======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/96 is trying to acquire lock:
ffff88803da53158 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419

but task is already holding lock:
ffffffff8e4eefc0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7074 [inline]
ffffffff8e4eefc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9a4/0x31c0 mm/vmscan.c:7452

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (fs_reclaim){+.+.}-{0:0}:
       __fs_reclaim_acquire mm/page_alloc.c:4338 [inline]
       fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4352
       might_alloc include/linux/sched/mm.h:317 [inline]
       slab_pre_alloc_hook mm/slub.c:4561 [inline]
       slab_alloc_node mm/slub.c:4899 [inline]
       kmem_cache_alloc_noprof+0x5c/0x680 mm/slub.c:4935
       jffs2_do_read_inode+0x33f/0x6a0 fs/jffs2/readinode.c:1372
       jffs2_iget+0x228/0xcc0 fs/jffs2/fs.c:277
       jffs2_do_fill_super+0x59d/0xc50 fs/jffs2/fs.c:578
       mtd_get_sb+0x18a/0x410 drivers/mtd/mtdsuper.c:57
       mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
       get_tree_mtd+0x4bd/0x7d0 drivers/mtd/mtdsuper.c:158
       vfs_get_tree+0x92/0x2a0 fs/super.c:1941
       fc_mount fs/namespace.c:1198 [inline]
       do_new_mount_fc fs/namespace.c:3777 [inline]
       do_new_mount+0x319/0xdc0 fs/namespace.c:3853
       do_mount fs/namespace.c:4186 [inline]
       __do_sys_mount fs/namespace.c:4402 [inline]
       __se_sys_mount+0x31d/0x420 fs/namespace.c:4379
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&f->sem){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3181 [inline]
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
       __mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
       jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419
       evict+0x624/0xb50 fs/inode.c:822
       dispose_list fs/inode.c:864 [inline]
       prune_icache_sb+0x223/0x2d0 fs/inode.c:1011
       super_cache_scan+0x3f5/0x500 fs/super.c:240
       do_shrink_slab+0x6d0/0x10e0 mm/shrinker.c:443
       shrink_slab_memcg mm/shrinker.c:560 [inline]
       shrink_slab+0x838/0x1220 mm/shrinker.c:638
       shrink_one+0x2a2/0x730 mm/vmscan.c:5016
       shrink_many mm/vmscan.c:5077 [inline]
       lru_gen_shrink_node mm/vmscan.c:5155 [inline]
       shrink_node+0x3303/0x3b60 mm/vmscan.c:6144
       kswapd_shrink_node mm/vmscan.c:6998 [inline]
       balance_pgdat mm/vmscan.c:7176 [inline]
       kswapd+0x17aa/0x31c0 mm/vmscan.c:7452
       kthread+0x388/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(fs_reclaim);
                               lock(&f->sem);
                               lock(fs_reclaim);
  lock(&f->sem);

 *** DEADLOCK ***

locks held by kswapd0/96: 2, last CPU#0:
 #0: ffffffff8e4eefc0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7074 [inline]
 #0: ffffffff8e4eefc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9a4/0x31c0 mm/vmscan.c:7452
 #1: ffff8880354fa0e0 (&type->s_umount_key#58){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
 #1: ffff8880354fa0e0 (&type->s_umount_key#58){++++}-{4:4}, at: super_cache_scan+0x94/0x500 fs/super.c:213

stack backtrace:
CPU: 0 UID: 0 PID: 96 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2059
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2191
 check_prev_add kernel/locking/lockdep.c:3181 [inline]
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
 __mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
 mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
 jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419
 evict+0x624/0xb50 fs/inode.c:822
 dispose_list fs/inode.c:864 [inline]
 prune_icache_sb+0x223/0x2d0 fs/inode.c:1011
 super_cache_scan+0x3f5/0x500 fs/super.c:240
 do_shrink_slab+0x6d0/0x10e0 mm/shrinker.c:443
 shrink_slab_memcg mm/shrinker.c:560 [inline]
 shrink_slab+0x838/0x1220 mm/shrinker.c:638
 shrink_one+0x2a2/0x730 mm/vmscan.c:5016
 shrink_many mm/vmscan.c:5077 [inline]
 lru_gen_shrink_node mm/vmscan.c:5155 [inline]
 shrink_node+0x3303/0x3b60 mm/vmscan.c:6144
 kswapd_shrink_node mm/vmscan.c:6998 [inline]
 balance_pgdat mm/vmscan.c:7176 [inline]
 kswapd+0x17aa/0x31c0 mm/vmscan.c:7452
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>