program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r2 = syz_mount_image$hfs(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32a, &(0x7f0000000e40)="$eJzs3U1rE08cB/DvTJJm+2/+dfsggsdqQS+i9SJeIpK3IIgH0bYRiqGiVlAvJuJJRO/efQu+CC+Kb0BPHsSr0F4cmdnZTXZ39iFt2jX6/YC42d3J/CYzk/1NUAZE9M+62vny7uI3/UcANdSAl5cBCcAD6gCO44T3aHtna6fX3cx7o5opgT0FgaCkSN2zsd01fw/ip3U5U8Ly9as6WqPn6HAopa58TZz7LisKhipjZr+DBJp2dprr3pFHlm9Q5ibHeO4fQizTROxiF48xX3UcRERULf38HwRPSv2cb9n8XUpgFRh4f+rzv5z/U2d+VhLHUVK5V0ee/2aVpYTu32Pm0nC9Z5Zw+roMV4llam4kXs8gyMFiCaZwryqHSz4Ti5y9s9Xrntu419uUeI62NVJgOarB0iO0INoVx9o0R4m2C2dGGYQlG7oNaxnxL+2zxhypdDfWIeKD+CRuCh9vsRnlf3UldLQmYD/RU0H857PrmzOl9F2wXxvtdluaNwotmEpOxnsqu5VmFHjuFQnCD3YB8R8I/KI4TanFRKmgdRecBZpRqSVnqbXwVUZdy7FSujXRaM6OcjLUs6wr4rW4LlbwA+/RGcn/pY5vFemZOdIJw1kjVoOJZj7xoD0z7urq5j391JOjjxut+JnoU2xmhb6nBH8SOqCwD19hHZcw//DJ07u1Xq/7QB/cdhzcb0VnGi8A5z0VH6A/PNOEMlI3h9+BseKz9uQYldbGCOzsRFuqJ2LhzXqWJS+FrZzoJz86EsIJO7E+hax+aOWNjc7HxEAqPFC1cnNHNZ0j3C/u94xLv9Q+2p7Ol+nvNOz0qiOhiui8SwTrP5PJ23zf5Gs6W7jWzF6NhItMV8pmEkf7jkrn2NEKyIuVXzRH/8XT6IIV0JzNYxzruD5Say797E+tuU6dAU6Xr9G3cU6H7PTfEh18xi3+/k9ERERERERERERERERERERERERENG3G/98Rs2OWavBflhMRERERERERERERERERERERERERERERHVC0/y/C/X9Rbv/f5PZSdv9fDwX7/66nY0jt//tmG6IPcP9fosP1OwAA//+1UnIe") r3 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r3, &(0x7f00000011c0)={0x18}, 0xfffffdef) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001200)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000001240)=ANY=[], 0x32600) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FIOCLEX(r1, 0x5451) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x8000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000006a0083130000000000000051000000f7a500000008000a"], 0x20}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000300), 0x40000000000009f, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000b40)={'syzkaller1\x00', 0x1}) r8 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000b80)={'syzkaller1\x00', 0x0}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000, 0x20010, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000bc0)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}, {0xfff5}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x10) sendmsg$nl_route_sched(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x0) write(r7, &(0x7f0000000e00)="000008004500001c123400004011e5c8ac141401ac14140204d204d200080000", 0x20) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYRES32=r8, @ANYRES32=r2, @ANYBLOB="dc8f9b957aca7335bcc57efb0f662a4f5e1882b8e7ae4394b932d7adc681455d6394f93127d8ee4569a0b1b1e37916861cf507c3f677ce22a65e18b1db16a181729bb8a84bea1a3f87eac0ff8023f0c631a47ca0a538dbfaeedec56a8ecdd56bc6fa744f362a409dbdf146ebef9a89e27aebece854099276388afc962da843232b4f7aa6bf3a268c633408b11963b20fceddbfeb81c500342d72d09ac44e0c345c8d2ffad1417c0c7f5fb803e4e59e79bf4bb61de27b5ea293a7f732017c95507c529b52925d730fbd1ada82778fcfcb817c0a7e291b834c6401afd155052e769019f64569f16fcbe233e36893f3"], 0x34}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) bind$netlink(r11, &(0x7f0000000800)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r11, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000880)=0x14) sendmsg$nl_route(r10, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@newlink={0x20, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r12, 0x60046}}, 0x20}, 0x1, 0x0, 0x0, 0x40040}, 0x0) [ 75.447230][ T5339] loop0: detected capacity change from 0 to 64 [ 75.600938][ T5340] Zero length message leads to an empty skb [ 75.632297][ T4667] Bluetooth: hci0: command tx timeout [ 76.595360][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.595470][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.692259][ T5339] [ 76.693324][ T5339] ============================================ [ 76.695948][ T5339] WARNING: possible recursive locking detected [ 76.698713][ T5339] syzkaller #0 Not tainted [ 76.700582][ T5339] -------------------------------------------- [ 76.703541][ T5339] syz.0.0/5339 is trying to acquire lock: [ 76.706125][ T5339] ffff888013ec80a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 76.710082][ T5339] [ 76.710082][ T5339] but task is already holding lock: [ 76.713661][ T5339] ffff888013ec80a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 76.717523][ T5339] [ 76.717523][ T5339] other info that might help us debug this: [ 76.720705][ T5339] Possible unsafe locking scenario: [ 76.720705][ T5339] [ 76.723922][ T5339] CPU0 [ 76.725342][ T5339] ---- [ 76.726819][ T5339] lock(&tree->tree_lock/1); [ 76.728759][ T5339] lock(&tree->tree_lock/1); [ 76.730618][ T5339] [ 76.730618][ T5339] *** DEADLOCK *** [ 76.730618][ T5339] [ 76.733719][ T5339] May be due to missing lock nesting notation [ 76.733719][ T5339] [ 76.736879][ T5339] locks held by syz.0.0/5339: 6, last CPU#0: [ 76.739398][ T5339] #0: ffff88803fee0b70 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 76.743339][ T5339] #1: ffff888013f64460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 76.747179][ T5339] #2: ffff888054777040 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 76.751881][ T5339] #3: ffff888054776ea0 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 76.756226][ T5339] #4: ffff888013ec80a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 76.760429][ T5339] #5: ffff88805477c0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 76.765616][ T5339] [ 76.765616][ T5339] stack backtrace: [ 76.768203][ T5339] CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.771931][ T5339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.776062][ T5339] Call Trace: [ 76.777541][ T5339] [ 76.778819][ T5339] dump_stack_lvl+0xe8/0x150 [ 76.780770][ T5339] print_deadlock_bug+0x27a/0x290 [ 76.782872][ T5339] __lock_acquire+0x25db/0x2de0 [ 76.784954][ T5339] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 76.787433][ T5339] ? stack_depot_save_flags+0x404/0x7f0 [ 76.789845][ T5339] ? kasan_save_track+0x4f/0x80 [ 76.792024][ T5339] ? kasan_save_track+0x3e/0x80 [ 76.794241][ T5339] ? __kasan_kmalloc+0x93/0xb0 [ 76.796331][ T5339] ? __kmalloc_noprof+0x366/0x710 [ 76.798453][ T5339] ? hfs_find_init+0x9d/0x300 [ 76.800402][ T5339] ? hfs_extend_file+0x367/0x1680 [ 76.802670][ T5339] ? hfs_bmap_reserve+0x108/0x430 [ 76.804923][ T5339] ? __hfs_ext_write_extent+0x200/0x620 [ 76.807397][ T5339] lock_acquire+0x115/0x350 [ 76.809661][ T5339] ? hfs_find_init+0x18d/0x300 [ 76.812351][ T5339] __mutex_lock+0x197/0x15a0 [ 76.814908][ T5339] ? hfs_find_init+0x18d/0x300 [ 76.817458][ T5339] ? hfs_find_init+0x18d/0x300 [ 76.819489][ T5339] ? __pfx___mutex_lock+0x10/0x10 [ 76.821589][ T5339] ? rcu_is_watching+0x16/0xb0 [ 76.823642][ T5339] ? trace_kmalloc+0x2a/0xf0 [ 76.825654][ T5339] ? __kmalloc_noprof+0x387/0x710 [ 76.827896][ T5339] ? __kmalloc_noprof+0x1a6/0x710 [ 76.830481][ T5339] ? hfs_find_init+0x9d/0x300 [ 76.833146][ T5339] hfs_find_init+0x18d/0x300 [ 76.835131][ T5339] hfs_extend_file+0x367/0x1680 [ 76.837490][ T5339] ? __asan_memcpy+0x40/0x70 [ 76.839678][ T5339] ? __pfx_hfs_extend_file+0x10/0x10 [ 76.842599][ T5339] ? __hfs_brec_find+0x335/0x510 [ 76.845357][ T5339] ? do_raw_spin_unlock+0x4d/0x200 [ 76.847956][ T5339] ? hfs_brec_find+0x3cc/0x510 [ 76.850102][ T5339] hfs_bmap_reserve+0x108/0x430 [ 76.852341][ T5339] __hfs_ext_write_extent+0x200/0x620 [ 76.854551][ T5339] ? __kmalloc_noprof+0x1a6/0x710 [ 76.856711][ T5339] ? hfs_find_init+0x9d/0x300 [ 76.858763][ T5339] __hfs_ext_cache_extent+0x6e/0x9b0 [ 76.861024][ T5339] ? hfs_find_init+0x18d/0x300 [ 76.863023][ T5339] hfs_extend_file+0x3ad/0x1680 [ 76.865070][ T5339] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 76.867396][ T5339] ? __pfx_hfs_extend_file+0x10/0x10 [ 76.869733][ T5339] ? clean_bdev_aliases+0x61a/0x740 [ 76.871920][ T5339] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 76.874325][ T5339] hfs_get_block+0x401/0xbf0 [ 76.876733][ T5339] ? __pfx_hfs_get_block+0x10/0x10 [ 76.878942][ T5339] ? do_raw_spin_unlock+0x4d/0x200 [ 76.881022][ T5339] ? _raw_spin_unlock+0x28/0x50 [ 76.883125][ T5339] ? create_empty_buffers+0x41e/0x4d0 [ 76.885430][ T5339] __block_write_begin_int+0x6c1/0x1930 [ 76.887631][ T5339] ? __pfx_hfs_get_block+0x10/0x10 [ 76.889728][ T5339] ? __pfx___block_write_begin_int+0x10/0x10 [ 76.892104][ T5339] cont_write_begin+0x71b/0xac0 [ 76.894203][ T5339] ? __pfx_cont_write_begin+0x10/0x10 [ 76.896500][ T5339] ? rcu_is_watching+0x16/0xb0 [ 76.898590][ T5339] hfs_write_begin+0x123/0x1c0 [ 76.900668][ T5339] ? __pfx_hfs_get_block+0x10/0x10 [ 76.902993][ T5339] generic_perform_write+0x2d5/0x8e0 [ 76.905264][ T5339] ? __pfx_generic_perform_write+0x10/0x10 [ 76.907759][ T5339] ? file_update_time_flags+0x1e0/0x440 [ 76.910139][ T5339] ? __generic_file_write_iter+0xf9/0x230 [ 76.912545][ T5339] ? generic_file_write_iter+0x9a/0x330 [ 76.914878][ T5339] generic_file_write_iter+0xae/0x330 [ 76.917086][ T5339] vfs_write+0x612/0xba0 [ 76.918896][ T5339] ? __pfx_vfs_write+0x10/0x10 [ 76.920961][ T5339] ? __fget_files+0x3a2/0x420 [ 76.923016][ T5339] ? __fget_files+0x2a/0x420 [ 76.925001][ T5339] ? fdget+0x1ac/0x250 [ 76.926835][ T5339] ksys_write+0x150/0x270 [ 76.929106][ T5339] ? __pfx_ksys_write+0x10/0x10 [ 76.931210][ T5339] do_syscall_64+0x166/0x520 [ 76.933068][ T5339] ? trace_irq_disable+0x3b/0x140 [ 76.935309][ T5339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.937834][ T5339] ? clear_bhb_loop+0x70/0xc0 [ 76.939430][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.941472][ T5339] RIP: 0033:0x7f7a0e59f559 [ 76.943119][ T5339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.950453][ T5339] RSP: 002b:00007f7a0f4f6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 76.953847][ T5339] RAX: ffffffffffffffda RBX: 00007f7a0e825fa0 RCX: 00007f7a0e59f559 [ 76.957037][ T5339] RDX: 00000000fffffdef RSI: 00002000000011c0 RDI: 0000000000000006 [ 76.960341][ T5339] RBP: 00007f7a0e636b20 R08: 0000000000000000 R09: 0000000000000000 [ 76.963635][ T5339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.966694][ T5339] R13: 00007f7a0e826038 R14: 00007f7a0e825fa0 R15: 00007ffeee9dedf8 [ 76.969752][ T5339] [ 77.711350][ T4667] Bluetooth: hci0: command tx timeout [ 79.791609][ T4667] Bluetooth: hci0: command tx timeout [ 80.511683][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511683][ T37] loop0: rw=9437185, sector=161, nr_sectors = 1 limit=64 [ 80.511707][ T37] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 80.511718][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511718][ T37] loop0: rw=9437185, sector=162, nr_sectors = 1 limit=64 [ 80.511729][ T37] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 80.511739][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511739][ T37] loop0: rw=9437185, sector=163, nr_sectors = 1 limit=64 [ 80.511750][ T37] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 80.511759][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511759][ T37] loop0: rw=9437185, sector=167, nr_sectors = 1 limit=64 [ 80.511770][ T37] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 80.511778][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511778][ T37] loop0: rw=9437185, sector=169, nr_sectors = 1 limit=64 [ 80.511789][ T37] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 80.511798][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511798][ T37] loop0: rw=9437185, sector=171, nr_sectors = 1 limit=64 [ 80.511808][ T37] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 80.511817][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511817][ T37] loop0: rw=9437185, sector=172, nr_sectors = 1 limit=64 [ 80.511827][ T37] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 80.511836][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511836][ T37] loop0: rw=9437185, sector=173, nr_sectors = 1 limit=64 [ 80.511847][ T37] Buffer I/O error on dev loop0, logical block 173, lost async page write [ 80.511864][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511864][ T37] loop0: rw=9437185, sector=174, nr_sectors = 1 limit=64 [ 80.511875][ T37] Buffer I/O error on dev loop0, logical block 174, lost async page write [ 80.511883][ T37] kworker/u4:2: attempt to access beyond end of device [ 80.511883][ T37] loop0: rw=9437185, sector=175, nr_sectors = 1 limit=64 [ 80.511894][ T37] Buffer I/O error on dev loop0, logical block 175, lost async page write