[v6.6] possible deadlock in xfs_icwalk_ag

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d27334b2888c Linux 6.6.151
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=161bffb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=7b73a3cb8c2499ca2318
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/695139abd971/disk-d27334b2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b11fc121442a/vmlinux-d27334b2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e226f54f9286/bzImage-d27334b2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7b73a3...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd0/87 is trying to acquire lock:
ffff888076e5ce98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
ffff888076e5ce98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
ffff888076e5ce98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714

but task is already holding lock:
ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7435 [inline]
ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x2ce0 mm/vmscan.c:7807

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (fs_reclaim){+.+.}-{0:0}:
__fs_reclaim_acquire mm/page_alloc.c:3600 [inline]
fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:3614
might_alloc include/linux/sched/mm.h:303 [inline]
slab_pre_alloc_hook+0x2a/0x300 mm/slab.h:714
slab_alloc_node mm/slub.c:3477 [inline]
slab_alloc mm/slub.c:3503 [inline]
__kmem_cache_alloc_lru mm/slub.c:3510 [inline]
kmem_cache_alloc+0x5a/0x2c0 mm/slub.c:3519
kmem_cache_zalloc include/linux/slab.h:711 [inline]
xfs_trans_get_rud fs/xfs/xfs_rmap_item.c:235 [inline]
xfs_rmap_update_create_done+0x34/0xf0 fs/xfs/xfs_rmap_item.c:390
xfs_defer_finish_one+0x236/0xcc0 fs/xfs/libxfs/xfs_defer.c:499
xfs_defer_finish_noroll+0xb11/0x1230 fs/xfs/libxfs/xfs_defer.c:588
__xfs_trans_commit+0x276/0xd90 fs/xfs/xfs_trans.c:965
xfs_alloc_file_space+0x5a9/0x990 fs/xfs/xfs_bmap_util.c:909
xfs_file_fallocate+0x8b3/0xc20 fs/xfs/xfs_file.c:1090
vfs_fallocate+0x585/0x6f0 fs/open.c:324
ksys_fallocate fs/open.c:347 [inline]
__do_sys_fallocate fs/open.c:355 [inline]
__se_sys_fallocate fs/open.c:353 [inline]
__x64_sys_fallocate+0xc1/0x110 fs/open.c:353
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #0 (&xfs_nondir_ilock_class#3){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
down_write_nested+0x9e/0x200 kernel/locking/rwsem.c:1689
xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714
xfs_icwalk fs/xfs/xfs_icache.c:1763 [inline]
xfs_reclaim_inodes_nr+0x188/0x230 fs/xfs/xfs_icache.c:1003
super_cache_scan+0x3e1/0x460 fs/super.c:234
do_shrink_slab+0x519/0xd20 mm/vmscan.c:907
shrink_slab+0x1c9/0x7c0 mm/vmscan.c:1067
shrink_one+0x284/0x7c0 mm/vmscan.c:5452
shrink_many mm/vmscan.c:5515 [inline]
lru_gen_shrink_node mm/vmscan.c:5607 [inline]
shrink_node+0x3179/0x3740 mm/vmscan.c:6547
kswapd_shrink_node mm/vmscan.c:7356 [inline]
balance_pgdat mm/vmscan.c:7547 [inline]
kswapd+0x1694/0x2ce0 mm/vmscan.c:7807
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&xfs_nondir_ilock_class#3);
lock(fs_reclaim);
lock(&xfs_nondir_ilock_class#3);

*** DEADLOCK ***

3 locks held by kswapd0/87:
#0: ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7435 [inline]
#0: ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x2ce0 mm/vmscan.c:7807
#1: ffffffff8d1e7bb0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x120/0x7c0 mm/vmscan.c:1057
#2: ffff8880500b60e0 (&type->s_umount_key#77){++++}-{3:3}, at: super_trylock_shared fs/super.c:607 [inline]
#2: ffff8880500b60e0 (&type->s_umount_key#77){++++}-{3:3}, at: super_cache_scan+0x74/0x460 fs/super.c:203

stack backtrace:
CPU: 0 PID: 87 Comm: kswapd0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
down_write_nested+0x9e/0x200 kernel/locking/rwsem.c:1689
xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714
xfs_icwalk fs/xfs/xfs_icache.c:1763 [inline]
xfs_reclaim_inodes_nr+0x188/0x230 fs/xfs/xfs_icache.c:1003
super_cache_scan+0x3e1/0x460 fs/super.c:234
do_shrink_slab+0x519/0xd20 mm/vmscan.c:907
shrink_slab+0x1c9/0x7c0 mm/vmscan.c:1067
shrink_one+0x284/0x7c0 mm/vmscan.c:5452
shrink_many mm/vmscan.c:5515 [inline]
lru_gen_shrink_node mm/vmscan.c:5607 [inline]
shrink_node+0x3179/0x3740 mm/vmscan.c:6547
kswapd_shrink_node mm/vmscan.c:7356 [inline]
balance_pgdat mm/vmscan.c:7547 [inline]
kswapd+0x1694/0x2ce0 mm/vmscan.c:7807
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup