program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48) syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") r1 = creat(&(0x7f0000000380)='./bus\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000140)='./mnt\x00', 0x2200454, &(0x7f0000000040)={[{@user_xattr}, {@nodelalloc}]}, 0x1, 0x244, &(0x7f0000000540)="$eJzs3DFoFXccB/Df3XuvadJHSdulUGgLpZQ2ENKt0CVdWgiUEEoptIWUIi5KIsQEt8TJxUFnlUwuQdyMjpIluCiCU9QMcRE0OCQ46PDk3iUSzQsKl7wT7/OBS+7e+//v9z/uff/3hncXQGX1R8RwRNQiYiAiGhGR7Gzwdb70b23O9y6PR7RafzxJ2u3y7dx2v48iYi4ifoqIpTSJI/WImcV/1p6u/Pbd6enGtxcX/+7t6kFuWV9b/X3zwuipKyM/zty682g0ieFovnJc+y/p8Fo9ifj0IIq9I5J62SPgbYyduHw3y/1nEfFNO/+NSCM/eWemPlhqxA/n9+p79vHtL7o5VmD/tVqN7Bo41wIqJ42IZiTpYETk62k6OJh/h79X60uPTk4dHzg8OT1xqOyZCtgvzYjVX6/1XN14Lf8Pa3n+gfdXlv8/xxbuZ+ubtbJHA3RTlv+B/2a/D/mHypF/qC75h+qSf6gu+Yfqkn+orj3yv/0z/7SscQEHz/Ufqkv+obrkH6prZ/4BgGpp9ZR9BzJQlrLnHwAAAAAAAAAAAAAAAAAAYLf53uXx7aVbNW+ci1j/JSLqnerXth5C/GH7b99GkjV7Kcm7FfLvVwV3UNClku++/vhBufVvfllu/dmJiLmTETFUr+/+/CWFH4L9yRveb/xfsEBBP/9Vbv3nC+XWH1mJuJ7NP0Od5p80Pm//7zz/NLPzV7D+sWcFdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDXvAgAAP//DkFuIw==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r2, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x7, 0x1000, 0x1000000007}) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r3, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r1, &(0x7f0000000000), 0xfffffffe, 0x16}]) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x14, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}}, 0x48044) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r4, 0xc0c0128e, &(0x7f0000000240)={0x4000000000002000, 0x2}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005e00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}], 0x10}}], 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x2, 0x17, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000fcff1f00000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000fbe3404dbd94a323a4d6060000008500000005000000980900000000000066090600000003e7040000000600000018010000756c6c2500000000002020207b9af8ff00000000ac9100000000000237010000f8ffffffb702000008000000b70300000000000014000000060000005d93000000000000b5030200000000008500000019000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb4) [ 94.181932][ T4637] Bluetooth: hci0: command tx timeout [ 94.284877][ T5312] loop0: detected capacity change from 0 to 1024 [ 94.351512][ T5312] syz.0.0: attempt to access beyond end of device [ 94.351512][ T5312] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 94.387209][ T5312] [ 94.388321][ T5312] ====================================================== [ 94.391126][ T5312] WARNING: possible circular locking dependency detected [ 94.393944][ T5312] syzkaller #0 Not tainted [ 94.395679][ T5312] ------------------------------------------------------ [ 94.398376][ T5312] syz.0.0/5312 is trying to acquire lock: [ 94.400572][ T5312] ffff888052828740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.404928][ T5312] [ 94.404928][ T5312] but task is already holding lock: [ 94.407975][ T5312] ffff8880406920a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.411818][ T5312] [ 94.411818][ T5312] which lock already depends on the new lock. [ 94.411818][ T5312] [ 94.415988][ T5312] [ 94.415988][ T5312] the existing dependency chain (in reverse order) is: [ 94.419565][ T5312] [ 94.419565][ T5312] -> #1 (&tree->tree_lock/1){+.+.}-{4:4}: [ 94.422831][ T5312] __mutex_lock+0x19d/0x1550 [ 94.425027][ T5312] hfsplus_find_init+0x179/0x2e0 [ 94.427171][ T5312] hfsplus_file_truncate+0x3e0/0xd20 [ 94.429575][ T5312] hfsplus_write_begin+0x17b/0x1e0 [ 94.431937][ T5312] cont_write_begin+0x7b2/0xac0 [ 94.434307][ T5312] hfsplus_write_begin+0x126/0x1e0 [ 94.436630][ T5312] generic_perform_write+0x2d5/0x8f0 [ 94.439059][ T5312] generic_file_write_iter+0xae/0x330 [ 94.441323][ T5312] do_iter_readv_writev+0x612/0x8c0 [ 94.443606][ T5312] vfs_writev+0x343/0x990 [ 94.445549][ T5312] __se_sys_pwritev2+0x177/0x2a0 [ 94.447897][ T5312] do_syscall_64+0x166/0x520 [ 94.450149][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.452969][ T5312] [ 94.452969][ T5312] -> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 94.456785][ T5312] __lock_acquire+0x1520/0x2cf0 [ 94.458993][ T5312] lock_acquire+0x106/0x350 [ 94.461169][ T5312] __mutex_lock+0x19d/0x1550 [ 94.463377][ T5312] hfsplus_file_extend+0x21c/0x1df0 [ 94.465780][ T5312] hfsplus_bmap_reserve+0x170/0x590 [ 94.468298][ T5312] __hfsplus_ext_write_extent+0x295/0x690 [ 94.470934][ T5312] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.473465][ T5312] hfsplus_file_extend+0x502/0x1df0 [ 94.475822][ T5312] hfsplus_get_block+0x41f/0x1610 [ 94.478129][ T5312] __block_write_begin_int+0x6c2/0x1900 [ 94.480681][ T5312] cont_write_begin+0x71b/0xac0 [ 94.482946][ T5312] hfsplus_write_begin+0x126/0x1e0 [ 94.485249][ T5312] generic_perform_write+0x2d5/0x8f0 [ 94.487696][ T5312] generic_file_write_iter+0xae/0x330 [ 94.490230][ T5312] aio_write+0x5d0/0x870 [ 94.492303][ T5312] io_submit_one+0x798/0x13d0 [ 94.494523][ T5312] __se_sys_io_submit+0x195/0x340 [ 94.496845][ T5312] do_syscall_64+0x166/0x520 [ 94.499069][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.501822][ T5312] [ 94.501822][ T5312] other info that might help us debug this: [ 94.501822][ T5312] [ 94.506203][ T5312] Possible unsafe locking scenario: [ 94.506203][ T5312] [ 94.509526][ T5312] CPU0 CPU1 [ 94.511857][ T5312] ---- ---- [ 94.514294][ T5312] lock(&tree->tree_lock/1); [ 94.516207][ T5312] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.519637][ T5312] lock(&tree->tree_lock/1); [ 94.522532][ T5312] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.524992][ T5312] [ 94.524992][ T5312] *** DEADLOCK *** [ 94.524992][ T5312] [ 94.528372][ T5312] locks held by syz.0.0/5312: 3, last CPU#0: [ 94.530891][ T5312] #0: ffff8880528221d8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 94.535407][ T5312] #1: ffff888052822040 (&hip->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.539215][ T5312] #2: ffff8880406920a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.542889][ T5312] [ 94.542889][ T5312] stack backtrace: [ 94.545279][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.545290][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.545295][ T5312] Call Trace: [ 94.545300][ T5312] [ 94.545304][ T5312] dump_stack_lvl+0xe8/0x150 [ 94.545319][ T5312] print_circular_bug+0x2e1/0x300 [ 94.545328][ T5312] check_noncircular+0x12e/0x150 [ 94.545338][ T5312] __lock_acquire+0x1520/0x2cf0 [ 94.545353][ T5312] ? rcu_is_watching+0x16/0xb0 [ 94.545362][ T5312] ? lock_release+0x4b/0x3c0 [ 94.545375][ T5312] ? lock_release+0x4b/0x3c0 [ 94.545387][ T5312] ? is_bpf_text_address+0x292/0x2b0 [ 94.545400][ T5312] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.545412][ T5312] lock_acquire+0x106/0x350 [ 94.545425][ T5312] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.545441][ T5312] __mutex_lock+0x19d/0x1550 [ 94.545454][ T5312] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.545469][ T5312] ? stack_trace_save+0xa9/0x100 [ 94.545482][ T5312] ? __pfx_stack_trace_save+0x10/0x10 [ 94.545499][ T5312] ? check_path+0x21/0x40 [ 94.545508][ T5312] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.545522][ T5312] ? __pfx___mutex_lock+0x10/0x10 [ 94.545532][ T5312] ? add_lock_to_list+0xc7/0x100 [ 94.545546][ T5312] ? stack_depot_save_flags+0x404/0x7f0 [ 94.545611][ T5312] hfsplus_file_extend+0x21c/0x1df0 [ 94.545635][ T5312] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.545648][ T5312] ? __pfx___mutex_trylock_common+0x10/0x10 [ 94.545660][ T5312] ? rcu_is_watching+0x16/0xb0 [ 94.545670][ T5312] ? trace_contention_end+0x3d/0x140 [ 94.545681][ T5312] ? __asan_memset+0x22/0x50 [ 94.545688][ T5312] ? hfsplus_brec_find+0x19a/0x510 [ 94.545697][ T5312] hfsplus_bmap_reserve+0x170/0x590 [ 94.545711][ T5312] __hfsplus_ext_write_extent+0x295/0x690 [ 94.545721][ T5312] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.545730][ T5312] ? hfsplus_find_init+0x179/0x2e0 [ 94.545737][ T5312] hfsplus_file_extend+0x502/0x1df0 [ 94.545746][ T5312] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.545758][ T5312] ? clean_bdev_aliases+0x62e/0x750 [ 94.545773][ T5312] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 94.545785][ T5312] hfsplus_get_block+0x41f/0x1610 [ 94.545799][ T5312] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.545813][ T5312] ? do_raw_spin_unlock+0x4d/0x200 [ 94.545825][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 94.545834][ T5312] ? create_empty_buffers+0x460/0x520 [ 94.545848][ T5312] __block_write_begin_int+0x6c2/0x1900 [ 94.545865][ T5312] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.545879][ T5312] ? __pfx___block_write_begin_int+0x10/0x10 [ 94.545892][ T5312] cont_write_begin+0x71b/0xac0 [ 94.545904][ T5312] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.545918][ T5312] ? __pfx_cont_write_begin+0x10/0x10 [ 94.545932][ T5312] ? rcu_is_watching+0x16/0xb0 [ 94.545942][ T5312] hfsplus_write_begin+0x126/0x1e0 [ 94.545952][ T5312] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.545964][ T5312] generic_perform_write+0x2d5/0x8f0 [ 94.545978][ T5312] ? __pfx_generic_perform_write+0x10/0x10 [ 94.545988][ T5312] ? file_update_time_flags+0x1e0/0x440 [ 94.546000][ T5312] ? __generic_file_write_iter+0xf9/0x230 [ 94.546009][ T5312] ? generic_file_write_iter+0x9a/0x330 [ 94.546019][ T5312] generic_file_write_iter+0xae/0x330 [ 94.546027][ T5312] aio_write+0x5d0/0x870 [ 94.546039][ T5312] ? __pfx_aio_write+0x10/0x10 [ 94.546053][ T5312] ? __might_fault+0xaf/0x130 [ 94.546070][ T5312] io_submit_one+0x798/0x13d0 [ 94.546081][ T5312] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.546091][ T5312] ? irqentry_exit+0x218/0x910 [ 94.546103][ T5312] ? __pfx_io_submit_one+0x10/0x10 [ 94.546114][ T5312] ? __might_fault+0xaf/0x130 [ 94.546129][ T5312] ? __might_fault+0xaf/0x130 [ 94.546143][ T5312] __se_sys_io_submit+0x195/0x340 [ 94.546153][ T5312] ? __pfx___se_sys_io_submit+0x10/0x10 [ 94.546166][ T5312] do_syscall_64+0x166/0x520 [ 94.546178][ T5312] ? trace_irq_disable+0x3b/0x140 [ 94.546192][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.546201][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 94.546212][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.546223][ T5312] RIP: 0033:0x7f85a039e0d9 [ 94.546235][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.546244][ T5312] RSP: 002b:00007f85a1195fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 94.546256][ T5312] RAX: ffffffffffffffda RBX: 00007f85a0625fa0 RCX: 00007f85a039e0d9 [ 94.546263][ T5312] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f85a116d000 [ 94.546270][ T5312] RBP: 00007f85a0435024 R08: 0000000000000000 R09: 0000000000000000 [ 94.546276][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.546282][ T5312] R13: 00007f85a0626038 R14: 00007f85a0625fa0 R15: 00007ffe9cdbadb8 [ 94.546292][ T5312]