program: syz_mount_image$hfs(&(0x7f0000000340), &(0x7f00000004c0)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d472968786c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc107102000000dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000f3069fe8", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32b, &(0x7f0000000b40)="$eJzs3U1rE0EYB/D/TJJma2PdvojgsVrQi2i9iJeI5CsI4kG0bYRiqKgV1IupeBLRu3e/gh/Ci+IX0JMH8Sq0F0dmdnazL7MvaRvX6v8H4mZ2J/tMZjbzTFAGRPTfutr78u7iN/1HAA00gJeXAQnAA5oAjuOE92hza2Nr0F8veqOGqYFdBYGgpshcs7bZN39vJ4t1PVPD8vWrJjrxMpoMpdSVr6my77KmYKg25ul3kEDbPp3mvPfHIyu2XeUix3geTiCWw0TsYAePMVt3HEREVC89/28HM6We5zs2f5cSWI7P+n/b/F/N0UzJz1rimLCp+AtVeGls/jerLCV0vx8zp0brPbOE0+dluEqsEkbLFZZMJZjCvaocLflMLHL6zsagf27t3mBd4jm6VqzCYrrheoSWRLvkWJsWqNB24cwog7BkS7dhJSf+hT3esUAm3U10iPggPombwsdbrEf5X1MJHa0J2E/1VBD/+fz7zZha+irYr41utyvNG4XmzE1OJnsqv5VmFHjuFQnCD3YOyR8I/LI4Ta35VK2gdRecFdpRrQVnrZXwVc69FhO1dGui0Zwf5cFQz/LOiNfiuljCD7xHL5b/Sx3fMrJPZqwTRk+NsJOC+cSD9ky5b9c07+lnZo4hbnSSJdGn2M4LfVcJ/iS0T2EfvsIqLmH24ZOndxuDQf+BPrjtOLjfiUpaLwDnNTUfYDgqaUMZmYvD78BE9WlbOMZNG2MEdvZAW6ofxNKL9VOWPhW2MiyRjmvGPoiPhPCBPbA+hax/aBWNjd7H1EAqPVCNas+OajtHuF/e7zmnfqk9tD2bL9O/adTpdUdCNdHTgQjWfyaTt/m+ydd0tnCtnb8aCReZrpTNJI72HZXOsaMVkJeoP2+OjiTT6JIV0IzNYxzruCEyay4992fWXKfOAKer39G3cR4O+em/JXr4jFv8/Z+IiIiIiIiIiIiIiIiIiIiIiIiI6LAZ/39HTI9Zq8V/WU5EREREREREREREREREREREREREREREtE/R/r8I9/9Ftf1/09tL2f1/PZTs/7uajSGz/++bTYghwP1/iSbrdwAAAP//kWVv8w==") prlimit64(0x0, 0xe, &(0x7f0000000980)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000009c0)=0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r0, &(0x7f0000000a40)={0x18}, 0xfffffdef) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000b00)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x6}}, 0x20) [ 74.132302][ T4648] Bluetooth: hci0: command tx timeout [ 74.209697][ T5324] loop0: detected capacity change from 0 to 64 [ 75.287468][ T5324] syz.0.0: attempt to access beyond end of device [ 75.287468][ T5324] loop0: rw=8388608, sector=25903, nr_sectors = 1 limit=64 [ 75.287538][ T5324] Buffer I/O error on dev loop0, logical block 25903, async page read [ 75.287567][ T5324] syz.0.0: attempt to access beyond end of device [ 75.287567][ T5324] loop0: rw=8388608, sector=26319, nr_sectors = 1 limit=64 [ 75.287581][ T5324] Buffer I/O error on dev loop0, logical block 26319, async page read [ 75.287596][ T5324] syz.0.0: attempt to access beyond end of device [ 75.287596][ T5324] loop0: rw=8388608, sector=26320, nr_sectors = 1 limit=64 [ 75.287608][ T5324] Buffer I/O error on dev loop0, logical block 26320, async page read [ 75.288013][ T5324] [ 75.315098][ T5324] ============================================ [ 75.320070][ T5324] WARNING: possible recursive locking detected [ 75.322810][ T5324] syzkaller #0 Not tainted [ 75.324788][ T5324] -------------------------------------------- [ 75.327463][ T5324] syz.0.0/5324 is trying to acquire lock: [ 75.329871][ T5324] ffff888035c5c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 75.334356][ T5324] [ 75.334356][ T5324] but task is already holding lock: [ 75.337501][ T5324] ffff888035c5c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 75.341686][ T5324] [ 75.341686][ T5324] other info that might help us debug this: [ 75.345318][ T5324] Possible unsafe locking scenario: [ 75.345318][ T5324] [ 75.348594][ T5324] CPU0 [ 75.350108][ T5324] ---- [ 75.351592][ T5324] lock(&tree->tree_lock/1); [ 75.353709][ T5324] lock(&tree->tree_lock/1); [ 75.355657][ T5324] [ 75.355657][ T5324] *** DEADLOCK *** [ 75.355657][ T5324] [ 75.359064][ T5324] May be due to missing lock nesting notation [ 75.359064][ T5324] [ 75.362545][ T5324] locks held by syz.0.0/5324: 6, last CPU#0: [ 75.365142][ T5324] #0: ffff8880140d47f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 75.369274][ T5324] #1: ffff88803ba38460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 75.373560][ T5324] #2: ffff88805465f040 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 75.378648][ T5324] #3: ffff88805465eea0 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_file_truncate+0x39b/0xb70 [ 75.385271][ T5324] #4: ffff888035c5c0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 75.389344][ T5324] #5: ffff8880546600a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 75.394016][ T5324] [ 75.394016][ T5324] stack backtrace: [ 75.396553][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.400533][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.404893][ T5324] Call Trace: [ 75.406421][ T5324] [ 75.407790][ T5324] dump_stack_lvl+0xe8/0x150 [ 75.409841][ T5324] print_deadlock_bug+0x27a/0x290 [ 75.412365][ T5324] __lock_acquire+0x25db/0x2de0 [ 75.414819][ T5324] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 75.417889][ T5324] ? stack_depot_save_flags+0x404/0x7f0 [ 75.420708][ T5324] ? kasan_save_track+0x4f/0x80 [ 75.424908][ T5324] ? kasan_save_track+0x3e/0x80 [ 75.427044][ T5324] ? __kasan_kmalloc+0x93/0xb0 [ 75.429139][ T5324] ? __kmalloc_noprof+0x366/0x710 [ 75.431390][ T5324] ? hfs_find_init+0x9d/0x300 [ 75.433508][ T5324] ? hfs_extend_file+0x367/0x1680 [ 75.435625][ T5324] ? hfs_bmap_reserve+0x108/0x430 [ 75.437955][ T5324] ? __hfs_ext_write_extent+0x200/0x620 [ 75.440541][ T5324] lock_acquire+0x115/0x350 [ 75.444377][ T5324] ? hfs_find_init+0x18d/0x300 [ 75.446489][ T5324] __mutex_lock+0x197/0x15a0 [ 75.448422][ T5324] ? hfs_find_init+0x18d/0x300 [ 75.450430][ T5324] ? hfs_find_init+0x18d/0x300 [ 75.452469][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 75.454447][ T5324] ? rcu_is_watching+0x16/0xb0 [ 75.456410][ T5324] ? trace_kmalloc+0x2a/0xf0 [ 75.458308][ T5324] ? __kmalloc_noprof+0x387/0x710 [ 75.460428][ T5324] ? __kmalloc_noprof+0x1a6/0x710 [ 75.462659][ T5324] ? hfs_find_init+0x9d/0x300 [ 75.464758][ T5324] hfs_find_init+0x18d/0x300 [ 75.466871][ T5324] hfs_extend_file+0x367/0x1680 [ 75.469058][ T5324] ? __asan_memcpy+0x40/0x70 [ 75.471228][ T5324] ? __pfx_hfs_extend_file+0x10/0x10 [ 75.473635][ T5324] ? __hfs_brec_find+0x335/0x510 [ 75.475864][ T5324] ? do_raw_spin_unlock+0x4d/0x200 [ 75.478157][ T5324] ? hfs_brec_find+0x3cc/0x510 [ 75.480578][ T5324] hfs_bmap_reserve+0x108/0x430 [ 75.483107][ T5324] __hfs_ext_write_extent+0x200/0x620 [ 75.485564][ T5324] ? __kmalloc_noprof+0x1a6/0x710 [ 75.487809][ T5324] ? hfs_find_init+0x9d/0x300 [ 75.489872][ T5324] __hfs_ext_cache_extent+0x6e/0x9b0 [ 75.492238][ T5324] ? hfs_find_init+0x18d/0x300 [ 75.494358][ T5324] hfs_file_truncate+0x4e6/0xb70 [ 75.496482][ T5324] ? __pfx_hfs_file_truncate+0x10/0x10 [ 75.498768][ T5324] ? __pfx_unmap_mapping_range+0x10/0x10 [ 75.503745][ T5324] hfs_write_begin+0x178/0x1c0 [ 75.505869][ T5324] generic_perform_write+0x2d5/0x8e0 [ 75.508224][ T5324] ? __pfx_generic_perform_write+0x10/0x10 [ 75.510848][ T5324] ? file_update_time_flags+0x1e0/0x440 [ 75.513252][ T5324] ? __generic_file_write_iter+0xf9/0x230 [ 75.515865][ T5324] ? generic_file_write_iter+0x9a/0x330 [ 75.518391][ T5324] generic_file_write_iter+0xae/0x330 [ 75.520808][ T5324] vfs_write+0x612/0xba0 [ 75.522746][ T5324] ? __pfx_vfs_write+0x10/0x10 [ 75.524904][ T5324] ? __fget_files+0x3a2/0x420 [ 75.527018][ T5324] ? __fget_files+0x2a/0x420 [ 75.529120][ T5324] ? fdget+0x1ac/0x250 [ 75.530986][ T5324] ksys_write+0x150/0x270 [ 75.533031][ T5324] ? __pfx_ksys_write+0x10/0x10 [ 75.535200][ T5324] do_syscall_64+0x166/0x520 [ 75.537309][ T5324] ? trace_irq_disable+0x3b/0x140 [ 75.541769][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.544529][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 75.546580][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.548904][ T5324] RIP: 0033:0x7f7670f9f559 [ 75.550802][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.558852][ T5324] RSP: 002b:00007f7671dabfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 75.562576][ T5324] RAX: ffffffffffffffda RBX: 00007f7671225fa0 RCX: 00007f7670f9f559 [ 75.566059][ T5324] RDX: 00000000fffffdef RSI: 0000200000000a40 RDI: 0000000000000004 [ 75.569587][ T5324] RBP: 00007f7671036b20 R08: 0000000000000000 R09: 0000000000000000 [ 75.572879][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.577154][ T5324] R13: 00007f7671226038 R14: 00007f7671225fa0 R15: 00007fffbd3b3af8 [ 75.580604][ T5324] [ 76.260369][ T4648] Bluetooth: hci0: command tx timeout [ 76.756388][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.756452][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 78.274979][ T4648] Bluetooth: hci0: command tx timeout [ 79.315842][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.315842][ T1060] loop0: rw=9437185, sector=161, nr_sectors = 1 limit=64 [ 79.315863][ T1060] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 79.315874][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.315874][ T1060] loop0: rw=9437185, sector=162, nr_sectors = 1 limit=64 [ 79.315950][ T1060] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 79.315961][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.315961][ T1060] loop0: rw=9437185, sector=163, nr_sectors = 1 limit=64 [ 79.315972][ T1060] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 79.315981][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.315981][ T1060] loop0: rw=9437185, sector=167, nr_sectors = 1 limit=64 [ 79.315992][ T1060] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 79.316001][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.316001][ T1060] loop0: rw=9437185, sector=169, nr_sectors = 1 limit=64 [ 79.316012][ T1060] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 79.316020][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.316020][ T1060] loop0: rw=9437185, sector=171, nr_sectors = 1 limit=64 [ 79.316031][ T1060] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 79.316041][ T1060] kworker/u4:10: attempt to access beyond end of device [ 79.316041][ T1060] loop0: rw=9437185, sector=172, nr_sectors = 1 limit=64 [ 79.316051][ T1060] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 80.354591][ T4648] Bluetooth: hci0: command tx timeout