program: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="18030000000000000000000000000000851000000600000018000000000000000000000000000000950000000000000065f8a0ae86e2ff47f3856a133a4dace600b10118fbe988f21763080d0cb1652f89cdc211097e49713720472fb13b9cbc216385929f94c0b1d2260edb291a11167b2c3ad585ae9cbe4c04d79f0e68e7906b917bbaa1acaee0d3eff94c57a8191b93a98664bf12a743d47324f0ae50633c0c352b7730962c66a6dd647f3567f57c61399ea9c7fa5c3e03c8"], 0x0}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) syz_mount_image$hfs(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d472968786c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc107102000000dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000f3069fe8", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32b, &(0x7f0000000800)="$eJzs3U1rE0EYB/D/TJJma2PdvojgsVrQi2i9iJeI5CsI4kG0bYRiqKgV1IupeBLRu3e/gh/Ci+IX0JMH8Sq0F0dmdnazL7MvaRvX6v8H4mZ2J/tMZjbzTFAGRPTfutr78u7iN/1HAA00gJeXAQnAA5oAjuOE92hza2Nr0F8veqOGqYFdBYGgpshcs7bZN39vJ4t1PVPD8vWrJjrxMpoMpdSVr6my77KmYKg25ul3kEDbPp3mvPfHIyu2XeUix3geTiCWw0TsYAePMVt3HEREVC89/28HM6We5zs2f5cSWI7P+n/b/F/N0UzJz1rimLCp+AtVeGls/jerLCV0vx8zp0brPbOE0+dluEqsEkbLFZZMJZjCvaocLflMLHL6zsagf27t3mBd4jm6VqzCYrrheoSWRLvkWJsWqNB24cwog7BkS7dhJSf+hT3esUAm3U10iPggPombwsdbrEf5X1MJHa0J2E/1VBD/+fz7zZha+irYr41utyvNG4XmzE1OJnsqv5VmFHjuFQnCD3YOyR8I/LI4Ta35VK2gdRecFdpRrQVnrZXwVc69FhO1dGui0Zwf5cFQz/LOiNfiuljCD7xHL5b/Sx3fMrJPZqwTRk+NsJOC+cSD9ky5b9c07+lnZo4hbnSSJdGn2M4LfVcJ/iS0T2EfvsIqLmH24ZOndxuDQf+BPrjtOLjfiUpaLwDnNTUfYDgqaUMZmYvD78BE9WlbOMZNG2MEdvZAW6ofxNKL9VOWPhW2MiyRjmvGPoiPhPCBPbA+hax/aBWNjd7H1EAqPVCNas+OajtHuF/e7zmnfqk9tD2bL9O/adTpdUdCNdHTgQjWfyaTt/m+ydd0tnCtnb8aCReZrpTNJI72HZXOsaMVkJeoP2+OjiTT6JIV0IzNYxzruCEyay4992fWXKfOAKer39G3cR4O+em/JXr4jFv8/Z+IiIiIiIiIiIiIiIiIiIiIiIiI6LAZ/39HTI9Zq8V/WU5EREREREREREREREREREREREREREREtE/R/r8I9/9Ftf1/09tL2f1/PZTs/7uajSGz/++bTYghwP1/iSbrdwAAAP//kWVv8w==") prlimit64(0x0, 0xe, &(0x7f0000000b40)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000b80)=0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r1, &(0x7f0000000c00)={0x18}, 0xfffffdef) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000c40)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x6}}, 0x20) ioctl$sock_SIOCSIFBR(r0, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r2 = socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200), 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r1) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x78, r5, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x188}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr=' \x01\x00'}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x456f}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xb}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x10000}, 0x100080c1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{}, &(0x7f0000000240), &(0x7f0000000280)}, 0x20) lseek(0xffffffffffffffff, 0x6, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000001c00)=@raw={'raw\x00', 0x3c1, 0x3, 0x360, 0x1c0, 0x12, 0x60d, 0x1c0, 0x202, 0x290, 0x2e8, 0x2e8, 0x290, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "000000000000000617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x2}}, @common=@inet=@socket2={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) [ 102.944688][ T4646] Bluetooth: hci0: command tx timeout [ 103.011533][ T5327] loop0: detected capacity change from 0 to 64 [ 103.959907][ T5327] syz.0.0: attempt to access beyond end of device [ 103.959907][ T5327] loop0: rw=8388608, sector=25903, nr_sectors = 1 limit=64 [ 103.959972][ T5327] Buffer I/O error on dev loop0, logical block 25903, async page read [ 103.960003][ T5327] syz.0.0: attempt to access beyond end of device [ 103.960003][ T5327] loop0: rw=8388608, sector=26319, nr_sectors = 1 limit=64 [ 103.960016][ T5327] Buffer I/O error on dev loop0, logical block 26319, async page read [ 103.960030][ T5327] syz.0.0: attempt to access beyond end of device [ 103.960030][ T5327] loop0: rw=8388608, sector=26320, nr_sectors = 1 limit=64 [ 103.960043][ T5327] Buffer I/O error on dev loop0, logical block 26320, async page read [ 104.059015][ T1025] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 104.059036][ T1025] ata1: failed to read log page 10h (errno=-5) [ 104.059051][ T1025] ata1.00: exception Emask 0x1 SAct 0x18000000 SErr 0x0 action 0x0 [ 104.059092][ T1025] ata1.00: irq_stat 0x41000000 [ 104.059105][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED [ 104.059112][ T1025] ata1.00: cmd 61/20:d8:0e:19:08/0c:00:00:00:00/40 tag 27 ncq dma 1589248 ou [ 104.059112][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 104.059141][ T1025] ata1.00: status: { DRDY } [ 104.059151][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED [ 104.059158][ T1025] ata1.00: cmd 61/50:e0:16:05:10/00:00:00:00:00/40 tag 28 ncq dma 40960 out [ 104.059158][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 104.059193][ T1025] ata1.00: status: { DRDY } [ 104.300099][ T5327] xt_NFQUEUE: number of total queues is 0 [ 104.304035][ T1025] ata1.00: configured for UDMA/100 [ 104.304586][ T1025] ata1: EH complete [ 104.444385][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444385][ T14] loop0: rw=8388609, sector=161, nr_sectors = 1 limit=64 [ 104.444404][ T14] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 104.444419][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444419][ T14] loop0: rw=8388609, sector=162, nr_sectors = 1 limit=64 [ 104.444427][ T14] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 104.444434][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444434][ T14] loop0: rw=8388609, sector=163, nr_sectors = 1 limit=64 [ 104.444441][ T14] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 104.444456][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444456][ T14] loop0: rw=8388609, sector=167, nr_sectors = 1 limit=64 [ 104.444463][ T14] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 104.444470][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444470][ T14] loop0: rw=8388609, sector=169, nr_sectors = 1 limit=64 [ 104.444478][ T14] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 104.444484][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444484][ T14] loop0: rw=8388609, sector=171, nr_sectors = 1 limit=64 [ 104.444492][ T14] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 104.444498][ T14] kworker/u4:1: attempt to access beyond end of device [ 104.444498][ T14] loop0: rw=8388609, sector=172, nr_sectors = 1 limit=64 [ 104.444506][ T14] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 104.504587][ T14] [ 104.571797][ T14] ============================================ [ 104.574451][ T14] WARNING: possible recursive locking detected [ 104.577117][ T14] syzkaller #0 Not tainted [ 104.579170][ T14] -------------------------------------------- [ 104.581938][ T14] kworker/u4:1/14 is trying to acquire lock: [ 104.584634][ T14] ffff888013f580a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.589026][ T14] [ 104.589026][ T14] but task is already holding lock: [ 104.592282][ T14] ffff888013f580a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.596348][ T14] [ 104.596348][ T14] other info that might help us debug this: [ 104.599883][ T14] Possible unsafe locking scenario: [ 104.599883][ T14] [ 104.603269][ T14] CPU0 [ 104.604882][ T14] ---- [ 104.606693][ T14] lock(&tree->tree_lock/1); [ 104.609334][ T14] lock(&tree->tree_lock/1); [ 104.611536][ T14] [ 104.611536][ T14] *** DEADLOCK *** [ 104.611536][ T14] [ 104.615146][ T14] May be due to missing lock nesting notation [ 104.615146][ T14] [ 104.618861][ T14] locks held by kworker/u4:1/14: 5, last CPU#0: [ 104.621538][ T14] #0: ffff88801cfcd940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.628298][ T14] #1: ffffc9000027fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.633908][ T14] #2: ffff888013f5c0e8 (&type->s_umount_key#54){.+.+}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 104.638300][ T14] #3: ffff888013f580a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.642356][ T14] #4: ffff88805415c0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.646702][ T14] [ 104.646702][ T14] stack backtrace: [ 104.649353][ T14] CPU: 0 UID: 0 PID: 14 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 104.653443][ T14] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.657809][ T14] Workqueue: writeback wb_workfn (flush-7:0) [ 104.660419][ T14] Call Trace: [ 104.661918][ T14] [ 104.663202][ T14] dump_stack_lvl+0xe8/0x150 [ 104.665284][ T14] print_deadlock_bug+0x27a/0x290 [ 104.667564][ T14] __lock_acquire+0x25db/0x2de0 [ 104.669845][ T14] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.672534][ T14] ? stack_depot_save_flags+0x404/0x7f0 [ 104.675067][ T14] ? kasan_save_track+0x4f/0x80 [ 104.677127][ T14] ? kasan_save_track+0x3e/0x80 [ 104.679238][ T14] ? __kasan_kmalloc+0x93/0xb0 [ 104.681214][ T14] ? __kmalloc_noprof+0x36b/0x720 [ 104.683234][ T14] ? hfs_find_init+0x9d/0x300 [ 104.685153][ T14] ? hfs_extend_file+0x367/0x1680 [ 104.687343][ T14] ? hfs_bmap_reserve+0x108/0x430 [ 104.689481][ T14] ? __hfs_ext_write_extent+0x1fc/0x470 [ 104.692163][ T14] lock_acquire+0x115/0x350 [ 104.694180][ T14] ? hfs_find_init+0x18d/0x300 [ 104.696289][ T14] __mutex_lock+0x19c/0x15a0 [ 104.698371][ T14] ? hfs_find_init+0x18d/0x300 [ 104.700588][ T14] ? hfs_find_init+0x18d/0x300 [ 104.703652][ T14] ? __pfx___mutex_lock+0x10/0x10 [ 104.706359][ T14] ? rcu_is_watching+0x16/0xb0 [ 104.708708][ T14] ? trace_kmalloc+0x2a/0xf0 [ 104.710898][ T14] ? __kmalloc_noprof+0x38c/0x720 [ 104.713721][ T14] ? __kmalloc_noprof+0x1ab/0x720 [ 104.716527][ T14] ? hfs_find_init+0x9d/0x300 [ 104.718932][ T14] hfs_find_init+0x18d/0x300 [ 104.721175][ T14] hfs_extend_file+0x367/0x1680 [ 104.723438][ T14] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.725867][ T14] ? _raw_spin_unlock+0x28/0x50 [ 104.728150][ T14] ? hfs_brec_find+0x3db/0x510 [ 104.730350][ T14] hfs_bmap_reserve+0x108/0x430 [ 104.732381][ T14] __hfs_ext_write_extent+0x1fc/0x470 [ 104.734673][ T14] hfs_ext_write_extent+0x17d/0x210 [ 104.736877][ T14] ? __pfx___mpage_writepages+0x10/0x10 [ 104.739258][ T14] ? __pfx_hfs_ext_write_extent+0x10/0x10 [ 104.741738][ T14] hfs_write_inode+0x117/0xa00 [ 104.743820][ T14] ? __pfx_hfs_write_inode+0x10/0x10 [ 104.746169][ T14] ? do_raw_spin_unlock+0x4d/0x200 [ 104.748515][ T14] __writeback_single_inode+0x69d/0x1220 [ 104.751045][ T14] writeback_sb_inodes+0x9de/0x1b00 [ 104.753819][ T14] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 104.756316][ T14] ? irqentry_exit+0x2a0/0x9b0 [ 104.758443][ T14] ? __pfx_down_read_trylock+0x10/0x10 [ 104.760832][ T14] ? __pfx___up_read+0x10/0x10 [ 104.762951][ T14] __writeback_inodes_wb+0x114/0x240 [ 104.765251][ T14] wb_writeback+0x42f/0xad0 [ 104.767231][ T14] ? queue_io+0x2b1/0x470 [ 104.769125][ T14] ? __pfx_wb_writeback+0x10/0x10 [ 104.771292][ T14] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.773477][ T14] wb_workfn+0x980/0x10f0 [ 104.775390][ T14] ? __pfx_wb_workfn+0x10/0x10 [ 104.777504][ T14] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.779668][ T14] ? lock_acquire+0x115/0x350 [ 104.781651][ T14] ? rcu_is_watching+0x16/0xb0 [ 104.783764][ T14] ? process_scheduled_works+0x97a/0x1630 [ 104.786227][ T14] process_scheduled_works+0xc3d/0x1630 [ 104.788684][ T14] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.791299][ T14] ? assign_work+0x3cf/0x5d0 [ 104.793168][ T14] worker_thread+0xa47/0xfb0 [ 104.795159][ T14] kthread+0x38b/0x480 [ 104.796951][ T14] ? __pfx_worker_thread+0x10/0x10 [ 104.799295][ T14] ? __pfx_kthread+0x10/0x10 [ 104.801238][ T14] ret_from_fork+0x514/0xb70 [ 104.803030][ T14] ? __pfx_ret_from_fork+0x10/0x10 [ 104.805197][ T14] ? __switch_to+0xc89/0x1420 [ 104.807237][ T14] ? __pfx_kthread+0x10/0x10 [ 104.809450][ T14] ret_from_fork_asm+0x1a/0x30 [ 104.811675][ T14]