program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2d1, &(0x7f0000000280)="$eJzs3b9u01AUx/HfddI2pVVxaRESY6ESLAjKgliCUCaegAkBTZAqoiKgiD9TQUwIwc7GwCvwECwgXgAmJh6gTEb32o6T2I7dqI0b+H6kRnbia58bX9vnRKquAPy3rrd+fLr8y/4Zqaaa9Oaq5ElqSHVJJ3Wq8WR7Z2un22mP2lHNtbB/RmFLk9pmc7uT1dS2cy0ivl2ra7H/vdDCeJ1EriAIrv2sOghUzl39GTxpTrPJemOCMZXxcsx2uwccx7Qxe9rTMy1VHQcAoFrR898LM3ktRvm750nr0WPf5QdH7fk/rr2qAzh0wchP+57/rsoKjD2/x91HSb3nSjj7uRdXiWWOPDO07tJHbyjBNEVVpYvFm7+31e1c2HzQbXt6pWakb7NV99oOh26sINq1jNp0hBJ9N9kZpatXvRnbh40w/qeSBuJfGfOIKWWvTPPFfDO3jK8Pavfyv3pg7GlyZ8ofOlNh/Bfz9+h66dutFN02ms2mN7DJsjvIafWXEkW9bGRXJIpH1LIGfyDwi+J0rU4MtQp7d6mg1Upmq414LafV6kAr25veaM4/3mEz78xNs6bf+qxWX/7v2fjWNfLKTK4asx4OOPeNh/2ZzT5c3e3TT43P9OXS+xbn8kL/M3xPu/ExGH2bQ563uqsrWnr8/MX9WrfbeWQX7mQsPFzsvTPzWsrcpuIF7SbvzClwUhvHD6VJBnb+QHdo7x+FG9ur7EiclH96ofX1sAbSfDRMq+9phfcmTExy0quOBBWxeZcJ67+kXqmHyZ598TPz9JLlRrTHwObYvQouaRuEGbmkY/uq4BbyK7h0zZWqGV3NdeacdLb8Ef0ozmlm+hL4lr7rNr//AwAAAAAAAAAAAAAAAAAATJtJ/DtB1X0EAAAAAAAAAAAAAAAAAAAAAGDa9eb/VTz/r8rN/zs878pBzv/7flvZ8//GcuaaAbAvfwMAAP//QTZ8Yw==") sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x8) ftruncate(r0, 0x2007ffc) syz_mount_image$udf(&(0x7f0000000180), &(0x7f0000000100)='./bus\x00', 0x1014494, &(0x7f00000001c0)=ANY=[@ANYBLOB="696f636861727365743d63703933322c706172746974696f6e3d30303030303030303030303030303030303030332c6769643d666f726765742c6769643d666f726765742c6e6f6164696e6963622c756e64656c6574652c7569643d666f726765742c00fb5ebc1bbec00aea8217b7375ace1f91cad4e856ac3ce827902dd91a9a936650ca99205dc1adee73bc464ab6ea2dad7091eea47594f5ef5227a72684b2ed98640aa52eba3e04c81c829036f312ecb1c7483575d32ed9eef652c6b7284dc45cecea6a0ae3a01c5cd7b60af90431eddc00"/225], 0xfe, 0xc24, &(0x7f0000001480)="$eJzs3UFsHNd9B+D/Gy5Fym4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIRtrQvfTQQ4Ci6CEnAq1RIEUDoymCHtnWBZKLD0VOPREtbARFD2wRIKeAxcy+lZY0ZcmmSFH299nUbznz3ux7b5YzkqA3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAiN976cKpZ9ODbgUAcJAuTX311Gn3fwD4RLnsz/8AAAAAAAAAAAAAAHDYpSjisUixeGkzzVTfdw1fbHdu3Jwen9i92tFU1Ryoypdfw8+ePnP2S8+NnevlB9e/356IV6YuX6i/uHB9cam1vNyaq0932rMLc617PsJe6+80Wg1A/fqrN+auXl2un37mzLbdN0feG3r0+Mj5sadOPtkrOz0+MTHVV6Y2+JHf/X3uNMPjSBRxMlI8/b2fpGZEFLH3sbjLZ2e/Ha06MVp1Ynp8ourIfLvZWSl3TvYGooio91Vq9MboAM7FnjQiVsvmlw0eLbs3tdhcal6Zb9Unm0sr7ZX2QmcydVtb9qceRZxLEWsRsTH0/sMNRhG1SPGdY5vpSkQM9Mbhi9XE4Du3o9jHPt6Dsp31wYi14iE4Z4fYUBTxcqT46dtFzJZjlr/iCxEvl/mDiDfLfCEilR+MsxHv7vI54uFUiyL+vDz/5zfTXHU96F1XLn6t/pXO1YW+sr3rykN/fzhIh/zaNBxFNKsr/mb66L/ZAQAAAAAAAAAAAAAAAOB+OxpFPBEpXvr3P6rmFUc1L/3Y+bHfH/nF/jnjj9/lOGXZZyJitbi3OblH8hTiyTSZ0gOeS/xJNhxF/HGe//fGg24MAAAAAAAAAAAAAAAAAADAJ9yPI8Xz75xIa9G/pni7c61+uXllvrsqbG/t396a6VtbW1v11M1GzpmcqznXcq7n3MgZRa6fs5FzJudqzrWc6zk3csZArp+zkXMm52rOtZzrOTdyRi3Xz9nIOZNzNedazvWcGznjkKzdCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwcVJEET+PFN/+xmaKFBGNiJno5vpQrwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8CANpSK+Hynqf9C4ta0WEan6v+tE+cvZaBwp89PRGCvzhWhcyNmsstZ44wG0n70ZTEX8KFIMDb9164Tn8z/Y/e7WxyDe/Obt736l1s2B3s6R94YePX7s/NjErz1+p9dptwaMXmx3btysT49PTEz1ba7ld/9037aR/L7F/ek6EbH82uuvNufnW0ufmBdFHIpmPKgXte6LWhyS9hzUi3y9il12FYfhp6BxWAaq9+IBX5g4EOX9/91I8dvv/Efvht+7//9C97tbd/j42Z/cvv8/v/NA+3T/f6xv2/P5dyODtYjhleuLg8cjhpdfe/1k+3rzWutaq3P21Kkvj419+cypwSMRw1fb862+V3seKgAAAAAAAAAAAAAAAICDlYr43UjR/NFmqkfEzWq+1sj5sadOPjkQA9V8q23ztl6Zunyh/uLC9cWl1vJya64+3WnPLsy17vXthqvpXtPjE/vSmbs6us/tPzr84sLia0vta3+4suv+R4YvXFleWWrO7r47jkYR0ejfMlo1eHp8omr0fLvZqapO7jqZ7sMbTEX8Z6SYPVs/0tuW5//tnOG/bf7/6s4D7dP8v0/1bSvfM6UifhYpfusvHo/PV+18JN43Zrnc30SK0XOfy+XiSFmu14bucwW6MwPLsv8bKf7h59vL9uZDPna77LP3Oq4Pi/L8H4sU3/+z78av523bn/+w+/l/ZOeB9un8f6Zv2yPbnlew566Tz//JSPHCY2/Fb+RtH/T8jyK2tra+FXEiF771fI59Ov+f7ds2Et33/c37130AAAAAAAAAAICH1mAq4m8jxZMTtfRc3nYv//5vbueB9unff/1y37a5A1qvaM+DCgAAAACHxGAq4seR4trKW7fmUG+f/903//N3bq+9Pp527K3+nu+XqucG3M+//+s3kt93Zu/dBgAAAAAAAAAAAAAAAAAAgEMlpSKey+upz9xlPfX1SPHSfz+dy6XjZbneOvAj1a/DlxY6Jy/Mzy/MNleaV+Zb9anF5myrrPuZSLH515/LdYtqffXP57rdNd6Ht3prsS9Fiom/65XtrsXeW5u8ux54dy32suynIsV//f32sr11rD97u+zpsuxfRYqv/9PuZY/fLnumLPvdSPHDr9d7ZR8py/aej9p9JulwLeZbz8wuzL/vUagAAAAAAAAAAAAAAAAAAADwYQ2mIv40UvzP9bVYrab9v3FrV85ab8Ob3+xb73+Hm9U6/yPV+v93ev1R1v8fuS+9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh0uKIl6PFIuXNtP6UPl91/DFdufGzenxid2rHU1VzYGqfPk1/OzpM2e/9NzYuV5+cP377Yl4ZeryhfqLC9cXl1rLy625+nSnPbsw17rnI+y1/u2h6xqtBqB+/dUbc1evLtdPP3Nm2+6bI+8NPXp85PzYUyef7JWdHp+YmOorUxv8EO/+oRp325Eo4i8jxdPf+0n656GIIvY+Fnf57Oy3o1UnRqtOTI9PVB2Zbzc7K+XOyd5AFBH1vkqN3hgdwLnYk0bEatn8ssGjZfemFptLzSvzrfpkc2mlvdJe6EymbmvL/tSjiHMpYi0iNob6D3QkZxGvRorvHNtM/zIUMdAbhy9emvrqqdN3bkexr728i29V7awPRqwVD8E5O8SGooh/jBQ/fftE/OtQRC26X/GFiJfL/EHEm2W+EJHKD8bZiHeHHnSruV9qUcT/lef//GZ6eyii+pGprisXv1b/SufqQl/Z3nVl5/1hKyIeqvvDQTrk16bhKOKH1RV/M/2bn2sAAAAAAAAAAAAAAACAQ6SIX40Uz79zIlXzg2/NKW53rtUvN6/Md6f19eb+9eZMb21tbdVTNxs5Z3Ku5lzLuZ5zI2cUuX7ORs6ZnKs513Ku59zIGQO5fs5GzpmcqznXcq7n3MgZtVw/ZyPnTM7VnGs513Nu5IxDMncPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubaWuou770THRz3XqgH3v/HwAA//9wn/vk") open(&(0x7f0000000100)='./file0\x00', 0x880ff, 0x0) mknod$loop(&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x8, 0x0) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x220801, 0x3) r1 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r2 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b1889b90f105d66b3e5a7c94742"}, 0x4, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000000000)={0x8000, {"8604a0a71359a294b7585622d5b25618", "398e9cb8b9ef106c55992b65958724b1", "04641700"}, 0x2, 0x6}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000300)='.\x00', r3, &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') lstat(&(0x7f000001c480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000540), 0x44800, 0x0) syz_mount_image$minix(&(0x7f0000000300), &(0x7f0000000180)='./file2\x00', 0x4040, &(0x7f0000000000)=ANY=[], 0x1, 0x21d, &(0x7f00000006c0)="$eJzs209PE0EYx/HfdttS0Yhi/BNPJibGi60CCelJeQFePJp4ILWQxqJGvEBIlDfh3asnXwKJvg/fAD1489Qxszu1LN20O3XLhvL9JHQf2HlmngVmu9NuBeDCehY9BgpUiyJjzKd7kl4+l1QuuDgAM2Xctm+GwsE+AHMu7E+b+YrzBHCu9Tbss31NR4H06/dB69h91UauFNIXA72NUhwE0vGJ/Eue1yF3y8n8RUmXM9RgvgbR9oEG+bbyg9aVjOP2DuP8RSXH17Ws+fHxP7yvik7kX5W0JEXdXJe0LOmGtGDb3lRJpcT4VffdMP9O/IPDjIcBAAAAAMBYdvVZ/69sqT6xg1Bu6TvCroO3Ot32Y7+BB8tnVVz+E7/8f6ouf2VcIzM5fzW1utOCYViJNwsuv956133tUTeQh5Lf/B95WdD+Rx9N6CCeDsup+8KR+V/JXo17RXCr88UrB0Bsd2//zWa32/6QZ/B0XBvJt0N7Rsi5wvTgmw30J35nZMZjTRPYk+206YM3ZPIu7LMmtzEZ2sxTUM739/xDwel5Wk5Mou/ub+vR84u0XVUl5mlCeMYnJgAz1/i4876xu7f/qLOzud3ebr9dW28219dWV5qN6LLcPpqloqsEMAvDZ/+Unb438QAAAAAAAAAAAAAAgELcknQ7in72PdK4MwAAAAA4h87iQ1FFHyMAAAAAAAAAAAAAAPPubwAAAP//GgQs4g==") openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) chdir(0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x103042, 0x5d9f61795f7ff7f7) write$UHID_DESTROY(r4, 0x0, 0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) [ 85.444532][ T5328] loop0: detected capacity change from 0 to 64 [ 85.487367][ T5328] ======================================================= [ 85.487367][ T5328] WARNING: The mand mount option has been deprecated and [ 85.487367][ T5328] and is ignored by this kernel. Remove the mand [ 85.487367][ T5328] option from the mount to silence this warning. [ 85.487367][ T5328] ======================================================= [ 85.610087][ T24] audit: type=1800 audit(1779491989.834:2): pid=5328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 85.652083][ T5289] Bluetooth: hci0: command tx timeout [ 85.749529][ T5329] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 85.763573][ T5329] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 85.790190][ T5329] syz.0.0: attempt to access beyond end of device [ 85.790190][ T5329] loop0: rw=0, sector=2571, nr_sectors = 1 limit=64 [ 85.802103][ T5329] Buffer I/O error on dev loop0, logical block 2571, async page read [ 85.812259][ T5329] syz.0.0: attempt to access beyond end of device [ 85.812259][ T5329] loop0: rw=0, sector=2572, nr_sectors = 1 limit=64 [ 85.846430][ T5329] Buffer I/O error on dev loop0, logical block 2572, async page read [ 85.850263][ T5329] syz.0.0: attempt to access beyond end of device [ 85.850263][ T5329] loop0: rw=0, sector=2573, nr_sectors = 1 limit=64 [ 85.864830][ T5329] Buffer I/O error on dev loop0, logical block 2573, async page read [ 85.876309][ T5329] syz.0.0: attempt to access beyond end of device [ 85.876309][ T5329] loop0: rw=0, sector=2574, nr_sectors = 1 limit=64 [ 85.902272][ T5329] Buffer I/O error on dev loop0, logical block 2574, async page read [ 85.908596][ T5334] syz.0.0: attempt to access beyond end of device [ 85.908596][ T5334] loop0: rw=0, sector=2571, nr_sectors = 1 limit=64 [ 85.922710][ T5334] Buffer I/O error on dev loop0, logical block 2571, async page read [ 85.928463][ T5334] syz.0.0: attempt to access beyond end of device [ 85.928463][ T5334] loop0: rw=0, sector=2572, nr_sectors = 1 limit=64 [ 85.941111][ T5334] Buffer I/O error on dev loop0, logical block 2572, async page read [ 85.951291][ T5334] syz.0.0: attempt to access beyond end of device [ 85.951291][ T5334] loop0: rw=0, sector=2573, nr_sectors = 1 limit=64 [ 85.962108][ T5334] Buffer I/O error on dev loop0, logical block 2573, async page read [ 85.972915][ T5334] syz.0.0: attempt to access beyond end of device [ 85.972915][ T5334] loop0: rw=0, sector=2574, nr_sectors = 1 limit=64 [ 86.001512][ T5334] Buffer I/O error on dev loop0, logical block 2574, async page read [ 86.031537][ T5334] [ 86.032608][ T5334] ====================================================== [ 86.035491][ T5334] WARNING: possible circular locking dependency detected [ 86.038671][ T5334] syzkaller #0 Not tainted [ 86.040806][ T5334] ------------------------------------------------------ [ 86.044022][ T5334] syz.0.0/5334 is trying to acquire lock: [ 86.046616][ T5334] ffff8880392420a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 86.050966][ T5334] [ 86.050966][ T5334] but task is already holding lock: [ 86.054703][ T5334] ffff888043b880f0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 86.059879][ T5334] [ 86.059879][ T5334] which lock already depends on the new lock. [ 86.059879][ T5334] [ 86.064644][ T5334] [ 86.064644][ T5334] the existing dependency chain (in reverse order) is: [ 86.069198][ T5334] [ 86.069198][ T5334] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 86.074116][ T5334] __mutex_lock+0x1a3/0x1550 [ 86.076895][ T5334] hfs_extend_file+0xf2/0x15e0 [ 86.079346][ T5334] hfs_bmap_reserve+0x107/0x430 [ 86.081775][ T5334] __hfs_ext_write_extent+0x1fa/0x470 [ 86.084493][ T5334] __hfs_ext_cache_extent+0x6b/0x9b0 [ 86.086998][ T5334] hfs_extend_file+0x39b/0x15e0 [ 86.089420][ T5334] hfs_get_block+0x412/0xc50 [ 86.091839][ T5334] __block_write_begin_int+0x6c6/0x1910 [ 86.094810][ T5334] cont_write_begin+0x737/0xae0 [ 86.097278][ T5334] hfs_write_begin+0x66/0xb0 [ 86.099556][ T5334] cont_write_begin+0x2e7/0xae0 [ 86.102026][ T5334] hfs_write_begin+0x66/0xb0 [ 86.104367][ T5334] hfs_file_truncate+0x1cf/0xb70 [ 86.106882][ T5334] hfs_inode_setattr+0x4a9/0x670 [ 86.109566][ T5334] notify_change+0xc1a/0xf40 [ 86.111877][ T5334] do_truncate+0x1c2/0x250 [ 86.114217][ T5334] do_ftruncate+0x490/0x540 [ 86.116520][ T5334] __x64_sys_ftruncate+0x8f/0xe0 [ 86.118855][ T5334] do_syscall_64+0x15f/0xf80 [ 86.121291][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.124410][ T5334] [ 86.124410][ T5334] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 86.127906][ T5334] __lock_acquire+0x15a5/0x2cf0 [ 86.130246][ T5334] lock_acquire+0x106/0x350 [ 86.132532][ T5334] __mutex_lock+0x1a3/0x1550 [ 86.134805][ T5334] hfs_find_init+0x18e/0x300 [ 86.137054][ T5334] hfs_extend_file+0x35c/0x15e0 [ 86.139505][ T5334] hfs_bmap_reserve+0x107/0x430 [ 86.141843][ T5334] hfs_cat_create+0x20f/0x800 [ 86.144106][ T5334] hfs_create+0x75/0xe0 [ 86.146109][ T5334] path_openat+0x1395/0x3860 [ 86.148308][ T5334] do_file_open+0x23e/0x4a0 [ 86.150490][ T5334] do_sys_openat2+0x113/0x200 [ 86.152837][ T5334] __x64_sys_creat+0x8f/0xc0 [ 86.155167][ T5334] do_syscall_64+0x15f/0xf80 [ 86.157506][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.160404][ T5334] [ 86.160404][ T5334] other info that might help us debug this: [ 86.160404][ T5334] [ 86.164799][ T5334] Possible unsafe locking scenario: [ 86.164799][ T5334] [ 86.168037][ T5334] CPU0 CPU1 [ 86.170891][ T5334] ---- ---- [ 86.173430][ T5334] lock(&HFS_I(tree->inode)->extents_lock); [ 86.176812][ T5334] lock(&tree->tree_lock/1); [ 86.180285][ T5334] lock(&HFS_I(tree->inode)->extents_lock); [ 86.183999][ T5334] lock(&tree->tree_lock/1); [ 86.186060][ T5334] [ 86.186060][ T5334] *** DEADLOCK *** [ 86.186060][ T5334] [ 86.189500][ T5334] 4 locks held by syz.0.0/5334: [ 86.191671][ T5334] #0: ffff8880126ea410 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 86.195799][ T5334] #1: ffff888043bbfad0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0xb4c/0x3860 [ 86.200226][ T5334] #2: ffff88803acb00a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 86.204313][ T5334] #3: ffff888043b880f0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 86.209052][ T5334] [ 86.209052][ T5334] stack backtrace: [ 86.211551][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.211567][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.211574][ T5334] Call Trace: [ 86.211582][ T5334] [ 86.211588][ T5334] dump_stack_lvl+0xe8/0x150 [ 86.211639][ T5334] print_circular_bug+0x2e1/0x300 [ 86.211656][ T5334] check_noncircular+0x12e/0x150 [ 86.211674][ T5334] __lock_acquire+0x15a5/0x2cf0 [ 86.211688][ T5334] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 86.211705][ T5334] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 86.211720][ T5334] ? stack_depot_save_flags+0x3f3/0x810 [ 86.211783][ T5334] ? kasan_save_track+0x4f/0x80 [ 86.211797][ T5334] ? kasan_save_track+0x3e/0x80 [ 86.211811][ T5334] ? hfs_find_init+0x18e/0x300 [ 86.211827][ T5334] lock_acquire+0x106/0x350 [ 86.211839][ T5334] ? hfs_find_init+0x18e/0x300 [ 86.211856][ T5334] __mutex_lock+0x1a3/0x1550 [ 86.211871][ T5334] ? hfs_find_init+0x18e/0x300 [ 86.211887][ T5334] ? hfs_find_init+0x18e/0x300 [ 86.211900][ T5334] ? __pfx___mutex_lock+0x10/0x10 [ 86.211916][ T5334] ? rcu_is_watching+0x15/0xb0 [ 86.211931][ T5334] ? __kmalloc_noprof+0x37d/0x760 [ 86.211944][ T5334] ? kasan_save_track+0x4f/0x80 [ 86.211955][ T5334] ? hfs_find_init+0xaa/0x300 [ 86.211969][ T5334] ? __kmalloc_noprof+0x1b8/0x760 [ 86.211981][ T5334] hfs_find_init+0x18e/0x300 [ 86.211997][ T5334] hfs_extend_file+0x35c/0x15e0 [ 86.212010][ T5334] ? __pfx_hfs_extend_file+0x10/0x10 [ 86.212020][ T5334] ? __mutex_lock+0x319/0x1550 [ 86.212040][ T5334] ? hfs_find_init+0x18e/0x300 [ 86.212056][ T5334] ? __pfx___mutex_lock+0x10/0x10 [ 86.212071][ T5334] ? rcu_is_watching+0x15/0xb0 [ 86.212086][ T5334] hfs_bmap_reserve+0x107/0x430 [ 86.212106][ T5334] hfs_cat_create+0x20f/0x800 [ 86.212116][ T5334] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.212131][ T5334] ? __pfx_hfs_cat_create+0x10/0x10 [ 86.212145][ T5334] ? _raw_spin_unlock+0x28/0x50 [ 86.212158][ T5334] ? hfs_new_inode+0x92d/0xc70 [ 86.212172][ T5334] hfs_create+0x75/0xe0 [ 86.212183][ T5334] ? __pfx_hfs_create+0x10/0x10 [ 86.212193][ T5334] path_openat+0x1395/0x3860 [ 86.212212][ T5334] ? __pfx_path_openat+0x10/0x10 [ 86.212224][ T5334] ? __x64_sys_creat+0x8f/0xc0 [ 86.212238][ T5334] do_file_open+0x23e/0x4a0 [ 86.212251][ T5334] ? __pfx_do_file_open+0x10/0x10 [ 86.212279][ T5334] ? _raw_spin_unlock+0x28/0x50 [ 86.212294][ T5334] ? alloc_fd+0x64b/0x6c0 [ 86.212307][ T5334] do_sys_openat2+0x113/0x200 [ 86.212318][ T5334] ? __se_sys_futex+0x3a8/0x450 [ 86.212332][ T5334] ? __pfx_do_sys_openat2+0x10/0x10 [ 86.212345][ T5334] ? rcu_is_watching+0x15/0xb0 [ 86.212360][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.212373][ T5334] __x64_sys_creat+0x8f/0xc0 [ 86.212385][ T5334] do_syscall_64+0x15f/0xf80 [ 86.212402][ T5334] ? trace_irq_disable+0x3b/0x140 [ 86.212418][ T5334] ? clear_bhb_loop+0x40/0x90 [ 86.212430][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.212440][ T5334] RIP: 0033:0x7fb55d99ce59 [ 86.212452][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.212461][ T5334] RSP: 002b:00007fb559dd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 86.212475][ T5334] RAX: ffffffffffffffda RBX: 00007fb55dc16180 RCX: 00007fb55d99ce59 [ 86.212484][ T5334] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000380 [ 86.212491][ T5334] RBP: 00007fb55da32d6f R08: 0000000000000000 R09: 0000000000000000 [ 86.212499][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.212505][ T5334] R13: 00007fb55dc16218 R14: 00007fb55dc16180 R15: 00007ffc0c18e908 [ 86.212517][ T5334] [ 86.430677][ T5334] syz.0.0: attempt to access beyond end of device [ 86.430677][ T5334] loop0: rw=0, sector=2571, nr_sectors = 1 limit=64 [ 86.443656][ T5334] Buffer I/O error on dev loop0, logical block 2571, async page read [ 86.450732][ T5334] syz.0.0: attempt to access beyond end of device [ 86.450732][ T5334] loop0: rw=0, sector=2572, nr_sectors = 1 limit=64 [ 86.470070][ T5334] Buffer I/O error on dev loop0, logical block 2572, async page read [ 86.503350][ T24] audit: type=1800 audit(1779491990.734:3): pid=5329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=22 res=0 errno=0