0x3303/0x3b60 [ 95.728467][ T75] kswapd+0x17b6/0x31c0 [ 95.730364][ T75] kthread+0x388/0x470 [ 95.732263][ T75] ret_from_fork+0x514/0xb70 [ 95.734362][ T75] ret_from_fork_asm+0x1a/0x30 [ 95.736519][ T75] [ 95.736519][ T75] other info that might help us debug this: [ 95.736519][ T75] [ 95.740576][ T75] Possible unsafe locking scenario: [ 95.740576][ T75] [ 95.743614][ T75] CPU0 CPU1 [ 95.745776][ T75] ---- ---- [ 95.748025][ T75] lock(fs_reclaim); [ 95.749735][ T75] lock(&f->sem); [ 95.752367][ T75] lock(fs_reclaim); [ 95.755125][ T75] lock(&f->sem); [ 95.756698][ T75] [ 95.756698][ T75] *** DEADLOCK *** [ 95.756698][ T75] [ 95.759923][ T75] 2 locks held by kswapd0/75: [ 95.761922][ T75] #0: ffffffff8ec86cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x31c0 [ 95.765494][ T75] #1: ffff888040af80d8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 [ 95.770230][ T75] [ 95.770230][ T75] stack backtrace: [ 95.772790][ T75] CPU: 0 UID: 0 PID: 75 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) [ 95.772804][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.772811][ T75] Call Trace: [ 95.772818][ T75] [ 95.772824][ T75] dump_stack_lvl+0xe8/0x150 [ 95.772848][ T75] print_circular_bug+0x2e1/0x300 [ 95.772867][ T75] check_noncircular+0x12e/0x150 [ 95.772884][ T75] __lock_acquire+0x1520/0x2cf0 [ 95.772899][ T75] ? ret_from_fork_asm+0x1a/0x30 [ 95.772917][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.772931][ T75] lock_acquire+0x106/0x350 [ 95.772944][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.772961][ T75] __mutex_lock+0x19d/0x1550 [ 95.772975][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.772991][ T75] ? jffs2_do_clear_inode+0x62/0x390 [ 95.773005][ T75] ? __pfx___mutex_lock+0x10/0x10 [ 95.773017][ T75] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.773029][ T75] ? jffs2_xattr_delete_inode+0x59/0x2d0 [ 95.773042][ T75] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.773056][ T75] jffs2_do_clear_inode+0x62/0x390 [ 95.773070][ T75] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 95.773085][ T75] evict+0x624/0xb50 [ 95.773102][ T75] ? __pfx_evict+0x10/0x10 [ 95.773116][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 95.773128][ T75] ? __pfx_inode_lru_isolate+0x10/0x10 [ 95.773138][ T75] ? list_lru_walk_one+0x3c/0x50 [ 95.773151][ T75] prune_icache_sb+0x223/0x2d0 [ 95.773163][ T75] ? __pfx_prune_icache_sb+0x10/0x10 [ 95.773174][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.773185][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.773196][ T75] ? list_lru_count_one+0x27/0x2c0 [ 95.773207][ T75] ? list_lru_count_one+0x264/0x2c0 [ 95.773220][ T75] super_cache_scan+0x38d/0x4a0 [ 95.773238][ T75] do_shrink_slab+0x6d0/0x10e0 [ 95.773254][ T75] shrink_slab+0x838/0x1220 [ 95.773267][ T75] ? shrink_slab+0x1e9/0x1220 [ 95.773280][ T75] ? __pfx_shrink_slab+0x10/0x10 [ 95.773293][ T75] ? __pfx_try_to_shrink_lruvec+0x10/0x10 [ 95.773305][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.773317][ T75] shrink_one+0x2a2/0x730 [ 95.773329][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.773339][ T75] shrink_node+0x3303/0x3b60 [ 95.773352][ T75] ? shrink_node+0x2ed4/0x3b60 [ 95.773366][ T75] ? percpu_ref_put+0x19/0x180 [ 95.773380][ T75] ? percpu_ref_put+0x19/0x180 [ 95.773393][ T75] ? __pfx_shrink_node+0x10/0x10 [ 95.773404][ T75] ? percpu_ref_put+0x19/0x180 [ 95.773415][ T75] ? percpu_ref_put+0x19/0x180 [ 95.773424][ T75] ? mem_cgroup_iter+0x410/0x440 [ 95.773433][ T75] ? mem_cgroup_iter+0x3b/0x440 [ 95.773442][ T75] kswapd+0x17b6/0x31c0 [ 95.773457][ T75] ? kswapd+0x9b6/0x31c0 [ 95.773471][ T75] ? __pfx_kswapd+0x10/0x10 [ 95.773484][ T75] ? trace_contention_end+0x3d/0x140 [ 95.773495][ T75] ? __lock_acquire+0x683/0x2cf0 [ 95.773509][ T75] ? kthread_affine_node+0x2b2/0x360 [ 95.773522][ T75] ? __mutex_unlock_slowpath+0x731/0x900 [ 95.773540][ T75] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.773551][ T75] ? __kthread_parkme+0x71/0x1f0 [ 95.773565][ T75] ? __kthread_parkme+0x196/0x1f0 [ 95.773578][ T75] kthread+0x388/0x470 [ 95.773592][ T75] ? __pfx_kswapd+0x10/0x10 [ 95.773604][ T75] ? __pfx_kthread+0x10/0x10 [ 95.773618][ T75] ret_from_fork+0x514/0xb70 [ 95.773634][ T75] ? __pfx_ret_from_fork+0x10/0x10 [ 95.773647][ T75] ? __switch_to+0xc89/0x1420 [ 95.773660][ T75] ? __pfx_kthread+0x10/0x10 [ 95.773672][ T75] ret_from_fork_asm+0x1a/0x30 [ 95.773691][ T75]