* [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
@ 2026-08-07 0:00 syzbot
2026-09-07 20:14 ` syzbot
2026-09-11 0:57 ` syzbot
0 siblings, 2 replies; 11+ messages in thread
From: syzbot @ 2026-08-07 0:00 UTC (permalink / raw)
To: dwmw2, linux-kernel, linux-mtd, richard, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13a07e32580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4e38b15c29e6a1d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9bf3ffd710de/disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/770c0a63a80c/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c54f9393cb03/bzImage-848acc8f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+743079a09058321247d8@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G N
------------------------------------------------------
syz.3.73/6195 is trying to acquire lock:
ffff88805432b1e0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4402 [inline]
ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xbd/0x310 mm/page_alloc.c:4427
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
__fs_reclaim_acquire mm/page_alloc.c:4329 [inline]
fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4343
might_alloc include/linux/sched/mm.h:317 [inline]
slab_pre_alloc_hook mm/slub.c:4537 [inline]
slab_alloc_node mm/slub.c:4897 [inline]
kmem_cache_alloc_noprof+0x64/0x5f0 mm/slub.c:4931
jffs2_do_read_inode+0x33f/0x6a0 fs/jffs2/readinode.c:1372
jffs2_iget+0x228/0xcc0 fs/jffs2/fs.c:277
jffs2_do_fill_super+0x59d/0xc50 fs/jffs2/fs.c:578
mtd_get_sb+0x18a/0x410 drivers/mtd/mtdsuper.c:57
mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
get_tree_mtd+0x4bd/0x7d0 drivers/mtd/mtdsuper.c:158
vfs_get_tree+0x92/0x2a0 fs/super.c:1700
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3765 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3841
do_mount fs/namespace.c:4174 [inline]
__do_sys_mount fs/namespace.c:4390 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4367
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419
evict+0x624/0xb50 fs/inode.c:825
dispose_list fs/inode.c:867 [inline]
prune_icache_sb+0x223/0x2d0 fs/inode.c:1014
super_cache_scan+0x38d/0x4a0 fs/super.c:225
do_shrink_slab+0x6d0/0x10e0 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0x838/0x1220 mm/shrinker.c:638
shrink_one+0x2a2/0x730 mm/vmscan.c:5026
shrink_many mm/vmscan.c:5087 [inline]
lru_gen_shrink_node mm/vmscan.c:5165 [inline]
shrink_node+0x3303/0x3b60 mm/vmscan.c:6154
shrink_zones mm/vmscan.c:6410 [inline]
do_try_to_free_pages+0x6a3/0x1990 mm/vmscan.c:6472
try_to_free_pages+0x90a/0xe50 mm/vmscan.c:6711
__perform_reclaim mm/page_alloc.c:4405 [inline]
__alloc_pages_direct_reclaim+0x148/0x310 mm/page_alloc.c:4427
__alloc_pages_slowpath+0x59d/0xcc0 mm/page_alloc.c:4876
__alloc_frozen_pages_noprof+0x31f/0x380 mm/page_alloc.c:5317
alloc_pages_mpol+0x212/0x380 mm/mempolicy.c:2490
alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline]
alloc_pages_noprof+0xac/0x2a0 mm/mempolicy.c:2581
alloc_image_page+0x23/0x130 kernel/power/snapshot.c:231
preallocate_image_pages kernel/power/snapshot.c:1654 [inline]
preallocate_image_memory+0x76/0x140 kernel/power/snapshot.c:1681
hibernate_preallocate_memory+0x43c/0x750 kernel/power/snapshot.c:1960
hibernation_snapshot+0x126/0x3d0 kernel/power/hibernate.c:430
hibernate+0x28f/0x680 kernel/power/hibernate.c:811
state_store+0x234/0x290 kernel/power/main.c:821
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
9 locks held by syz.3.73/6195:
#0: ffff88807a0a70b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 fs/file.c:1259
#1: ffff888034304450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
#1: ffff888034304450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683
#2: ffff88805386dc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336
#3: ffff88801f28d968 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#3: ffff88801f28d968 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337
#4: ffffffff8ea02160 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x49/0x70 kernel/power/main.c:71
#5: ffffffff8f5e45e0 (device_hotplug_lock){+.+.}-{4:4}, at: hibernate+0x25b/0x680 kernel/power/hibernate.c:805
#6: ffffffff8f3d5240 (acpi_scan_lock){+.+.}-{4:4}, at: acpi_pm_start drivers/acpi/sleep.c:533 [inline]
#6: ffffffff8f3d5240 (acpi_scan_lock){+.+.}-{4:4}, at: acpi_hibernation_begin+0xc8/0x110 drivers/acpi/sleep.c:945
#7: ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4402 [inline]
#7: ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xbd/0x310 mm/page_alloc.c:4427
#8: ffff8880358a40d8 (&type->s_umount_key#83){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:566 [inline]
#8: ffff8880358a40d8 (&type->s_umount_key#83){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4a0 fs/super.c:198
stack backtrace:
CPU: 0 UID: 0 PID: 6195 Comm: syz.3.73 Tainted: G N syzkaller #0 PREEMPT(full)
Tainted: [N]=TEST
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x62/0x390 fs/jffs2/readinode.c:1419
evict+0x624/0xb50 fs/inode.c:825
dispose_list fs/inode.c:867 [inline]
prune_icache_sb+0x223/0x2d0 fs/inode.c:1014
super_cache_scan+0x38d/0x4a0 fs/super.c:225
do_shrink_slab+0x6d0/0x10e0 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0x838/0x1220 mm/shrinker.c:638
shrink_one+0x2a2/0x730 mm/vmscan.c:5026
shrink_many mm/vmscan.c:5087 [inline]
lru_gen_shrink_node mm/vmscan.c:5165 [inline]
shrink_node+0x3303/0x3b60 mm/vmscan.c:6154
shrink_zones mm/vmscan.c:6410 [inline]
do_try_to_free_pages+0x6a3/0x1990 mm/vmscan.c:6472
try_to_free_pages+0x90a/0xe50 mm/vmscan.c:6711
__perform_reclaim mm/page_alloc.c:4405 [inline]
__alloc_pages_direct_reclaim+0x148/0x310 mm/page_alloc.c:4427
__alloc_pages_slowpath+0x59d/0xcc0 mm/page_alloc.c:4876
__alloc_frozen_pages_noprof+0x31f/0x380 mm/page_alloc.c:5317
alloc_pages_mpol+0x212/0x380 mm/mempolicy.c:2490
alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline]
alloc_pages_noprof+0xac/0x2a0 mm/mempolicy.c:2581
alloc_image_page+0x23/0x130 kernel/power/snapshot.c:231
preallocate_image_pages kernel/power/snapshot.c:1654 [inline]
preallocate_image_memory+0x76/0x140 kernel/power/snapshot.c:1681
hibernate_preallocate_memory+0x43c/0x750 kernel/power/snapshot.c:1960
hibernation_snapshot+0x126/0x3d0 kernel/power/hibernate.c:430
hibernate+0x28f/0x680 kernel/power/hibernate.c:811
state_store+0x234/0x290 kernel/power/main.c:821
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb3bdd9e019
Code: Unable to access opcode bytes at 0x7fb3bdd9dfef.
RSP: 002b:00007fb3beb8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fb3be025fa0 RCX: 00007fb3bdd9e019
RDX: 0000000000000004 RSI: 0000200000000100 RDI: 0000000000000003
RBP: 00007fb3bde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb3be026038 R14: 00007fb3be025fa0 R15: 00007ffecece6378
</TASK>
PM: hibernation: Allocated 724545 pages for snapshot
PM: hibernation: Allocated 2898180 kbytes in 41.10 seconds (70.51 MB/s)
printk: Suspending console(s) (use no_console_suspend to debug)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-08-07 0:00 [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2) syzbot
@ 2026-09-07 20:14 ` syzbot
2026-09-11 0:57 ` syzbot
1 sibling, 0 replies; 11+ messages in thread
From: syzbot @ 2026-09-07 20:14 UTC (permalink / raw)
To: dwmw2, linux-kernel, linux-mtd, richard, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: df2908090cda Linux 7.3-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17c4f8d1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14824601580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-df290809.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a500bcdb2c4d/vmlinux-df290809.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2b5c3e1aefa2/bzImage-df290809.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+743079a09058321247d8@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/113 is trying to acquire lock:
ffff8880139810e0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8efc9860 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
might_alloc include/linux/sched/mm.h:316 [inline]
slab_pre_alloc_hook mm/slub.c:4636 [inline]
slab_alloc_node mm/slub.c:4974 [inline]
kmem_cache_alloc_noprof+0x63/0x6a0 mm/slub.c:5010
jffs2_do_read_inode+0x307/0x520 fs/jffs2/readinode.c:1372
jffs2_iget+0x32b/0xe30 fs/jffs2/fs.c:277
jffs2_do_fill_super+0x44b/0xa50 fs/jffs2/fs.c:578
jffs2_fill_super+0x283/0x370 fs/jffs2/super.c:290
mtd_get_sb+0x2f0/0x4c0 drivers/mtd/mtdsuper.c:57
mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
get_tree_mtd+0x6f9/0x8a0 drivers/mtd/mtdsuper.c:141
vfs_get_tree+0x92/0x320 fs/super.c:1947
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount fs/namespace.c:3848 [inline]
path_mount+0x7d0/0x24c0 fs/namespace.c:4168
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount fs/namespace.c:4374 [inline]
__ia32_sys_mount+0x292/0x310 fs/namespace.c:4374
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
locks held by kswapd0/113: 2, last CPU#3:
#0: ffffffff8efc9860 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
#1: ffff88806bdce0e8 (&type->s_umount_key#59){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
#1: ffff88806bdce0e8 (&type->s_umount_key#59){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 fs/super.c:213
stack backtrace:
CPU: 3 UID: 0 PID: 113 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-08-07 0:00 [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2) syzbot
2026-09-07 20:14 ` syzbot
@ 2026-09-11 0:57 ` syzbot
2026-09-11 3:03 ` Edward Adam Davis
` (3 more replies)
1 sibling, 4 replies; 11+ messages in thread
From: syzbot @ 2026-09-11 0:57 UTC (permalink / raw)
To: dwmw2, linux-kernel, linux-mtd, richard, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=152c679e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10ec21f9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16715ef9580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-50d05c7c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/303a0ade8f9e/vmlinux-50d05c7c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/70b8ca71442b/bzImage-50d05c7c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+743079a09058321247d8@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/113 is trying to acquire lock:
ffff888013732c60 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
might_alloc include/linux/sched/mm.h:316 [inline]
slab_pre_alloc_hook mm/slub.c:4636 [inline]
slab_alloc_node mm/slub.c:4974 [inline]
kmem_cache_alloc_noprof+0x63/0x6a0 mm/slub.c:5010
jffs2_do_read_inode+0x307/0x520 fs/jffs2/readinode.c:1372
jffs2_iget+0x32b/0xe30 fs/jffs2/fs.c:277
jffs2_do_fill_super+0x44b/0xa50 fs/jffs2/fs.c:578
jffs2_fill_super+0x283/0x370 fs/jffs2/super.c:290
mtd_get_sb+0x2f0/0x4c0 drivers/mtd/mtdsuper.c:57
mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
get_tree_mtd+0x6f9/0x8a0 drivers/mtd/mtdsuper.c:141
vfs_get_tree+0x92/0x320 fs/super.c:1947
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount fs/namespace.c:3848 [inline]
path_mount+0x7d0/0x24c0 fs/namespace.c:4168
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount fs/namespace.c:4374 [inline]
__ia32_sys_mount+0x292/0x310 fs/namespace.c:4374
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
locks held by kswapd0/113: 2, last CPU#0:
#0: ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
#1: ffff88802553c0e8 (&type->s_umount_key#58){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
#1: ffff88802553c0e8 (&type->s_umount_key#58){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 fs/super.c:213
stack backtrace:
CPU: 0 UID: 0 PID: 113 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 0:57 ` syzbot
@ 2026-09-11 3:03 ` Edward Adam Davis
2026-09-11 3:26 ` syzbot
2026-09-11 7:55 ` Edward Adam Davis
` (2 subsequent siblings)
3 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-09-11 3:03 UTC (permalink / raw)
To: syzbot+743079a09058321247d8; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 50d05c7c76c9
diff --git a/fs/jffs2/malloc.c b/fs/jffs2/malloc.c
index 411de8b361b2..f8c642d6c205 100644
--- a/fs/jffs2/malloc.c
+++ b/fs/jffs2/malloc.c
@@ -246,7 +246,7 @@ void jffs2_free_node_frag(struct jffs2_node_frag *x)
struct jffs2_inode_cache *jffs2_alloc_inode_cache(void)
{
struct jffs2_inode_cache *ret;
- ret = kmem_cache_alloc(inode_cache_slab, GFP_KERNEL);
+ ret = kmem_cache_alloc(inode_cache_slab, GFP_NOFS);
dbg_memalloc("%p\n", ret);
return ret;
}
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 3:03 ` Edward Adam Davis
@ 2026-09-11 3:26 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-09-11 3:26 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in jffs2_do_clear_inode
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/113 is trying to acquire lock:
ffff888013a1ac60 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
might_alloc include/linux/sched/mm.h:316 [inline]
slab_pre_alloc_hook mm/slub.c:4636 [inline]
slab_alloc_node mm/slub.c:4974 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0xce/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
jffs2_get_inode_nodes fs/jffs2/readinode.c:997 [inline]
jffs2_do_read_inode_internal+0x13d/0x4ac0 fs/jffs2/readinode.c:1160
jffs2_do_read_inode+0x1b3/0x520 fs/jffs2/readinode.c:1389
jffs2_iget+0x32b/0xe30 fs/jffs2/fs.c:277
jffs2_do_fill_super+0x44b/0xa50 fs/jffs2/fs.c:578
jffs2_fill_super+0x283/0x370 fs/jffs2/super.c:290
mtd_get_sb+0x2f0/0x4c0 drivers/mtd/mtdsuper.c:57
mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
get_tree_mtd+0x6f9/0x8a0 drivers/mtd/mtdsuper.c:141
vfs_get_tree+0x92/0x320 fs/super.c:1947
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount fs/namespace.c:3848 [inline]
path_mount+0x7d0/0x24c0 fs/namespace.c:4168
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount fs/namespace.c:4374 [inline]
__ia32_sys_mount+0x292/0x310 fs/namespace.c:4374
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
locks held by kswapd0/113: 2, last CPU#2:
#0: ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
#1: ffff88804b2a40e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
#1: ffff88804b2a40e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 fs/super.c:213
stack backtrace:
CPU: 2 UID: 0 PID: 113 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: 50d05c7c Merge tag 'landlock-7.3-rc3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=150621f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=11ac8905580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 0:57 ` syzbot
2026-09-11 3:03 ` Edward Adam Davis
@ 2026-09-11 7:55 ` Edward Adam Davis
2026-09-11 8:19 ` syzbot
2026-09-11 8:28 ` Edward Adam Davis
2026-09-11 11:41 ` Edward Adam Davis
3 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-09-11 7:55 UTC (permalink / raw)
To: syzbot+743079a09058321247d8; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 50d05c7c76c9
diff --git a/fs/jffs2/malloc.c b/fs/jffs2/malloc.c
index 411de8b361b2..1ce17e265159 100644
--- a/fs/jffs2/malloc.c
+++ b/fs/jffs2/malloc.c
@@ -246,7 +246,11 @@ void jffs2_free_node_frag(struct jffs2_node_frag *x)
struct jffs2_inode_cache *jffs2_alloc_inode_cache(void)
{
struct jffs2_inode_cache *ret;
+ unsigned int nofs_flag;
+
+ nofs_flag = memalloc_nofs_save();
ret = kmem_cache_alloc(inode_cache_slab, GFP_KERNEL);
+ memalloc_nofs_restore(nofs_flag);
dbg_memalloc("%p\n", ret);
return ret;
}
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 7:55 ` Edward Adam Davis
@ 2026-09-11 8:19 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-09-11 8:19 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in jffs2_do_clear_inode
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/111 is trying to acquire lock:
ffff888013343ce0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
might_alloc include/linux/sched/mm.h:316 [inline]
slab_pre_alloc_hook mm/slub.c:4636 [inline]
slab_alloc_node mm/slub.c:4974 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0xce/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
jffs2_get_inode_nodes fs/jffs2/readinode.c:997 [inline]
jffs2_do_read_inode_internal+0x13d/0x4ac0 fs/jffs2/readinode.c:1160
jffs2_do_read_inode+0x1b3/0x520 fs/jffs2/readinode.c:1389
jffs2_iget+0x32b/0xe30 fs/jffs2/fs.c:277
jffs2_do_fill_super+0x44b/0xa50 fs/jffs2/fs.c:578
jffs2_fill_super+0x283/0x370 fs/jffs2/super.c:290
mtd_get_sb+0x2f0/0x4c0 drivers/mtd/mtdsuper.c:57
mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:88 [inline]
get_tree_mtd+0x6f9/0x8a0 drivers/mtd/mtdsuper.c:141
vfs_get_tree+0x92/0x320 fs/super.c:1947
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount fs/namespace.c:3848 [inline]
path_mount+0x7d0/0x24c0 fs/namespace.c:4168
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount fs/namespace.c:4374 [inline]
__ia32_sys_mount+0x292/0x310 fs/namespace.c:4374
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
locks held by kswapd0/111: 2, last CPU#1:
#0: ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
#1: ffff88804ba6e0e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
#1: ffff88804ba6e0e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 fs/super.c:213
stack backtrace:
CPU: 1 UID: 0 PID: 111 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: 50d05c7c Merge tag 'landlock-7.3-rc3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10391871580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=154d7749580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 0:57 ` syzbot
2026-09-11 3:03 ` Edward Adam Davis
2026-09-11 7:55 ` Edward Adam Davis
@ 2026-09-11 8:28 ` Edward Adam Davis
2026-09-11 8:45 ` syzbot
2026-09-11 11:41 ` Edward Adam Davis
3 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-09-11 8:28 UTC (permalink / raw)
To: syzbot+743079a09058321247d8; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 50d05c7c76c9
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 6ada8369a762..59972e03685d 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -256,6 +256,7 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
struct jffs2_sb_info *c;
struct jffs2_raw_inode latest_node;
union jffs2_device_node jdev;
+ unsigned int nofs_flag;
struct inode *inode;
dev_t rdev = 0;
int ret;
@@ -274,7 +275,9 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
jffs2_init_inode_info(f);
mutex_lock(&f->sem);
+ nofs_flag = memalloc_nofs_save();
ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node);
+ memalloc_nofs_restore(nofs_flag);
if (ret)
goto error;
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 8:28 ` Edward Adam Davis
@ 2026-09-11 8:45 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-09-11 8:45 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in jffs2_do_clear_inode
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/113 is trying to acquire lock:
ffff8880142105e0 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
but task is already holding lock:
ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
might_alloc include/linux/sched/mm.h:316 [inline]
slab_pre_alloc_hook mm/slub.c:4636 [inline]
slab_alloc_node mm/slub.c:4974 [inline]
kmem_cache_alloc_noprof+0x63/0x6a0 mm/slub.c:5010
jffs2_do_new_inode+0x24/0x520 fs/jffs2/write.c:28
jffs2_new_inode+0x581/0xcf0 fs/jffs2/fs.c:469
jffs2_create+0x94/0x390 fs/jffs2/dir.c:182
vfs_create+0x2fb/0x6c0 fs/namei.c:4197
filename_mknodat+0x2de/0x7f0 fs/namei.c:5319
__do_sys_mknodat fs/namei.c:5350 [inline]
__se_sys_mknodat fs/namei.c:5346 [inline]
__ia32_sys_mknodat+0xb4/0xf0 fs/namei.c:5346
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (&f->sem){+.+.}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&f->sem);
lock(fs_reclaim);
lock(&f->sem);
*** DEADLOCK ***
locks held by kswapd0/113: 2, last CPU#1:
#0: ffffffff8efc9a20 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 mm/vmscan.c:7292
#1: ffff88805c6760e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_trylock_shared fs/super.c:688 [inline]
#1: ffff88805c6760e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 fs/super.c:213
stack backtrace:
CPU: 1 UID: 0 PID: 113 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
jffs2_do_clear_inode+0x5a/0x470 fs/jffs2/readinode.c:1419
evict+0x3c2/0xad0 fs/inode.c:822
dispose_list+0x117/0x1e0 fs/inode.c:864
prune_icache_sb+0xea/0x150 fs/inode.c:1011
super_cache_scan+0x3ac/0x5c0 fs/super.c:240
do_shrink_slab+0x416/0x1200 mm/shrinker.c:443
shrink_slab_memcg mm/shrinker.c:560 [inline]
shrink_slab+0xa82/0x12e0 mm/shrinker.c:638
shrink_one+0x398/0x850 mm/vmscan.c:5119
shrink_many mm/vmscan.c:5180 [inline]
lru_gen_shrink_node mm/vmscan.c:5258 [inline]
shrink_node+0x2b20/0x4320 mm/vmscan.c:6247
kswapd_shrink_node mm/vmscan.c:7101 [inline]
balance_pgdat+0xb20/0x1f00 mm/vmscan.c:7279
kswapd+0x556/0xb50 mm/vmscan.c:7555
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: 50d05c7c Merge tag 'landlock-7.3-rc3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16842601580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=13a68905580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 0:57 ` syzbot
` (2 preceding siblings ...)
2026-09-11 8:28 ` Edward Adam Davis
@ 2026-09-11 11:41 ` Edward Adam Davis
2026-09-11 12:18 ` syzbot
3 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-09-11 11:41 UTC (permalink / raw)
To: syzbot+743079a09058321247d8; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 50d05c7c76c9
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 1caabff9dc91..6d0c766fe801 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -1416,6 +1416,9 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
int deleted;
jffs2_xattr_delete_inode(c, f->inocache);
+ if (!f->inocache && !f->metadata)
+ return;
+
mutex_lock(&f->sem);
deleted = f->inocache && !f->inocache->pino_nlink;
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2)
2026-09-11 11:41 ` Edward Adam Davis
@ 2026-09-11 12:18 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-09-11 12:18 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+743079a09058321247d8@syzkaller.appspotmail.com
Tested-by: syzbot+743079a09058321247d8@syzkaller.appspotmail.com
Tested on:
commit: 50d05c7c Merge tag 'landlock-7.3-rc3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=114f16f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=743079a09058321247d8
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=1336ac8e580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-09-11 12:18 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-07 0:00 [syzbot] [jffs2?] possible deadlock in jffs2_do_clear_inode (2) syzbot
2026-09-07 20:14 ` syzbot
2026-09-11 0:57 ` syzbot
2026-09-11 3:03 ` Edward Adam Davis
2026-09-11 3:26 ` syzbot
2026-09-11 7:55 ` Edward Adam Davis
2026-09-11 8:19 ` syzbot
2026-09-11 8:28 ` Edward Adam Davis
2026-09-11 8:45 ` syzbot
2026-09-11 11:41 ` Edward Adam Davis
2026-09-11 12:18 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®