program: syz_mount_image$hfs(&(0x7f0000004c40), &(0x7f0000004c80)='./file0\x00', 0x0, &(0x7f0000004cc0)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32a, &(0x7f0000004f40)="$eJzs3U1rE08cB/DvTJJm+2/+dfsggsdqQS+i9SJeIpK3IIgH0bYRiqGiVlAvJuJJRO/efQu+CC+Kb0BPHsSr0F4cmdnZTXZ39iFt2jX6/YC42d3J/CYzk/1NUAZE9M+62vny7uI3/UcANdSAl5cBCcAD6gCO44T3aHtna6fX3cx7o5opgT0FgaCkSN2zsd01fw/ip3U5U8Ly9as6WqPn6HAopa58TZz7LisKhipjZr+DBJp2dprr3pFHlm9Q5ibHeO4fQizTROxiF48xX3UcRERULf38HwRPSv2cb9n8XUpgFRh4f+rzv5z/U2d+VhLHUVK5V0ee/2aVpYTu32Pm0nC9Z5Zw+roMV4llam4kXs8gyMFiCaZwryqHSz4Ti5y9s9Xrntu419uUeI62NVJgOarB0iO0INoVx9o0R4m2C2dGGYQlG7oNaxnxL+2zxhypdDfWIeKD+CRuCh9vsRnlf3UldLQmYD/RU0H857PrmzOl9F2wXxvtdluaNwotmEpOxnsqu5VmFHjuFQnCD3YB8R8I/KI4TanFRKmgdRecBZpRqSVnqbXwVUZdy7FSujXRaM6OcjLUs6wr4rW4LlbwA+/RGcn/pY5vFemZOdIJw1kjVoOJZj7xoD0z7urq5j391JOjjxut+JnoU2xmhb6nBH8SOqCwD19hHZcw//DJ07u1Xq/7QB/cdhzcb0VnGi8A5z0VH6A/PNOEMlI3h9+BseKz9uQYldbGCOzsRFuqJ2LhzXqWJS+FrZzoJz86EsIJO7E+hax+aOWNjc7HxEAqPFC1cnNHNZ0j3C/u94xLv9Q+2p7Ol+nvNOz0qiOhiui8SwTrP5PJ23zf5Gs6W7jWzF6NhItMV8pmEkf7jkrn2NEKyIuVXzRH/8XT6IIV0JzNYxzruD5Say797E+tuU6dAU6Xr9G3cU6H7PTfEh18xi3+/k9ERERERERERERERERERERERERENG3G/98Rs2OWavBflhMRERERERERERERERERERERERERERERHVC0/y/C/X9Rbv/f5PZSdv9fDwX7/66nY0jt//tmG6IPcP9fosP1OwAA//+1UnIe") syz_usb_connect(0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="5000000010000304000000040000000000000000", @ANYRES32=0x0, @ANYBLOB="05a00200000000002800128009000100766c616e00000000180002800c000200540a00001d000000060001000000000008000500", @ANYRES32=r2], 0x50}, 0x1, 0xba01}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100766c616e0000000018000280060001"], 0x50}, 0x1, 0xba01}, 0x0) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000280)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r5 = openat(0xffffffffffffff9c, &(0x7f0000005300)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r5, &(0x7f0000005340)={0x18}, 0xfffffdef) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000004a80)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000004ac0)=ANY=[], 0x32600) ioctl$DVB_DVR_DMX_DQBUF(r6, 0xc0186f40, &(0x7f0000000000)={0x6, 0x9b, 0x5, 0xfffff000, 0x10, 0x1}) [ 93.598641][ T4660] Bluetooth: hci0: command tx timeout [ 93.611487][ T9] cfg80211: failed to load regulatory.db [ 93.683828][ T5337] loop0: detected capacity change from 0 to 64 [ 93.815974][ T5337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.816002][ T5337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.828726][ T5337] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.828915][ T5337] bridge_slave_1: left allmulticast mode [ 93.828932][ T5337] bridge_slave_1: left promiscuous mode [ 93.829090][ T5337] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.839329][ T5337] bridge_slave_0: left allmulticast mode [ 93.839350][ T5337] bridge_slave_0: left promiscuous mode [ 93.839494][ T5337] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.017679][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017679][ T58] loop0: rw=8388609, sector=161, nr_sectors = 1 limit=64 [ 94.017735][ T58] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 94.017761][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017761][ T58] loop0: rw=8388609, sector=162, nr_sectors = 1 limit=64 [ 94.017775][ T58] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 94.017787][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017787][ T58] loop0: rw=8388609, sector=163, nr_sectors = 1 limit=64 [ 94.017800][ T58] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 94.017812][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017812][ T58] loop0: rw=8388609, sector=167, nr_sectors = 1 limit=64 [ 94.017825][ T58] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 94.017845][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017845][ T58] loop0: rw=8388609, sector=169, nr_sectors = 1 limit=64 [ 94.017858][ T58] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 94.017870][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017870][ T58] loop0: rw=8388609, sector=171, nr_sectors = 1 limit=64 [ 94.017883][ T58] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 94.017895][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017895][ T58] loop0: rw=8388609, sector=172, nr_sectors = 1 limit=64 [ 94.017908][ T58] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 94.017920][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.017920][ T58] loop0: rw=8388609, sector=173, nr_sectors = 1 limit=64 [ 94.017934][ T58] Buffer I/O error on dev loop0, logical block 173, lost async page write [ 94.018050][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.018050][ T58] loop0: rw=8388609, sector=174, nr_sectors = 1 limit=64 [ 94.018065][ T58] Buffer I/O error on dev loop0, logical block 174, lost async page write [ 94.018076][ T58] kworker/u4:4: attempt to access beyond end of device [ 94.018076][ T58] loop0: rw=8388609, sector=175, nr_sectors = 1 limit=64 [ 94.018087][ T58] Buffer I/O error on dev loop0, logical block 175, lost async page write [ 95.431087][ T5338] [ 95.431998][ T5338] ============================================ [ 95.434064][ T5338] WARNING: possible recursive locking detected [ 95.437254][ T5338] syzkaller #0 Not tainted [ 95.438818][ T5338] -------------------------------------------- [ 95.440968][ T5338] syz.0.0/5338 is trying to acquire lock: [ 95.443038][ T5338] ffff8880400720a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.446745][ T5338] [ 95.446745][ T5338] but task is already holding lock: [ 95.449929][ T5338] ffff8880400720a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.453930][ T5338] [ 95.453930][ T5338] other info that might help us debug this: [ 95.457347][ T5338] Possible unsafe locking scenario: [ 95.457347][ T5338] [ 95.460587][ T5338] CPU0 [ 95.462117][ T5338] ---- [ 95.463595][ T5338] lock(&tree->tree_lock/1); [ 95.465696][ T5338] lock(&tree->tree_lock/1); [ 95.467761][ T5338] [ 95.467761][ T5338] *** DEADLOCK *** [ 95.467761][ T5338] [ 95.471135][ T5338] May be due to missing lock nesting notation [ 95.471135][ T5338] [ 95.474586][ T5338] locks held by syz.0.0/5338: 6, last CPU#0: [ 95.477222][ T5338] #0: ffff88803b840d30 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 95.481152][ T5338] #1: ffff88801384c460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 95.485041][ T5338] #2: ffff888014a37040 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 95.489821][ T5338] #3: ffff888014a36ea0 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.494280][ T5338] #4: ffff8880400720a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.498438][ T5338] #5: ffff888013bf40a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.503303][ T5338] [ 95.503303][ T5338] stack backtrace: [ 95.505993][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.509911][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.514033][ T5338] Call Trace: [ 95.515520][ T5338] [ 95.516838][ T5338] dump_stack_lvl+0xe8/0x150 [ 95.518746][ T5338] print_deadlock_bug+0x27a/0x290 [ 95.520805][ T5338] __lock_acquire+0x25db/0x2de0 [ 95.522798][ T5338] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.525286][ T5338] ? stack_depot_save_flags+0x404/0x7f0 [ 95.527555][ T5338] ? kasan_save_track+0x4f/0x80 [ 95.529549][ T5338] ? kasan_save_track+0x3e/0x80 [ 95.531544][ T5338] ? __kasan_kmalloc+0x93/0xb0 [ 95.533591][ T5338] ? __kmalloc_noprof+0x366/0x710 [ 95.535749][ T5338] ? hfs_find_init+0x9d/0x300 [ 95.537796][ T5338] ? hfs_extend_file+0x367/0x1680 [ 95.540003][ T5338] ? hfs_bmap_reserve+0x108/0x430 [ 95.542156][ T5338] ? __hfs_ext_write_extent+0x200/0x620 [ 95.544569][ T5338] lock_acquire+0x115/0x350 [ 95.546533][ T5338] ? hfs_find_init+0x18d/0x300 [ 95.548546][ T5338] __mutex_lock+0x197/0x15a0 [ 95.550492][ T5338] ? hfs_find_init+0x18d/0x300 [ 95.552576][ T5338] ? hfs_find_init+0x18d/0x300 [ 95.554651][ T5338] ? __pfx___mutex_lock+0x10/0x10 [ 95.556683][ T5338] ? rcu_is_watching+0x16/0xb0 [ 95.558516][ T5338] ? trace_kmalloc+0x2a/0xf0 [ 95.560465][ T5338] ? __kmalloc_noprof+0x387/0x710 [ 95.562465][ T5338] ? __kmalloc_noprof+0x1a6/0x710 [ 95.564581][ T5338] ? hfs_find_init+0x9d/0x300 [ 95.566602][ T5338] hfs_find_init+0x18d/0x300 [ 95.568583][ T5338] hfs_extend_file+0x367/0x1680 [ 95.570683][ T5338] ? __asan_memcpy+0x40/0x70 [ 95.572544][ T5338] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.574638][ T5338] ? __hfs_brec_find+0x326/0x510 [ 95.576701][ T5338] ? do_raw_spin_unlock+0x4d/0x200 [ 95.578872][ T5338] ? hfs_brec_find+0x3cc/0x510 [ 95.580987][ T5338] hfs_bmap_reserve+0x108/0x430 [ 95.583294][ T5338] __hfs_ext_write_extent+0x200/0x620 [ 95.585584][ T5338] ? __kmalloc_noprof+0x1a6/0x710 [ 95.587956][ T5338] ? hfs_find_init+0x9d/0x300 [ 95.590347][ T5338] __hfs_ext_cache_extent+0x6e/0x9b0 [ 95.592661][ T5338] ? hfs_find_init+0x18d/0x300 [ 95.594624][ T5338] hfs_extend_file+0x3ad/0x1680 [ 95.596762][ T5338] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 95.599326][ T5338] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.601498][ T5338] ? clean_bdev_aliases+0x61a/0x740 [ 95.603662][ T5338] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 95.605980][ T5338] hfs_get_block+0x401/0xbf0 [ 95.607916][ T5338] ? __pfx_hfs_get_block+0x10/0x10 [ 95.610004][ T5338] ? do_raw_spin_unlock+0x4d/0x200 [ 95.612164][ T5338] ? _raw_spin_unlock+0x28/0x50 [ 95.614123][ T5338] ? create_empty_buffers+0x41e/0x4d0 [ 95.616305][ T5338] __block_write_begin_int+0x6c1/0x1930 [ 95.618551][ T5338] ? __pfx_hfs_get_block+0x10/0x10 [ 95.620667][ T5338] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.623026][ T5338] cont_write_begin+0x71b/0xac0 [ 95.624984][ T5338] ? __pfx_cont_write_begin+0x10/0x10 [ 95.627096][ T5338] ? rcu_is_watching+0x16/0xb0 [ 95.629200][ T5338] hfs_write_begin+0x123/0x1c0 [ 95.631268][ T5338] ? __pfx_hfs_get_block+0x10/0x10 [ 95.633578][ T5338] generic_perform_write+0x2d5/0x8e0 [ 95.635983][ T5338] ? __pfx_generic_perform_write+0x10/0x10 [ 95.638511][ T5338] ? file_update_time_flags+0x1e0/0x440 [ 95.640903][ T5338] ? __generic_file_write_iter+0xf9/0x230 [ 95.643395][ T5338] ? generic_file_write_iter+0x9a/0x330 [ 95.645860][ T5338] generic_file_write_iter+0xae/0x330 [ 95.648186][ T5338] vfs_write+0x612/0xba0 [ 95.649984][ T5338] ? __pfx_vfs_write+0x10/0x10 [ 95.652009][ T5338] ? __fget_files+0x3a2/0x420 [ 95.653952][ T5338] ? __fget_files+0x2a/0x420 [ 95.655880][ T5338] ? fdget+0x1ac/0x250 [ 95.657680][ T5338] ksys_write+0x150/0x270 [ 95.659563][ T5338] ? __pfx_ksys_write+0x10/0x10 [ 95.661586][ T5338] do_syscall_64+0x166/0x520 [ 95.663596][ T5338] ? trace_irq_disable+0x3b/0x140 [ 95.665744][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.668230][ T5338] ? clear_bhb_loop+0x70/0xc0 [ 95.670169][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.672474][ T5338] RIP: 0033:0x7fd07279f559 [ 95.674339][ T5338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.682268][ T5338] RSP: 002b:00007fd07365ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.685688][ T5338] RAX: ffffffffffffffda RBX: 00007fd072a26090 RCX: 00007fd07279f559 [ 95.689046][ T5338] RDX: 00000000fffffdef RSI: 0000200000005340 RDI: 0000000000000009 [ 95.692137][ T5338] RBP: 00007fd072836b20 R08: 0000000000000000 R09: 0000000000000000 [ 95.695477][ T5338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.699005][ T5338] R13: 00007fd072a26128 R14: 00007fd072a26090 R15: 00007ffefd4329b8 [ 95.702349][ T5338] [ 95.726475][ T4660] Bluetooth: hci0: command tx timeout [ 97.740414][ T4660] Bluetooth: hci0: command tx timeout [ 99.421296][ T58] bio_check_eod: 36 callbacks suppressed [ 99.421326][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421326][ T58] loop0: rw=1048577, sector=2083, nr_sectors = 2088 limit=64 [ 99.421765][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421765][ T58] loop0: rw=1048577, sector=4172, nr_sectors = 16 limit=64 [ 99.421856][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421856][ T58] loop0: rw=9437185, sector=4188, nr_sectors = 1 limit=64 [ 99.421871][ T58] buffer_io_error: 22 callbacks suppressed [ 99.421877][ T58] Buffer I/O error on dev loop0, logical block 4188, lost async page write [ 99.421889][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421889][ T58] loop0: rw=9437185, sector=4189, nr_sectors = 1 limit=64 [ 99.421902][ T58] Buffer I/O error on dev loop0, logical block 4189, lost async page write [ 99.421911][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421911][ T58] loop0: rw=9437185, sector=4190, nr_sectors = 1 limit=64 [ 99.421923][ T58] Buffer I/O error on dev loop0, logical block 4190, lost async page write [ 99.421933][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421933][ T58] loop0: rw=9437185, sector=4191, nr_sectors = 1 limit=64 [ 99.421944][ T58] Buffer I/O error on dev loop0, logical block 4191, lost async page write [ 99.421953][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421953][ T58] loop0: rw=9437185, sector=4192, nr_sectors = 1 limit=64 [ 99.421966][ T58] Buffer I/O error on dev loop0, logical block 4192, lost async page write [ 99.421975][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421975][ T58] loop0: rw=9437185, sector=4193, nr_sectors = 1 limit=64 [ 99.421987][ T58] Buffer I/O error on dev loop0, logical block 4193, lost async page write [ 99.421997][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.421997][ T58] loop0: rw=9437185, sector=4196, nr_sectors = 1 limit=64 [ 99.422009][ T58] Buffer I/O error on dev loop0, logical block 4196, lost async page write [ 99.422018][ T58] kworker/u4:4: attempt to access beyond end of device [ 99.422018][ T58] loop0: rw=9437185, sector=4197, nr_sectors = 1 limit=64 [ 99.422030][ T58] Buffer I/O error on dev loop0, logical block 4197, lost async page write [ 99.422223][ T58] Buffer I/O error on dev loop0, logical block 4358, lost async page write [ 99.422234][ T58] Buffer I/O error on dev loop0, logical block 4359, lost async page write