program: r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000001480)={0xe}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040), 0x208e24b) setns(0xc9, 0x0) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) write(r2, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value={r4, 0xfa}, 0x8) execve(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00') fchdir(r5) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000200)={'vxcan1\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000100)={0x1d, r7, 0x3}, 0x18) sendmsg$can_j1939(r6, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, 0x0, 0x0, {0x0, 0x1ec}}, 0x18, &(0x7f00000004c0)={&(0x7f0000000040)="19", 0x1}}, 0x0) [ 94.158316][ T4637] Bluetooth: hci0: command tx timeout [ 94.306008][ T5311] loop0: detected capacity change from 0 to 64 [ 94.322449][ T5311] ======================================================= [ 94.322449][ T5311] WARNING: The mand mount option has been deprecated and [ 94.322449][ T5311] and is ignored by this kernel. Remove the mand [ 94.322449][ T5311] option from the mount to silence this warning. [ 94.322449][ T5311] ======================================================= [ 95.053934][ T5311] hfs: request for non-existent node 8 in B*Tree [ 95.057620][ T5311] hfs: request for non-existent node 8 in B*Tree [ 95.126465][ T5311] [ 95.127560][ T5311] ====================================================== [ 95.130339][ T5311] WARNING: possible circular locking dependency detected [ 95.133204][ T5311] syzkaller #0 Not tainted [ 95.135042][ T5311] ------------------------------------------------------ [ 95.137855][ T5311] syz.0.0/5311 is trying to acquire lock: [ 95.140208][ T5311] ffff88803d9940a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.144087][ T5311] [ 95.144087][ T5311] but task is already holding lock: [ 95.147105][ T5311] ffff888052c2ba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.151610][ T5311] [ 95.151610][ T5311] which lock already depends on the new lock. [ 95.151610][ T5311] [ 95.155981][ T5311] [ 95.155981][ T5311] the existing dependency chain (in reverse order) is: [ 95.159928][ T5311] [ 95.159928][ T5311] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 95.163907][ T5311] __mutex_lock+0x19d/0x1550 [ 95.166085][ T5311] hfs_extend_file+0xf9/0x1680 [ 95.168385][ T5311] hfs_bmap_reserve+0x108/0x430 [ 95.170450][ T5311] __hfs_ext_write_extent+0x1fc/0x470 [ 95.172658][ T5311] __hfs_ext_cache_extent+0x6e/0x9b0 [ 95.174940][ T5311] hfs_extend_file+0x3ad/0x1680 [ 95.177009][ T5311] hfs_get_block+0x401/0xbf0 [ 95.178919][ T5311] __block_write_begin_int+0x6c2/0x1900 [ 95.181268][ T5311] cont_write_begin+0x71b/0xac0 [ 95.183349][ T5311] hfs_write_begin+0x123/0x1c0 [ 95.185557][ T5311] generic_perform_write+0x2d5/0x8f0 [ 95.188069][ T5311] generic_file_write_iter+0xae/0x330 [ 95.190476][ T5311] vfs_write+0x612/0xba0 [ 95.192290][ T5311] ksys_write+0x150/0x270 [ 95.194134][ T5311] do_syscall_64+0x166/0x520 [ 95.196111][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.198512][ T5311] [ 95.198512][ T5311] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 95.201550][ T5311] __lock_acquire+0x1520/0x2cf0 [ 95.203665][ T5311] lock_acquire+0x106/0x350 [ 95.205638][ T5311] __mutex_lock+0x19d/0x1550 [ 95.207653][ T5311] hfs_find_init+0x18d/0x300 [ 95.209738][ T5311] hfs_extend_file+0x367/0x1680 [ 95.211825][ T5311] hfs_bmap_reserve+0x108/0x430 [ 95.214163][ T5311] hfs_cat_create+0x23d/0x870 [ 95.216737][ T5311] hfs_create+0x78/0xe0 [ 95.218889][ T5311] lookup_open+0xc0d/0x1a40 [ 95.221190][ T5311] path_openat+0x677/0x1d60 [ 95.223606][ T5311] do_file_open+0x23e/0x4a0 [ 95.225985][ T5311] do_sys_openat2+0x115/0x200 [ 95.228535][ T5311] __x64_sys_openat+0x138/0x170 [ 95.230993][ T5311] do_syscall_64+0x166/0x520 [ 95.233746][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.236900][ T5311] [ 95.236900][ T5311] other info that might help us debug this: [ 95.236900][ T5311] [ 95.241385][ T5311] Possible unsafe locking scenario: [ 95.241385][ T5311] [ 95.244318][ T5311] CPU0 CPU1 [ 95.246388][ T5311] ---- ---- [ 95.248942][ T5311] lock(&HFS_I(tree->inode)->extents_lock); [ 95.251926][ T5311] lock(&tree->tree_lock/1); [ 95.255738][ T5311] lock(&HFS_I(tree->inode)->extents_lock); [ 95.259441][ T5311] lock(&tree->tree_lock/1); [ 95.261377][ T5311] [ 95.261377][ T5311] *** DEADLOCK *** [ 95.261377][ T5311] [ 95.264546][ T5311] locks held by syz.0.0/5311: 4, last CPU#0: [ 95.266700][ T5311] #0: ffff88803af96460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.270161][ T5311] #1: ffff888052c2b600 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: lookup_open+0x242/0x1a40 [ 95.274076][ T5311] #2: ffff88803eda80a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.277645][ T5311] #3: ffff888052c2ba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.282704][ T5311] [ 95.282704][ T5311] stack backtrace: [ 95.285203][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.285221][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.285229][ T5311] Call Trace: [ 95.285238][ T5311] [ 95.285245][ T5311] dump_stack_lvl+0xe8/0x150 [ 95.285269][ T5311] print_circular_bug+0x2e1/0x300 [ 95.285285][ T5311] check_noncircular+0x12e/0x150 [ 95.285299][ T5311] __lock_acquire+0x1520/0x2cf0 [ 95.285320][ T5311] ? stack_depot_save_flags+0x404/0x7f0 [ 95.285388][ T5311] ? __kmalloc_noprof+0x1af/0x720 [ 95.285405][ T5311] ? kasan_save_track+0x4f/0x80 [ 95.285420][ T5311] ? kasan_save_track+0x3e/0x80 [ 95.285434][ T5311] ? __kasan_kmalloc+0x93/0xb0 [ 95.285448][ T5311] ? __kmalloc_noprof+0x379/0x720 [ 95.285458][ T5311] ? hfs_find_init+0x9d/0x300 [ 95.285470][ T5311] ? hfs_extend_file+0x367/0x1680 [ 95.285478][ T5311] ? hfs_bmap_reserve+0x108/0x430 [ 95.285491][ T5311] ? hfs_cat_create+0x23d/0x870 [ 95.285505][ T5311] ? hfs_create+0x78/0xe0 [ 95.285513][ T5311] ? lookup_open+0xc0d/0x1a40 [ 95.285524][ T5311] ? hfs_find_init+0x18d/0x300 [ 95.285535][ T5311] lock_acquire+0x106/0x350 [ 95.285549][ T5311] ? hfs_find_init+0x18d/0x300 [ 95.285564][ T5311] __mutex_lock+0x19d/0x1550 [ 95.285578][ T5311] ? hfs_find_init+0x18d/0x300 [ 95.285601][ T5311] ? hfs_find_init+0x18d/0x300 [ 95.285616][ T5311] ? __pfx___mutex_lock+0x10/0x10 [ 95.285641][ T5311] ? trace_kmalloc+0x2a/0xf0 [ 95.285654][ T5311] ? __kmalloc_noprof+0x39a/0x720 [ 95.285667][ T5311] ? __kmalloc_noprof+0x1af/0x720 [ 95.285679][ T5311] ? hfs_find_init+0x9d/0x300 [ 95.285700][ T5311] hfs_find_init+0x18d/0x300 [ 95.285716][ T5311] hfs_extend_file+0x367/0x1680 [ 95.285725][ T5311] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.285737][ T5311] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.285796][ T5311] ? __mutex_lock+0x30b/0x1550 [ 95.285813][ T5311] ? hfs_find_init+0x18d/0x300 [ 95.285829][ T5311] ? __pfx___mutex_lock+0x10/0x10 [ 95.285879][ T5311] ? trace_kmalloc+0x2a/0xf0 [ 95.285892][ T5311] hfs_bmap_reserve+0x108/0x430 [ 95.285917][ T5311] hfs_cat_create+0x23d/0x870 [ 95.285934][ T5311] ? __pfx_hfs_cat_create+0x10/0x10 [ 95.285952][ T5311] ? _raw_spin_unlock+0x28/0x50 [ 95.285961][ T5311] ? hfs_new_inode+0x8e8/0xc50 [ 95.285972][ T5311] hfs_create+0x78/0xe0 [ 95.285981][ T5311] lookup_open+0xc0d/0x1a40 [ 95.285999][ T5311] path_openat+0x677/0x1d60 [ 95.286019][ T5311] do_file_open+0x23e/0x4a0 [ 95.286034][ T5311] ? __pfx_do_file_open+0x10/0x10 [ 95.286048][ T5311] ? _raw_spin_unlock+0x28/0x50 [ 95.286057][ T5311] ? alloc_fd+0x651/0x6c0 [ 95.286073][ T5311] do_sys_openat2+0x115/0x200 [ 95.286085][ T5311] ? __se_sys_futex+0x3a8/0x450 [ 95.286096][ T5311] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.286113][ T5311] ? rcu_is_watching+0x16/0xb0 [ 95.286127][ T5311] __x64_sys_openat+0x138/0x170 [ 95.286139][ T5311] do_syscall_64+0x166/0x520 [ 95.286151][ T5311] ? trace_irq_disable+0x3b/0x140 [ 95.286163][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.286173][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 95.286183][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.286194][ T5311] RIP: 0033:0x7f23fa99e0d9 [ 95.286205][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.286214][ T5311] RSP: 002b:00007f23fb8b7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 95.286227][ T5311] RAX: ffffffffffffffda RBX: 00007f23fac25fa0 RCX: 00007f23fa99e0d9 [ 95.286239][ T5311] RDX: 000000000000275a RSI: 0000200000000200 RDI: ffffffffffffff9c [ 95.286249][ T5311] RBP: 00007f23faa35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.286258][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.286266][ T5311] R13: 00007f23fac26038 R14: 00007f23fac25fa0 R15: 00007fff9f4efd08 [ 95.286277][ T5311] [ 95.478871][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.478871][ T74] loop0: rw=8388609, sector=4169, nr_sectors = 1 limit=64 [ 95.485372][ T74] Buffer I/O error on dev loop0, logical block 4169, lost async page write [ 95.489098][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.489098][ T74] loop0: rw=8388609, sector=4170, nr_sectors = 1 limit=64 [ 95.495307][ T74] Buffer I/O error on dev loop0, logical block 4170, lost async page write [ 95.499367][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.499367][ T74] loop0: rw=8388609, sector=4172, nr_sectors = 1 limit=64 [ 95.505334][ T74] Buffer I/O error on dev loop0, logical block 4172, lost async page write [ 95.508989][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.508989][ T74] loop0: rw=8388609, sector=4173, nr_sectors = 1 limit=64 [ 95.515234][ T74] Buffer I/O error on dev loop0, logical block 4173, lost async page write [ 95.519135][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.519135][ T74] loop0: rw=8388609, sector=4174, nr_sectors = 1 limit=64 [ 95.524992][ T74] Buffer I/O error on dev loop0, logical block 4174, lost async page write [ 95.528737][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.528737][ T74] loop0: rw=8388609, sector=4175, nr_sectors = 1 limit=64 [ 95.534811][ T74] Buffer I/O error on dev loop0, logical block 4175, lost async page write [ 95.538608][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.538608][ T74] loop0: rw=8388609, sector=4176, nr_sectors = 1 limit=64 [ 95.550920][ T74] Buffer I/O error on dev loop0, logical block 4176, lost async page write [ 95.555492][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.555492][ T74] loop0: rw=8388609, sector=4177, nr_sectors = 1 limit=64 [ 95.562785][ T74] Buffer I/O error on dev loop0, logical block 4177, lost async page write [ 95.567941][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.567941][ T74] loop0: rw=1, sector=4178, nr_sectors = 16 limit=64 [ 95.588280][ T74] kworker/u4:5: attempt to access beyond end of device [ 95.588280][ T74] loop0: rw=8388609, sector=4196, nr_sectors = 1 limit=64 [ 95.608949][ T74] Buffer I/O error on dev loop0, logical block 4196, lost async page write [ 95.615051][ T74] Buffer I/O error on dev loop0, logical block 4197, lost async page write