program: syz_mount_image$hfs(&(0x7f0000000340), &(0x7f0000000380)='./file0\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32a, &(0x7f0000000640)="$eJzs3U1rE08cB/DvTJJm+2/+dfsggsdqQS+i9SJeIpK3IIgH0bYRiqGiVlAvJuJJRO/efQu+CC+Kb0BPHsSr0F4cmdnZTXZ39iFt2jX6/YC42d3J/CYzk/1NUAZE9M+62vny7uI3/UcANdSAl5cBCcAD6gCO44T3aHtna6fX3cx7o5opgT0FgaCkSN2zsd01fw/ip3U5U8Ly9as6WqPn6HAopa58TZz7LisKhipjZr+DBJp2dprr3pFHlm9Q5ibHeO4fQizTROxiF48xX3UcRERULf38HwRPSv2cb9n8XUpgFRh4f+rzv5z/U2d+VhLHUVK5V0ee/2aVpYTu32Pm0nC9Z5Zw+roMV4llam4kXs8gyMFiCaZwryqHSz4Ti5y9s9Xrntu419uUeI62NVJgOarB0iO0INoVx9o0R4m2C2dGGYQlG7oNaxnxL+2zxhypdDfWIeKD+CRuCh9vsRnlf3UldLQmYD/RU0H857PrmzOl9F2wXxvtdluaNwotmEpOxnsqu5VmFHjuFQnCD3YB8R8I/KI4TanFRKmgdRecBZpRqSVnqbXwVUZdy7FSujXRaM6OcjLUs6wr4rW4LlbwA+/RGcn/pY5vFemZOdIJw1kjVoOJZj7xoD0z7urq5j391JOjjxut+JnoU2xmhb6nBH8SOqCwD19hHZcw//DJ07u1Xq/7QB/cdhzcb0VnGi8A5z0VH6A/PNOEMlI3h9+BseKz9uQYldbGCOzsRFuqJ2LhzXqWJS+FrZzoJz86EsIJO7E+hax+aOWNjc7HxEAqPFC1cnNHNZ0j3C/u94xLv9Q+2p7Ol+nvNOz0qiOhiui8SwTrP5PJ23zf5Gs6W7jWzF6NhItMV8pmEkf7jkrn2NEKyIuVXzRH/8XT6IIV0JzNYxzruD5Say797E+tuU6dAU6Xr9G3cU6H7PTfEh18xi3+/k9ERERERERERERERERERERERERENG3G/98Rs2OWavBflhMRERERERERERERERERERERERERERERHVC0/y/C/X9Rbv/f5PZSdv9fDwX7/66nY0jt//tmG6IPcP9fosP1OwAA//+1UnIe") mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000d80)={'vxcan0\x00', 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='./cgrp2/cgroup.subtree_control\x00', 0x1, 0x0) write(r1, &(0x7f0000000e80)='+rdma', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) write(r2, &(0x7f0000000f00)='0', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000f40)='./file2\x00', 0x103042, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000f80)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x400, @empty, 0xe}, {0xa, 0x4e20, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x5}, 0xffffffffffffffff, 0x1}}, 0x48) ioctl$FITRIM(r3, 0x40305839, &(0x7f0000001000)={0x0, 0x0, 0x8000000}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001100)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x12, 0x1e, &(0x7f0000000b40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6148, 0x0, 0x0, 0x0, 0x4}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0x9}, @exit, @ringbuf_output, @cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffff8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1d2f}}]}, &(0x7f0000000c40)='syzkaller\x00', 0x6, 0xd4, &(0x7f0000000c80)=""/212, 0x41000, 0x37, '\x00', r0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000dc0)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000e00)={0x4, 0xe, 0x0, 0x80}, 0x10, 0xffffffffffffffff, r1, 0x3, &(0x7f0000001180)=[r2, r3, r4, r5, 0xffffffffffffffff], &(0x7f00000011c0)=[{0x3, 0x4, 0xd, 0xd}, {0x4, 0x1, 0xe}, {0x1, 0x3, 0x6, 0x9}], 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000980)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000009c0)=0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000006140)='./bus\x00', 0x141842, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000006180)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000061c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000006200), 0xfea7) copy_file_range(r7, 0x0, r6, 0x0, 0xffffffffa003e459, 0x700000000000000) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/mapper/control\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl(r10, 0xc138fd03, &(0x7f0000000180)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79746869") write(0xffffffffffffffff, &(0x7f00000001c0)="0000000000000000008000000000000000000000000000007468696e00", 0x1d) ioctl(r10, 0xc138fd09, &(0x7f0000000200)="0400000000000000000000006e010000380100000100"/42) write$cgroup_subtree(r8, &(0x7f0000000000)={[{0x2d, 'cpuacct'}, {0x2b, 'net'}, {0x2d, 'perf_event'}, {0x2b, 'hugetlb'}, {0x2d, 'io'}, {0x2b, 'pids'}, {0x2d, 'devices'}]}, 0x36) write$FUSE_WRITE(r9, &(0x7f0000000a40)={0x18}, 0xfffffdef) [ 94.002263][ T5281] Bluetooth: hci0: command tx timeout [ 94.077119][ T5319] loop0: detected capacity change from 0 to 64 [ 94.266926][ T5319] syz.0.0: attempt to access beyond end of device [ 94.266926][ T5319] loop0: rw=8390657, sector=169, nr_sectors = 1 limit=64 [ 94.267004][ T5319] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 94.267030][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267030][ T5319] loop0: rw=8390657, sector=171, nr_sectors = 1 limit=64 [ 94.267043][ T5319] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 94.267055][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267055][ T5319] loop0: rw=8390657, sector=172, nr_sectors = 1 limit=64 [ 94.267066][ T5319] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 94.267077][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267077][ T5319] loop0: rw=8390657, sector=173, nr_sectors = 1 limit=64 [ 94.267087][ T5319] Buffer I/O error on dev loop0, logical block 173, lost async page write [ 94.267098][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267098][ T5319] loop0: rw=8390657, sector=174, nr_sectors = 1 limit=64 [ 94.267109][ T5319] Buffer I/O error on dev loop0, logical block 174, lost async page write [ 94.267120][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267120][ T5319] loop0: rw=8390657, sector=175, nr_sectors = 1 limit=64 [ 94.267130][ T5319] Buffer I/O error on dev loop0, logical block 175, lost async page write [ 94.267141][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267141][ T5319] loop0: rw=8390657, sector=176, nr_sectors = 1 limit=64 [ 94.267152][ T5319] Buffer I/O error on dev loop0, logical block 176, lost async page write [ 94.267163][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267163][ T5319] loop0: rw=8390657, sector=177, nr_sectors = 1 limit=64 [ 94.267174][ T5319] Buffer I/O error on dev loop0, logical block 177, lost async page write [ 94.267449][ T5319] syz.0.0: attempt to access beyond end of device [ 94.267449][ T5319] loop0: rw=2049, sector=179, nr_sectors = 120 limit=64 [ 94.365326][ T51] kworker/u4:4: attempt to access beyond end of device [ 94.365326][ T51] loop0: rw=8388609, sector=157, nr_sectors = 1 limit=64 [ 94.365351][ T51] Buffer I/O error on dev loop0, logical block 157, lost async page write [ 94.365378][ T51] Buffer I/O error on dev loop0, logical block 158, lost async page write [ 95.229262][ T5319] [ 95.230378][ T5319] ============================================ [ 95.232794][ T5319] WARNING: possible recursive locking detected [ 95.235294][ T5319] syzkaller #0 Not tainted [ 95.237111][ T5319] -------------------------------------------- [ 95.239720][ T5319] syz.0.0/5319 is trying to acquire lock: [ 95.242034][ T5319] ffff88805b3b60a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.245863][ T5319] [ 95.245863][ T5319] but task is already holding lock: [ 95.248736][ T5319] ffff88805b3b60a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.252390][ T5319] [ 95.252390][ T5319] other info that might help us debug this: [ 95.255627][ T5319] Possible unsafe locking scenario: [ 95.255627][ T5319] [ 95.258589][ T5319] CPU0 [ 95.259962][ T5319] ---- [ 95.261406][ T5319] lock(&tree->tree_lock/1); [ 95.263291][ T5319] lock(&tree->tree_lock/1); [ 95.265381][ T5319] [ 95.265381][ T5319] *** DEADLOCK *** [ 95.265381][ T5319] [ 95.268946][ T5319] May be due to missing lock nesting notation [ 95.268946][ T5319] [ 95.272405][ T5319] locks held by syz.0.0/5319: 6, last CPU#0: [ 95.274809][ T5319] #0: ffff888041907630 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 95.278446][ T5319] #1: ffff888013162460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 95.282069][ T5319] #2: ffff8880137c1f00 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 95.287201][ T5319] #3: ffff8880137c1d60 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.291175][ T5319] #4: ffff88805b3b60a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.295100][ T5319] #5: ffff8880136cc0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.299464][ T5319] [ 95.299464][ T5319] stack backtrace: [ 95.301829][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.305414][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.309105][ T5319] Call Trace: [ 95.310326][ T5319] [ 95.311463][ T5319] dump_stack_lvl+0xe8/0x150 [ 95.313474][ T5319] print_deadlock_bug+0x27a/0x290 [ 95.315274][ T5319] __lock_acquire+0x25db/0x2de0 [ 95.316943][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.319064][ T5319] ? stack_depot_save_flags+0x404/0x7f0 [ 95.321006][ T5319] ? kasan_save_track+0x4f/0x80 [ 95.322706][ T5319] ? kasan_save_track+0x3e/0x80 [ 95.324412][ T5319] ? __kasan_kmalloc+0x93/0xb0 [ 95.326839][ T5319] ? __kmalloc_noprof+0x36b/0x720 [ 95.329096][ T5319] ? hfs_find_init+0x9d/0x300 [ 95.331116][ T5319] ? hfs_extend_file+0x367/0x1680 [ 95.333260][ T5319] ? hfs_bmap_reserve+0x108/0x430 [ 95.335347][ T5319] ? __hfs_ext_write_extent+0x1fc/0x470 [ 95.337950][ T5319] lock_acquire+0x115/0x350 [ 95.340005][ T5319] ? hfs_find_init+0x18d/0x300 [ 95.342326][ T5319] __mutex_lock+0x19d/0x1550 [ 95.344501][ T5319] ? hfs_find_init+0x18d/0x300 [ 95.346847][ T5319] ? hfs_find_init+0x18d/0x300 [ 95.349066][ T5319] ? __pfx___mutex_lock+0x10/0x10 [ 95.351397][ T5319] ? rcu_is_watching+0x16/0xb0 [ 95.353694][ T5319] ? trace_kmalloc+0x2a/0xf0 [ 95.355882][ T5319] ? __kmalloc_noprof+0x38c/0x720 [ 95.358295][ T5319] ? __kmalloc_noprof+0x1ab/0x720 [ 95.360612][ T5319] ? hfs_find_init+0x9d/0x300 [ 95.362791][ T5319] hfs_find_init+0x18d/0x300 [ 95.364977][ T5319] hfs_extend_file+0x367/0x1680 [ 95.367338][ T5319] ? __asan_memcpy+0x40/0x70 [ 95.369430][ T5319] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.371803][ T5319] ? __hfs_brec_find+0x335/0x510 [ 95.374054][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 95.376389][ T5319] ? hfs_brec_find+0x3cc/0x510 [ 95.378632][ T5319] hfs_bmap_reserve+0x108/0x430 [ 95.380830][ T5319] __hfs_ext_write_extent+0x1fc/0x470 [ 95.383256][ T5319] __hfs_ext_cache_extent+0x6e/0x9b0 [ 95.385650][ T5319] ? hfs_find_init+0x18d/0x300 [ 95.387808][ T5319] hfs_extend_file+0x3ad/0x1680 [ 95.390035][ T5319] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 95.392787][ T5319] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.395073][ T5319] ? clean_bdev_aliases+0x62e/0x750 [ 95.397688][ T5319] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 95.399669][ T5319] hfs_get_block+0x401/0xbf0 [ 95.401898][ T5319] ? __pfx_hfs_get_block+0x10/0x10 [ 95.404391][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 95.406722][ T5319] ? _raw_spin_unlock+0x28/0x50 [ 95.408931][ T5319] ? create_empty_buffers+0x460/0x520 [ 95.411348][ T5319] __block_write_begin_int+0x6c2/0x1900 [ 95.413835][ T5319] ? __pfx_hfs_get_block+0x10/0x10 [ 95.416125][ T5319] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.418831][ T5319] cont_write_begin+0x71b/0xac0 [ 95.420994][ T5319] ? __pfx_cont_write_begin+0x10/0x10 [ 95.423395][ T5319] ? rcu_is_watching+0x16/0xb0 [ 95.425503][ T5319] hfs_write_begin+0x123/0x1c0 [ 95.427673][ T5319] ? __pfx_hfs_get_block+0x10/0x10 [ 95.430116][ T5319] generic_perform_write+0x2d5/0x8f0 [ 95.432487][ T5319] ? __pfx_generic_perform_write+0x10/0x10 [ 95.435176][ T5319] ? file_update_time_flags+0x1e0/0x440 [ 95.437720][ T5319] ? __generic_file_write_iter+0xf9/0x230 [ 95.440628][ T5319] ? generic_file_write_iter+0x9a/0x330 [ 95.443401][ T5319] generic_file_write_iter+0xae/0x330 [ 95.445850][ T5319] vfs_write+0x612/0xba0 [ 95.447753][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 95.449953][ T5319] ? __fget_files+0x2a/0x420 [ 95.452019][ T5319] ksys_write+0x150/0x270 [ 95.453831][ T5319] ? __pfx_ksys_write+0x10/0x10 [ 95.456001][ T5319] do_syscall_64+0x166/0x520 [ 95.458111][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.460822][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 95.463013][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.466012][ T5319] RIP: 0033:0x7f3ce579e1d9 [ 95.468026][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.476713][ T5319] RSP: 002b:00007f3ce66effe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.480709][ T5319] RAX: ffffffffffffffda RBX: 00007f3ce5a25fa0 RCX: 00007f3ce579e1d9 [ 95.484324][ T5319] RDX: 00000000fffffdef RSI: 0000200000000a40 RDI: 0000000000000008 [ 95.487910][ T5319] RBP: 00007f3ce5835888 R08: 0000000000000000 R09: 0000000000000000 [ 95.491490][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.495024][ T5319] R13: 00007f3ce5a26038 R14: 00007f3ce5a25fa0 R15: 00007ffd756541f8 [ 95.498886][ T5319] [ 96.048627][ T5281] Bluetooth: hci0: command tx timeout [ 98.128550][ T5281] Bluetooth: hci0: command tx timeout