program: syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x11d04b8, 0x0, 0x85, 0x0, 0x0) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) syz_mount_image$hfs(&(0x7f0000000040), &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x30008c0, &(0x7f0000000180)={[{}, {@codepage={'codepage', 0x3d, 'cp862'}}, {@iocharset={'iocharset', 0x3d, 'maccyrillic'}}, {}, {@part={'part', 0x3d, 0x5}}]}, 0x11, 0x2b6, &(0x7f0000000200)="$eJzs3U1rE0Ecx/HfbNI22lK3tiJ4rBb0Ilov4iUieRGeRG0iFENFrfhwquJJRO/efQu+CC+Kb0BPnnwB9bQys5Nskt3spqHJNvX7gYZNdmbnP9mHmX9ERgD+W7caPz9f+23/jFRRRXp3QwokmV1VJZ3R2dqznd3t3XarmXegilST+zOSq2lSZbZ2WllVbT1Xwwvtu6qWej/DZERRdPNX2UGgdO7uzxBIC/7udPtrU48s3+sx6+0dchyzxuxrXy+0XHYcAIBy+fE/8OP8kp+/B4G04Yf9Izn+j2u/7AAmLsrd2zP+uywrMvb8nnK7knzPpXB2f9DJEkdpeW7g/bziK6tvgmmKskoXS3DiwXa7dXnrUbsZ6I3qXk+xNffajC/djoJo1zNy0xwj9N1kzygXXR/mbB824/ifS+qLf3XMFsdmvprv5o4J9UnN7vyvGhl7mtyZCgfOVBz/leFHdL0MbSn5x0a9Xg/6iqy4Rs75FryCXtayMxJ1rqgV9f9AEBbF6WqdHqgV9+5qQa3VzFqbnXdDaq311bK96V7Nw9ubNPPB3Dbr+qMvavTM/wMb34Zy78zkrjEb8VDgvvG4P/PZzVXdMcPUyJG+Xbrf4sKw0P/mP9NwAO91X9e1/PTlq4eVdrv1xG7cy9h4vNT9ZO6tlFmm5A3tJZ8sKHJShTuD0jQDu3SoB7TPj8LC9i47EiflWG80vk33Qipjo+TnE6YiOellR4KSuH/si/O/JF+pxpM9+xJmztNH/CHAHzGyc+xuBpfUjeIZuaSTB8rgFodncOmcK5Uzupzr/EXpwugthj7OY8I09EN3+f0fAAAAAAAAAAAAAAAAAABg1kzjvxOU3UcAAAAAAAAAAAAAAAAAAAAAAGZdd/1fddb/lV//t6bc9X8Hl2I5zPV/P+6I9X+ByfsXAAD//9kdfSs=") mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@verity_on}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r1, &(0x7f00000000c0)={0x18}, 0xfffffdef) read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x9}}, './file2\x00'}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r3, 0xe) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="043e1f1b"], 0x22) read$FUSE(r2, &(0x7f0000003480)={0x2020}, 0x2020) getdents(r0, &(0x7f00000004c0)=""/250, 0xfa) [ 94.092009][ T5284] Bluetooth: hci0: command tx timeout [ 94.140766][ T5324] loop0: detected capacity change from 0 to 64 [ 94.152387][ T5324] ======================================================= [ 94.152387][ T5324] WARNING: The mand mount option has been deprecated and [ 94.152387][ T5324] and is ignored by this kernel. Remove the mand [ 94.152387][ T5324] option from the mount to silence this warning. [ 94.152387][ T5324] ======================================================= [ 94.394887][ T5330] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 94.399419][ T5330] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 94.425269][ T5330] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 94.814971][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.814971][ T68] loop0: rw=1, sector=4137, nr_sectors = 32 limit=64 [ 94.821954][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.821954][ T68] loop0: rw=8388609, sector=4169, nr_sectors = 1 limit=64 [ 94.842571][ T68] Buffer I/O error on dev loop0, logical block 4169, lost async page write [ 94.855972][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.855972][ T68] loop0: rw=8388609, sector=4170, nr_sectors = 1 limit=64 [ 94.874114][ T68] Buffer I/O error on dev loop0, logical block 4170, lost async page write [ 94.886156][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.886156][ T68] loop0: rw=8388609, sector=4172, nr_sectors = 1 limit=64 [ 94.903928][ T68] Buffer I/O error on dev loop0, logical block 4172, lost async page write [ 94.907731][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.907731][ T68] loop0: rw=8388609, sector=4173, nr_sectors = 1 limit=64 [ 94.923889][ T68] Buffer I/O error on dev loop0, logical block 4173, lost async page write [ 94.934263][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.934263][ T68] loop0: rw=8388609, sector=4174, nr_sectors = 1 limit=64 [ 94.944085][ T68] Buffer I/O error on dev loop0, logical block 4174, lost async page write [ 94.950207][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.950207][ T68] loop0: rw=8388609, sector=4175, nr_sectors = 1 limit=64 [ 94.964423][ T68] Buffer I/O error on dev loop0, logical block 4175, lost async page write [ 94.968658][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.968658][ T68] loop0: rw=8388609, sector=4176, nr_sectors = 1 limit=64 [ 94.983863][ T68] Buffer I/O error on dev loop0, logical block 4176, lost async page write [ 94.989228][ T68] kworker/u4:4: attempt to access beyond end of device [ 94.989228][ T68] loop0: rw=8388609, sector=4177, nr_sectors = 1 limit=64 [ 95.014213][ T68] Buffer I/O error on dev loop0, logical block 4177, lost async page write [ 95.031287][ T68] kworker/u4:4: attempt to access beyond end of device [ 95.031287][ T68] loop0: rw=1, sector=4178, nr_sectors = 16 limit=64 [ 95.050852][ T68] Buffer I/O error on dev loop0, logical block 4356, lost async page write [ 95.064805][ T68] Buffer I/O error on dev loop0, logical block 4357, lost async page write [ 96.008633][ T5324] [ 96.009850][ T5324] ============================================ [ 96.012499][ T5324] WARNING: possible recursive locking detected [ 96.015017][ T5324] syzkaller #0 Not tainted [ 96.016970][ T5324] -------------------------------------------- [ 96.019635][ T5324] syz.0.0/5324 is trying to acquire lock: [ 96.021877][ T5324] ffff888042c6c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 96.026049][ T5324] [ 96.026049][ T5324] but task is already holding lock: [ 96.029079][ T5324] ffff888042c6c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 96.032820][ T5324] [ 96.032820][ T5324] other info that might help us debug this: [ 96.036181][ T5324] Possible unsafe locking scenario: [ 96.036181][ T5324] [ 96.039138][ T5324] CPU0 [ 96.040565][ T5324] ---- [ 96.041951][ T5324] lock(&tree->tree_lock/1); [ 96.050073][ T5324] lock(&tree->tree_lock/1); [ 96.052740][ T5324] [ 96.052740][ T5324] *** DEADLOCK *** [ 96.052740][ T5324] [ 96.056950][ T5324] May be due to missing lock nesting notation [ 96.056950][ T5324] [ 96.060933][ T5324] 6 locks held by syz.0.0/5324: [ 96.063230][ T5324] #0: ffff888000ffe0f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 96.067947][ T5324] #1: ffff888042c6e450 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 96.071885][ T5324] #2: ffff888052d7b040 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 96.077231][ T5324] #3: ffff888052d7aea0 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 96.082773][ T5324] #4: ffff888042c6c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 96.087945][ T5324] #5: ffff888052d7c0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 96.092799][ T5324] [ 96.092799][ T5324] stack backtrace: [ 96.095032][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.095043][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.095049][ T5324] Call Trace: [ 96.095055][ T5324] [ 96.095059][ T5324] dump_stack_lvl+0xe8/0x150 [ 96.095072][ T5324] print_deadlock_bug+0x279/0x290 [ 96.095079][ T5324] __lock_acquire+0x24df/0x2cf0 [ 96.095089][ T5324] ? stack_depot_save_flags+0x3ec/0x800 [ 96.095135][ T5324] ? __kmalloc_noprof+0x1ad/0x720 [ 96.095143][ T5324] ? kasan_save_track+0x4f/0x80 [ 96.095153][ T5324] ? kasan_save_track+0x3e/0x80 [ 96.095163][ T5324] ? __kasan_kmalloc+0x93/0xb0 [ 96.095174][ T5324] ? __kmalloc_noprof+0x375/0x720 [ 96.095185][ T5324] ? hfs_find_init+0x9d/0x300 [ 96.095194][ T5324] ? hfs_extend_file+0x35f/0x1680 [ 96.095206][ T5324] ? hfs_bmap_reserve+0x108/0x430 [ 96.095216][ T5324] ? __hfs_ext_write_extent+0x1fc/0x470 [ 96.095228][ T5324] ? __hfs_ext_cache_extent+0x6e/0x9b0 [ 96.095241][ T5324] ? hfs_extend_file+0x3a0/0x1680 [ 96.095252][ T5324] ? hfs_find_init+0x18d/0x300 [ 96.095258][ T5324] lock_acquire+0x106/0x350 [ 96.095271][ T5324] ? hfs_find_init+0x18d/0x300 [ 96.095282][ T5324] __mutex_lock+0x19d/0x1550 [ 96.095327][ T5324] ? hfs_find_init+0x18d/0x300 [ 96.095361][ T5324] ? hfs_find_init+0x18d/0x300 [ 96.095373][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 96.095383][ T5324] ? trace_kmalloc+0x2a/0xf0 [ 96.095394][ T5324] ? __kmalloc_noprof+0x396/0x720 [ 96.095405][ T5324] ? __kmalloc_noprof+0x1ad/0x720 [ 96.095416][ T5324] ? hfs_find_init+0x9d/0x300 [ 96.095426][ T5324] hfs_find_init+0x18d/0x300 [ 96.095436][ T5324] hfs_extend_file+0x35f/0x1680 [ 96.095447][ T5324] ? __asan_memcpy+0x40/0x70 [ 96.095457][ T5324] ? hfs_bnode_read+0x3c0/0x800 [ 96.095469][ T5324] ? __pfx_hfs_extend_file+0x10/0x10 [ 96.095481][ T5324] ? __hfs_brec_find+0x335/0x510 [ 96.095494][ T5324] ? do_raw_spin_unlock+0x4d/0x210 [ 96.095507][ T5324] ? hfs_brec_find+0x3cc/0x510 [ 96.095515][ T5324] hfs_bmap_reserve+0x108/0x430 [ 96.095524][ T5324] __hfs_ext_write_extent+0x1fc/0x470 [ 96.095533][ T5324] __hfs_ext_cache_extent+0x6e/0x9b0 [ 96.095541][ T5324] ? hfs_find_init+0x18d/0x300 [ 96.095552][ T5324] hfs_extend_file+0x3a0/0x1680 [ 96.095560][ T5324] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 96.095568][ T5324] ? __pfx_hfs_extend_file+0x10/0x10 [ 96.095576][ T5324] ? clean_bdev_aliases+0x62e/0x750 [ 96.095585][ T5324] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 96.095593][ T5324] hfs_get_block+0x401/0xbe0 [ 96.095607][ T5324] ? __pfx_hfs_get_block+0x10/0x10 [ 96.095619][ T5324] ? do_raw_spin_unlock+0x4d/0x210 [ 96.095630][ T5324] ? _raw_spin_unlock+0x28/0x50 [ 96.095645][ T5324] ? create_empty_buffers+0x460/0x520 [ 96.095657][ T5324] __block_write_begin_int+0x6c2/0x1900 [ 96.095671][ T5324] ? filemap_add_folio+0x350/0x530 [ 96.095684][ T5324] ? __pfx_hfs_get_block+0x10/0x10 [ 96.095692][ T5324] ? __pfx___block_write_begin_int+0x10/0x10 [ 96.095701][ T5324] cont_write_begin+0x71b/0xac0 [ 96.095712][ T5324] ? trace_irq_disable+0x3b/0x140 [ 96.095726][ T5324] ? __pfx_cont_write_begin+0x10/0x10 [ 96.095737][ T5324] ? rcu_is_watching+0x15/0xb0 [ 96.095749][ T5324] hfs_write_begin+0x66/0xb0 [ 96.095761][ T5324] ? __pfx_hfs_get_block+0x10/0x10 [ 96.095772][ T5324] generic_perform_write+0x2d5/0x8f0 [ 96.095787][ T5324] ? __pfx_generic_perform_write+0x10/0x10 [ 96.095798][ T5324] ? file_update_time_flags+0x219/0x4a0 [ 96.095814][ T5324] ? __generic_file_write_iter+0xf9/0x230 [ 96.095825][ T5324] ? generic_file_write_iter+0x9a/0x330 [ 96.095836][ T5324] generic_file_write_iter+0xae/0x330 [ 96.095843][ T5324] vfs_write+0x612/0xba0 [ 96.095853][ T5324] ? __pfx_vfs_write+0x10/0x10 [ 96.095863][ T5324] ? __fget_files+0x2a/0x420 [ 96.095872][ T5324] ksys_write+0x150/0x270 [ 96.095881][ T5324] ? __pfx_ksys_write+0x10/0x10 [ 96.095890][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.095897][ T5324] do_syscall_64+0x174/0x580 [ 96.095904][ T5324] ? trace_irq_disable+0x3b/0x140 [ 96.095912][ T5324] ? clear_bhb_loop+0x40/0x90 [ 96.095919][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.095929][ T5324] RIP: 0033:0x7f454f99de99 [ 96.095957][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.095966][ T5324] RSP: 002b:00007f45508a0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.095977][ T5324] RAX: ffffffffffffffda RBX: 00007f454fc25fa0 RCX: 00007f454f99de99 [ 96.095984][ T5324] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000004 [ 96.095991][ T5324] RBP: 00007f454fa33eaf R08: 0000000000000000 R09: 0000000000000000 [ 96.095997][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.096003][ T5324] R13: 00007f454fc26038 R14: 00007f454fc25fa0 R15: 00007ffc0a4a8b08 [ 96.096013][ T5324] [ 96.434323][ T5284] Bluetooth: hci0: command 0x0419 tx timeout [ 98.514202][ T5284] Bluetooth: hci0: command 0x0419 tx timeout [ 100.594388][ T5284] Bluetooth: hci0: command 0x0419 tx timeout