program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file7\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={0x34, r1, 0x1, 0x0, 0xffffffff, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x40) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x29, 0x2, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) fstat(r4, &(0x7f00000070c0)) (async, rerun: 32) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x3, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f0000000240)='GPL\x00'}, 0x94) (rerun: 32) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000000)={r2, r5}) (async, rerun: 64) r6 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) (rerun: 64) ftruncate(r6, 0x2007ffc) [ 95.223639][ T4648] Bluetooth: hci0: command tx timeout [ 95.304310][ T5323] loop0: detected capacity change from 0 to 64 [ 95.315112][ T5323] ======================================================= [ 95.315112][ T5323] WARNING: The mand mount option has been deprecated and [ 95.315112][ T5323] and is ignored by this kernel. Remove the mand [ 95.315112][ T5323] option from the mount to silence this warning. [ 95.315112][ T5323] ======================================================= [ 95.733335][ T5323] [ 95.734441][ T5323] ============================================ [ 95.736968][ T5323] WARNING: possible recursive locking detected [ 95.739616][ T5323] syzkaller #0 Not tainted [ 95.741670][ T5323] -------------------------------------------- [ 95.744400][ T5323] syz.0.0/5323 is trying to acquire lock: [ 95.747046][ T5323] ffff8880517b40a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.751756][ T5323] [ 95.751756][ T5323] but task is already holding lock: [ 95.754933][ T5323] ffff8880517b3a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.759657][ T5323] [ 95.759657][ T5323] other info that might help us debug this: [ 95.763059][ T5323] Possible unsafe locking scenario: [ 95.763059][ T5323] [ 95.766313][ T5323] CPU0 [ 95.767804][ T5323] ---- [ 95.769320][ T5323] lock(&HFS_I(tree->inode)->extents_lock); [ 95.771869][ T5323] lock(&HFS_I(tree->inode)->extents_lock); [ 95.774462][ T5323] [ 95.774462][ T5323] *** DEADLOCK *** [ 95.774462][ T5323] [ 95.778006][ T5323] May be due to missing lock nesting notation [ 95.778006][ T5323] [ 95.781614][ T5323] locks held by syz.0.0/5323: 5, last CPU#0: [ 95.784168][ T5323] #0: ffff88801d2ac460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.788053][ T5323] #1: ffff8880517b3600 (&type->i_mutex_dir_key#9){+.+.}-{4:4}, at: lookup_open+0x242/0x1a40 [ 95.792266][ T5323] #2: ffff88801d2aa0a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.796363][ T5323] #3: ffff8880517b3a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.801087][ T5323] #4: ffff88801d2a80a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.805198][ T5323] [ 95.805198][ T5323] stack backtrace: [ 95.807723][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.811738][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.816074][ T5323] Call Trace: [ 95.817550][ T5323] [ 95.818915][ T5323] dump_stack_lvl+0xe8/0x150 [ 95.821072][ T5323] print_deadlock_bug+0x27a/0x290 [ 95.823346][ T5323] __lock_acquire+0x261c/0x2e50 [ 95.825500][ T5323] ? rcu_is_watching+0x16/0xb0 [ 95.827629][ T5323] ? __kasan_check_byte+0x12/0x40 [ 95.829859][ T5323] ? rcu_is_watching+0x16/0xb0 [ 95.831966][ T5323] ? lock_release+0x4b/0x3c0 [ 95.834048][ T5323] ? lock_release+0x4b/0x3c0 [ 95.836048][ T5323] lock_acquire+0x115/0x350 [ 95.838024][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 95.840086][ T5323] __mutex_lock+0x19d/0x1550 [ 95.842286][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 95.844438][ T5323] ? stack_trace_save+0xa9/0x100 [ 95.846464][ T5323] ? __pfx_stack_trace_save+0x10/0x10 [ 95.848870][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 95.851138][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 95.853298][ T5323] ? add_lock_to_list+0xc7/0x100 [ 95.855519][ T5323] ? lockdep_unlock+0x5c/0xd0 [ 95.857715][ T5323] ? __lock_acquire+0x14b9/0x2e50 [ 95.860000][ T5323] hfs_extend_file+0xf9/0x1680 [ 95.862201][ T5323] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.864627][ T5323] ? __mutex_trylock_common+0x15f/0x270 [ 95.867177][ T5323] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.869782][ T5323] ? rcu_is_watching+0x16/0xb0 [ 95.871848][ T5323] ? trace_contention_end+0x3d/0x140 [ 95.874168][ T5323] ? __asan_memset+0x22/0x50 [ 95.876188][ T5323] ? hfs_brec_find+0x19a/0x510 [ 95.878286][ T5323] hfs_bmap_reserve+0x108/0x430 [ 95.880623][ T5323] __hfs_ext_write_extent+0x1fc/0x470 [ 95.883028][ T5323] __hfs_ext_cache_extent+0x6e/0x9b0 [ 95.885392][ T5323] ? hfs_find_init+0x18d/0x300 [ 95.887484][ T5323] hfs_extend_file+0x3ad/0x1680 [ 95.889569][ T5323] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.892163][ T5323] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.894479][ T5323] ? __mutex_lock+0x30b/0x1550 [ 95.896626][ T5323] ? hfs_find_init+0x18d/0x300 [ 95.898639][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 95.900795][ T5323] ? rcu_is_watching+0x16/0xb0 [ 95.902910][ T5323] ? trace_kmalloc+0x2a/0xf0 [ 95.904796][ T5323] hfs_bmap_reserve+0x108/0x430 [ 95.906761][ T5323] hfs_cat_create+0x23d/0x870 [ 95.908648][ T5323] ? __pfx_hfs_cat_create+0x10/0x10 [ 95.910769][ T5323] ? _raw_spin_unlock+0x28/0x50 [ 95.912780][ T5323] ? hfs_new_inode+0x8e8/0xc50 [ 95.914745][ T5323] hfs_create+0x78/0xe0 [ 95.916399][ T5323] lookup_open+0xc0d/0x1a40 [ 95.918259][ T5323] path_openat+0x677/0x1d60 [ 95.920035][ T5323] do_file_open+0x23e/0x4a0 [ 95.921981][ T5323] ? __pfx_do_file_open+0x10/0x10 [ 95.924367][ T5323] ? _raw_spin_unlock+0x28/0x50 [ 95.926483][ T5323] ? alloc_fd+0x651/0x6c0 [ 95.928353][ T5323] do_sys_openat2+0x115/0x200 [ 95.930462][ T5323] ? __se_sys_futex+0x3a8/0x450 [ 95.932637][ T5323] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.934991][ T5323] ? rcu_is_watching+0x16/0xb0 [ 95.937109][ T5323] __x64_sys_open+0x11e/0x150 [ 95.939277][ T5323] do_syscall_64+0x166/0x520 [ 95.941665][ T5323] ? trace_irq_disable+0x3b/0x140 [ 95.943976][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.946615][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 95.948697][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.951300][ T5323] RIP: 0033:0x7fb8b739e159 [ 95.953588][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.962421][ T5323] RSP: 002b:00007fb8b81dbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 95.966008][ T5323] RAX: ffffffffffffffda RBX: 00007fb8b7625fa0 RCX: 00007fb8b739e159 [ 95.969534][ T5323] RDX: 0000000000000000 RSI: 0000000000145142 RDI: 0000200000000240 [ 95.972944][ T5323] RBP: 00007fb8b7435024 R08: 0000000000000000 R09: 0000000000000000 [ 95.976252][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.980161][ T5323] R13: 00007fb8b7626038 R14: 00007fb8b7625fa0 R15: 00007ffc3e1c2c48 [ 95.983480][ T5323] [ 96.024603][ T5323] syz.0.0: attempt to access beyond end of device [ 96.024603][ T5323] loop0: rw=8388608, sector=66, nr_sectors = 1 limit=64 [ 96.030354][ T5323] Buffer I/O error on dev loop0, logical block 66, async page read [ 96.034632][ T5323] syz.0.0: attempt to access beyond end of device [ 96.034632][ T5323] loop0: rw=8388608, sector=67, nr_sectors = 1 limit=64 [ 96.040487][ T5323] Buffer I/O error on dev loop0, logical block 67, async page read [ 96.044227][ T5323] syz.0.0: attempt to access beyond end of device [ 96.044227][ T5323] loop0: rw=8388608, sector=68, nr_sectors = 1 limit=64 [ 96.050092][ T5323] Buffer I/O error on dev loop0, logical block 68, async page read [ 96.053856][ T5323] syz.0.0: attempt to access beyond end of device [ 96.053856][ T5323] loop0: rw=8388608, sector=69, nr_sectors = 1 limit=64 [ 96.060209][ T5323] Buffer I/O error on dev loop0, logical block 69, async page read [ 96.064548][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064548][ T5323] loop0: rw=8388608, sector=70, nr_sectors = 1 limit=64 [ 96.064573][ T5323] Buffer I/O error on dev loop0, logical block 70, async page read [ 96.064871][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064871][ T5323] loop0: rw=8388608, sector=66, nr_sectors = 1 limit=64 [ 96.064886][ T5323] Buffer I/O error on dev loop0, logical block 66, async page read [ 96.064896][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064896][ T5323] loop0: rw=8388608, sector=67, nr_sectors = 1 limit=64 [ 96.064907][ T5323] Buffer I/O error on dev loop0, logical block 67, async page read [ 96.064917][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064917][ T5323] loop0: rw=8388608, sector=68, nr_sectors = 1 limit=64 [ 96.064927][ T5323] Buffer I/O error on dev loop0, logical block 68, async page read [ 96.064937][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064937][ T5323] loop0: rw=8388608, sector=69, nr_sectors = 1 limit=64 [ 96.064948][ T5323] Buffer I/O error on dev loop0, logical block 69, async page read [ 96.064957][ T5323] syz.0.0: attempt to access beyond end of device [ 96.064957][ T5323] loop0: rw=8388608, sector=70, nr_sectors = 1 limit=64 [ 96.064968][ T5323] Buffer I/O error on dev loop0, logical block 70, async page read