program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) r1 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$BLKROSET(r1, 0x125d, &(0x7f00000001c0)=0x4) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) r3 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r3, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x2000, 0x0, 0x3) socket$inet6(0xa, 0x200000000003, 0x87) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x93, 0x1, 0x3, 0xd59f80, 0x19ef, 0x7, 0x19ef, 0x3, 0x6, 0x2800, 0x6, 0x8000, 0xbb6, 0x9, 0x10, {0x8}, 0xd0, 0x9}}) setns(0xc9, 0x0) socket$netlink(0x10, 0x3, 0x14) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/kernel/mm/transparent_hugepage/hugepages-2048kB/stats/anon_fault_alloc\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xcd, 0x0, 0x0, 0x0, 0x100}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x4c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd1}, 0x94) r6 = io_uring_setup(0xab1, &(0x7f0000000080)={0x0, 0xdf4, 0x800, 0x0, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) read(r5, &(0x7f0000000100)=""/100, 0x64) ioctl$VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f00000002c0)={0x2, 0xfffffffa}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) syz_mount_image$exfat(&(0x7f0000000280), &(0x7f0000001840)='./file2\x00', 0x10000, &(0x7f0000000240)=ANY=[], 0xf7, 0x1501, &(0x7f0000001980)="$eJzs3Am4T1X3OPC19t6H62b4JpnP2uvwTYZNkoSSZEiSJCRzQpIkSZK4ZEpCEjLeJHPInG665nnInHTzSpIkJCTZ/+c2/P16h5/3fX/9/vq/d32e5zz2cs7aZ+27nu89w/Pc79ddh1VvVKNKfWaGf4f+bYC//JMEAAkAMBAAcgBAAABlc5bNmb4/i8akf+sk4n9JgxlXugJxJUn/Mzbpf8Ym/c/YpP8Zm/Q/Y5P+Z2zS/4xN+i9EhjYr39WyZdxN3v//f079T5Ll+p8h4D/aIf3/T6P/paOl/xmb9D9jk/5nbNL/jCy40gWIK0w+/xmb9F+IDO0Pf6e84dyVfqct27+wCSGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ/w+c85cYAPhtfKXrEkIIIYQQQgghxB/Hv3ulKxBCCCGEEEIIIcT/PgQFGgwEkAkyQwJkgUS4CrJCNsgOOSAGV0NOuAZywbWQG/JAXsgH+aEAFIQQCCwwRFAICkMcroMicD0UhWJQHEqAg5JQCm6A0nAjlIGboCzcDOXgFigPFX4+Z7rboTLcAVXgTqgK1aA61IC7oCbcDbXgHqgN90IduA/qwv1QDx6A+tAAGsKD0AgegsbQBJpCM2gOLaDlZfKTc/y9/OehB7wAPaEXJEFv6AMvQl/oB/1hAAyEl2AQvAyD4RUYAkNhGLwKw+E1GAGvw0gYBaPhDRgDY2EcjIcJMBGS4U2YBG/BZHj7oWwwFabBdJgBM2EWvAOzYQ7MhXdhHsyHBZCcZREshiXwHiyF9yEFPoBl8CGkwnJYASthFayGNbAW1sF62AAbYRNshi2wFbbBR7AddsBO2AW7YQ/shY9hH3wC++FTSMPP/sX8s7/Ph24ICKhQoUGDmTATJmACJmIiZsWsmB2zYwxjmBNzYi7MhbkxN+bFvJiE+bEgFkRCQkbGQlgI4xjHIlgEi2JRLI7F0aHDUlgKS+ONWAbLYFksi+WwHJbHClgBb8VbsRJWwspYGatgFayKVbE6Vse78C68G2thLayNtbEO1sG6WBfrYT2sj/WxITbERtgIG2NjbIpNsTk2x5bYElthK2yNrbEttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsCt2xW74HD6Hz+Pz+AK+gL2wquqNfbAP9sW+2B8H4AB8CQfhy/gyvoJDcCgOw1fxVXwNR+AZHImjcDSOxkpqLI7D8chqIiZjMmaGSTgZJ+MUnIpTcTrOwJk4C2fhbJyDc/BdnIfzcT4uxIW4GJfgElyK72MKpuAyPIupuBxX4EpchatxFa7FdbgWN+BG3ICbcTNuxa34EX6EO3AH7sJduAf34Mf4MX6Cn+AQTMM0PIAH8CAexEN4CA/jYTyCR/AoHsVjeAyP43E8gSfxFJ7E03gaz+BZPAcA5/E8XsALeBEvpn/4VTqjjMqkMqkElaASVaLKqrKq7Cq7iqmYyqlyqlwql8qtcqu8Kq/Kr/KrgqqgIkWKVaQKqUIqruKqiCqiiqqiqrgqrpxyqpQqpUqr0qqMKqPKqptVOXWLKq8qqDbuVnWrqqTausrqDlVFVVFVVTVVXdVQNVRNVVPVUrVUbVVb1VF1VF11v6qnemN/bKDSO9NIDcXGahg2Vc1Uc9VCvYYPq1ZqBLZWbVRb9agahSOxvWrlOqgnVEc1Djupp9R4fFp1UROxq3pWdVPPqe7qedVDtXY9VS81BXurPmo69lX9VH81QM3Gaiq9Y9XVK+r5zEPVMPWqWoyvqRHqdTVSjVKj1RtqjBqrxqnxaoKaqJLVm2qSektNVm+rKWqqmqamqxlqppql3lGz1Rw1V72r5qn5aoFaqBapxWqJek8tVe+rFPWBWqY+VKlquVqhVqpVarVao9aqdWq92qA2qk1qs9qitqpt6iO1Xe1QO9UutVvtUXvVx2qf+kTtV5+qNPWZOqD+og6qz9Uh9YU6rL5UR9RX6qj6Wh1T36jj6lt1Qp1Up9R36rT6Xp1RZ9U59YM6r35UF9RP6qLyCjRqpbU2OtCZdGadoLPoRH2Vzqqz6ew6h47pq3VOfY3Opa/VuXUendfk0/l1AV1Qh5q01awjXUgX1nF9nS6ir9dFdTFdXJfQTpfUpfQNurS+UZfRN+my+mZdTt+iy+sKuqIHfZuupG/XlfUduoq+U1fV1XR1XUPfpWvqu3UtfY+ure/VdfR9uq6+X9fTD+j6uoFuqB/UjfRDurFuopvqZrq5bqFb6od1K/2Ibq3b6Lb6Ud1OP6bb68d1B/2E7qif1J30U7qzflp30c/orvpZ3U0/p7vrn/RF7XVP3Usn6d66j35R99X9dH89QA/UL+lB+mU9WL+ih+iheph+VQ/Xr+kR+nU9Uo/So/Ubeoweq8fp8XqCnqiT9Zt6kn5LT9Zv6yl6qp6mp+sZeqbu/+tMc/+J/Lf+Tv7gn8++VW/TH+nteofeqXfp3XqP3qv36n16n96v9+s0naYP6AP6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+iT+gf9nT6tv9dn9Fl9Vv+gz+vz+sKvPwMwaJTRxpjAZDKZTYLJYhLNVSaryWaymxwmZq42Oc01Jpe51uQ2eUxek8/kNwVMQRMaMtawiUwhU9jEzXWmiLneFDXFTHFTwjhT0pQyN/yP8y9XX0vT0rQyrUxr09q0NW1NO9POtDftTQfTwXQ0HU0n08l0Np1NF9PFdDVdTTfTzXQ33U0P08P0ND1NkkkyfcyLpq/pZ/qbAWageckMMoPMYDPYDDFDzDAzzAw3w80IM8KMNCPNaDPajDFjzDgzzkwwE0yyz2EmmUlmsplsppgpZtrAHGaGmWFmmVlmtplt5pq5Zp6ZZxaYBWaRWWSWmCVmqVlqUkyKWWaWmVSz3Cw3K81Ks9qsNmvNWrPerDcbzUaz2Ww2qWab2Wa2m+1mp9lpdpvdZq/Za/aZfWa/2W/STJo5YA6Yg+agOWQOmcPmsDlijpij5qg5Zo6Z4+a4OWFOmFPmlDltTpsz5ow5Z86Z8+a8uWAumIvmYvptX6ACFZjABJmCTEFCkBAkBolB1iBrkD3IHsSCWJAzyBnkCq4Ncgd5grxBviB/UCAoGIQBBTbgIAoKBYWDeHBdUCS4PigaFAuKByUCF5QMSgU3BKWDG4MywU1B2eDmoFxwS1A+qBBUDG4NbgsqBbcHlYM7girBnUHVoFpQPagR3BXUDO4OagX3BLWDe4M6wX1B3eD+oF7wQFA/aBA0DB4MGgUPBY2DJkHToFnQPGgRtPxD5/f+TJ5HXM+wV5gU9g77hC+GfcN+Yf9wQDgwfCkcFL4cDg5fCYeEQ8Nh4avh8PC1cET4ejgyHBWODt8Ix4Rjw3Hh+HBCODFMDt8MJ4VvhZPDt8Mp4dRwWjA9nBHODGeF74Szwznh3PDdcF44P1wQLgwXhYtD/OWWGFLCD8Jl4Ydharg8XBGuDFeFq8M14dpwXbg+3BBuDDeFm8sO+uXQcHu4I9wZ7gp3h3vCveHH4b7wk3B/+GmYFn4WHgj/Eh4MPw8PhV+Eh8MvwyPhV+HR8OvwWPhNeDz8NjwRngxPhd+Fp8PvwzPh2fBc+EN4PvwxvBD+FF4MffrNffrlnQwZykSZKIESKJESKStlpeyUnWIUo5yUk3JRLspNuSkv5aX8lJ8KUkFKx8RUiApRnOJUhIpQUSpKxak4OXJUikpRaSpNZagMlaWyVI7KUXkqTxWpIt1Gt9HtdDvdQXfQnXQnVaNqVINqUE2qSbWoFtWm2lSH6lBdqkv1qB7Vp/rUkBpSI2pEjakxNaWm1JyaU0tqSa2oFbWm1tSW2lI7akftqT11oA7UkTpSJ+pEnakzdaEu1JW6UjfqRt2pO/WgHtSTelISJVEf6kN9qS/1p/40kAbSIBpEg2kwDaEhNIyG0XAaTiNoBI2kUTSa3qAxNJbG0XiaQBMpmZJpEk2iyTSZptAUmkbTaAbNoFk0i2bTbJpLc2kezaMFtIAW0SJaQktoKS2lFEqhZbSMUimVVtAKWkWraA2toXW0jjbQBtpEm2gLbaFttI2203baSTtpN+2mvbSX9tE+2k/7KY3S6AAdoIN0kA7RITpMh+kIHaGjdJSO0TE6TsfpBJ2gU3SKTtNpOkNn6Bydo/P0I12gn+gieUqwWWyivcpmtdlsdpvD/nWc1+az+W0BW9CGNrfN87uYrLVFbTFb3Jawzpa0pewNfxOXtxVsRXurvc1Wsrfbyra8zQL/Na5p77a17D22tr3X1rB3/S6uY++zde1Dtp5tYuvbZrahbWEb2YdsY9vENrXNbHPbwrazj9n29nHbwT5hO9on/yZeat+36+x6u8FutPvsJ/ac/cEetV/b8/ZH29P2sgPtS3aQfdkOtq/YIXbo72MAO9q+YcfYsXacHW8n2Il/E0+z0+0MO9POsu/Y2XbO38RL7Ht2nk2xC+xCu8gu/jlOrynFfmCX2Q9tql1uV9iVdpVdbdfYtf+31pV2s91it9q99mO73e6wO+0uu9vu+TlOX8d++6lNs5/ZI/Yre9B+bg/ZY/aw/fLnOH19x+w39rj91p6wJ+0p+509bb+3Z+zZn9efvvbv7E/2ovUWGFmxZsMBZ+LMnMBZOJGv4qycjbNzDo7x1ZyTr+FcfC3n5jycl/Nxfi7ABTlkYsvMERfiwhzn67gIX89FuRgX5xLsuCSX4hu4NN/IZfgmLss3czm+hctzBa7It/JtXIlv58p8B1fhO7kqV+PqXIPv4pp8N9fie7g238t1+D6uy/dzPX6A63MDbsgPciN+iBtzE27Kzbg5t+CW/DC34ke4Nbfhtvwot+PHuD0/zh34Ce7IT3Infoo789PchZ/hrvwsd+PnuDs/zz34Be7JvTiJe3MffpH7cj/uzwN4IL/Eg/hlHsyv8BAeysP4VR7Or/EIfp1H8igezW/wGB7L43g8T+CJnMxv8iR+iyfz2zyFp/I0ns4zeCbP4nd4Ns/hufwuz+P5vIAX8iJezEv4PV7K73MKf8DL+ENO5eW8glfyKl7Na3gtr+P1vIE38ibezFt4K2/jj3g77+CdvIt38x7eyx/zPv6E9/OnnMaf8QH+Cx/kz/kQf8GH+Us+wl/xUf6aj/E3fJy/5RN8kk/xd3yav+czfJbP8Q98nn/kC/wTX2TPEGGkIh2ZKIgyRZmjhChLlBhdFWWNskXZoxxRLLo6yhldE+WKro1yR3mivFG+KH9UICoYhRFFNuIoigpFhaN4dF1UJLo+KhoVi4pHJSIXlYxKRTdEpaMbozLRTVHZ6OaoXHRLVD6qEFWMbo1uiypFt0eVozuiKtGdUdWoWlQ9qhHdFdWM7o5qRfdEtaN7ozLRfVHd6P6oXvRAVD9qEDWMHowaRQ9FjaMmUdOoWdQ8ahG1jB6OWkWPRK2jNlHb6NGoXfRY1D56POoQPRF1jJ68tL9Y8MvV9K/2J0W9I/3rG7J79KL44viS+HvxpfH34ynxD+LL4h/GU+PL4yviK+Or4qvja+Jr4+vi6+Mb4hvjm+Kb41viW+Pe18gMDtMfhMG4wGVymV2Cy+IS3VUuq8vmsrscLuaudjndNS6Xu9bldnlcXpfP5XcFXEEXOnLWsYtcIVfYxd11roi73hV1xVxxV8I5V9KVci1cS9fStXKPuNaujWvrHnWPusfcY+7xhF8Ld53cU66ze9p1cc+4Z9yzrpt7znV3z7se7gXX0/VySS7J9XF9XF/X1/V3/d1AN9ANcoPcYDfYDXFD3DA3zA13w90IN8KNdCPdaDfajXFj3Dg3zk1wE1yyS3aT3CQ32U12U9wUN81NczPcDDfLzXKz3Ww3181189w8t8AtcIvcIrfELXFL3VKX4lLcMrfMpbpUt8KtcKvcKrfGrXHr3Dq3wW1wm9wmt8VtcdvcNrfdbXc73U632+12e91et8/tc/vdfpfm0twBd8AddAfdIfeFO+y+dEfcV+6o+9odc9+44+5bd8KddKec16fd9+6MO+vOuR/cefeju+B+chedd8mxN2OTYm/FJsfejk2JTY1Ni02PzYjNjM2KvRObHZsTmxt7NzYvNj+2ILYwtii2OLYk9l5saez9WErsg9iy2Iex1Njy2IrYytiq2OqY9wW2R76QL+zj/jpfxF/vi/pivrgv4Z0v6Uv5G3xpf6Mv42/yZf3Nvpy/xZf3FXxF38Q39c18c9/Ct/QP+1b+Ed/at/Ft/aO+nX/Mt/eP+w7+Cd/RP+k7+ad8Z/+07+Kf8V39s/N/7bLv4V/wPX0vn+R7+z7+Rd/X9/P9/QA/0L/kB/mX/WD/ih/ih/ph/lU/3L/mR/jX/Ug/yo/2b/gxfqwf58f7CX6iT/Zv+kn+LT/Zv+2n+Kl+mp/uZ/iZfpZ/x8/2c/xc/66f5+f7BX6hX+QX+yX+Pb/Uv+9T/Ad+mf/Qp/rlfoVf6Vf51X6NX+vX+fV+g9/oN/nNfovf6rf5j/x2v8Pv9Lv8br/H7/Uf+33+E7/ff+rT/Gf+gP+LP+g/94f8F/6w/9If8V/5o/5rf8x/44/7b/0Jf9Kf8t/50/57f8af9ef8D/68/9Ff8D/5i/I3a0IIIYQQ/xR9mf29/87/qV+3dH0AINuOfIf/es5NuX8Z91P7OsYA4IleXRv8tjVokJSU9OuxqRqCwgsBIHYp/+fvH/g1Xg5t4THoAG2g9N+tr5+q+PN93383f/xmgESALL/lpD8eJcJfz3/jP5i/yXt8ufkXAhQtfCkn/US/xZfmL/MP5t/T7jLzZ/k8GaD1f8nJCpfiS/OXgkfgSejwuyOFEEIIIYQQQohf9FPnu13u+Tb9+Ty/uZSTGS7Fl3s+v4zKf8QahBBCCCGEEEII8d97+rnujz/coUObzv/Jg8x/jjL+BAMEgD9BGTL48w+u9G8mIYQQQgghxB/t0k3/la5ECCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYTIuP79bwhT//TBV3qNQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghxJX2fwIAAP//5g1V0w==") openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x141a42, 0x1c2) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r7, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) io_setup(0x1, &(0x7f00000004c0)=0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x0) io_submit(r8, 0x1, &(0x7f00000002c0)=[&(0x7f0000000040)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x6, r9, &(0x7f0000000140)='i', 0x1, 0xc}]) [ 94.797174][ T5281] Bluetooth: hci0: command tx timeout [ 94.962381][ T5317] loop0: detected capacity change from 0 to 1024 [ 95.084642][ T5317] Trying to write to read-only block-device loop0 [ 95.095529][ T25] audit: type=1800 audit(1788416937.930:2): pid=5317 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="bus" dev="loop0" ino=25 res=0 errno=0 [ 95.236052][ T5317] syz.0.0: attempt to access beyond end of device [ 95.236052][ T5317] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 95.243718][ T5317] Buffer I/O error on dev loop0, logical block 2889, async page read [ 95.247638][ T5317] syz.0.0: attempt to access beyond end of device [ 95.247638][ T5317] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 95.253537][ T5317] Buffer I/O error on dev loop0, logical block 2889, async page read [ 95.259706][ T25] audit: type=1800 audit(1788416938.100:3): pid=5317 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 95.271785][ T5317] [ 95.272926][ T5317] ====================================================== [ 95.275976][ T5317] WARNING: possible circular locking dependency detected [ 95.279140][ T5317] syzkaller #0 Not tainted [ 95.281119][ T5317] ------------------------------------------------------ [ 95.284111][ T5317] syz.0.0/5317 is trying to acquire lock: [ 95.286565][ T5317] ffff8880388620a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 95.290683][ T5317] [ 95.290683][ T5317] but task is already holding lock: [ 95.293783][ T5317] ffff8880120a5a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 95.298549][ T5317] [ 95.298549][ T5317] which lock already depends on the new lock. [ 95.298549][ T5317] [ 95.303195][ T5317] [ 95.303195][ T5317] the existing dependency chain (in reverse order) is: [ 95.306982][ T5317] [ 95.306982][ T5317] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 95.310914][ T5317] __mutex_lock+0x19d/0x1550 [ 95.313512][ T5317] hfsplus_file_extend+0x21c/0x1df0 [ 95.316005][ T5317] hfsplus_bmap_reserve+0x170/0x590 [ 95.318509][ T5317] __hfsplus_ext_write_extent+0x295/0x690 [ 95.321384][ T5317] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 95.324109][ T5317] hfsplus_file_extend+0x502/0x1df0 [ 95.326638][ T5317] hfsplus_get_block+0x41f/0x1610 [ 95.329095][ T5317] __block_write_begin_int+0x6c2/0x1900 [ 95.331674][ T5317] cont_write_begin+0x71b/0xac0 [ 95.333846][ T5317] hfsplus_write_begin+0x126/0x1e0 [ 95.336075][ T5317] generic_perform_write+0x2d5/0x8f0 [ 95.338465][ T5317] generic_file_write_iter+0xae/0x330 [ 95.340879][ T5317] aio_write+0x5d0/0x870 [ 95.342854][ T5317] io_submit_one+0x798/0x13d0 [ 95.344970][ T5317] __se_sys_io_submit+0x195/0x340 [ 95.347320][ T5317] do_syscall_64+0x166/0x520 [ 95.349577][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.353003][ T5317] [ 95.353003][ T5317] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 95.356428][ T5317] __lock_acquire+0x15ff/0x2e50 [ 95.358749][ T5317] lock_acquire+0x115/0x350 [ 95.360974][ T5317] __mutex_lock+0x19d/0x1550 [ 95.363197][ T5317] hfsplus_find_init+0x179/0x2e0 [ 95.365485][ T5317] hfsplus_file_truncate+0x3e0/0xd20 [ 95.368135][ T5317] hfsplus_setattr+0x1b5/0x260 [ 95.370418][ T5317] notify_change+0xbba/0xea0 [ 95.372694][ T5317] do_truncate+0x1c2/0x250 [ 95.374914][ T5317] path_openat+0x15b5/0x1d60 [ 95.377230][ T5317] do_file_open+0x23e/0x4a0 [ 95.379423][ T5317] do_sys_openat2+0x115/0x200 [ 95.381677][ T5317] __x64_sys_openat+0x138/0x170 [ 95.384089][ T5317] do_syscall_64+0x166/0x520 [ 95.386212][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.388965][ T5317] [ 95.388965][ T5317] other info that might help us debug this: [ 95.388965][ T5317] [ 95.393335][ T5317] Possible unsafe locking scenario: [ 95.393335][ T5317] [ 95.396339][ T5317] CPU0 CPU1 [ 95.398583][ T5317] ---- ---- [ 95.400906][ T5317] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.403470][ T5317] lock(&tree->tree_lock/1); [ 95.406538][ T5317] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.410138][ T5317] lock(&tree->tree_lock/1); [ 95.412109][ T5317] [ 95.412109][ T5317] *** DEADLOCK *** [ 95.412109][ T5317] [ 95.415435][ T5317] locks held by syz.0.0/5317: 3, last CPU#0: [ 95.417992][ T5317] #0: ffff888012b44460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.421670][ T5317] #1: ffff8880120a5b98 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: do_truncate+0x18f/0x250 [ 95.425809][ T5317] #2: ffff8880120a5a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 95.430601][ T5317] [ 95.430601][ T5317] stack backtrace: [ 95.433226][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.436888][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.441060][ T5317] Call Trace: [ 95.442557][ T5317] [ 95.443768][ T5317] dump_stack_lvl+0xe8/0x150 [ 95.445731][ T5317] print_circular_bug+0x2e2/0x300 [ 95.447941][ T5317] check_noncircular+0x12f/0x150 [ 95.450088][ T5317] __lock_acquire+0x15ff/0x2e50 [ 95.452165][ T5317] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.454697][ T5317] ? kasan_save_track+0x4f/0x80 [ 95.456758][ T5317] ? kasan_save_track+0x3e/0x80 [ 95.458853][ T5317] ? __kasan_kmalloc+0x93/0xb0 [ 95.460912][ T5317] ? __kmalloc_noprof+0x36b/0x720 [ 95.463117][ T5317] ? hfsplus_find_init+0x9d/0x2e0 [ 95.465352][ T5317] ? hfsplus_file_truncate+0x3e0/0xd20 [ 95.467678][ T5317] ? hfsplus_setattr+0x1b5/0x260 [ 95.469930][ T5317] ? notify_change+0xbba/0xea0 [ 95.472007][ T5317] lock_acquire+0x115/0x350 [ 95.473968][ T5317] ? hfsplus_find_init+0x179/0x2e0 [ 95.476238][ T5317] __mutex_lock+0x19d/0x1550 [ 95.478245][ T5317] ? hfsplus_find_init+0x179/0x2e0 [ 95.480691][ T5317] ? hfsplus_find_init+0x179/0x2e0 [ 95.483168][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 95.485303][ T5317] ? rcu_is_watching+0x16/0xb0 [ 95.487516][ T5317] ? trace_kmalloc+0x2a/0xf0 [ 95.489622][ T5317] ? __kmalloc_noprof+0x38c/0x720 [ 95.491760][ T5317] ? __kmalloc_noprof+0x1ab/0x720 [ 95.493673][ T5317] ? hfsplus_find_init+0x9d/0x2e0 [ 95.495790][ T5317] hfsplus_find_init+0x179/0x2e0 [ 95.498402][ T5317] hfsplus_file_truncate+0x3e0/0xd20 [ 95.501095][ T5317] ? __up_read+0x29c/0x930 [ 95.503591][ T5317] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 95.506743][ T5317] ? unmap_mapping_range+0xe7/0x190 [ 95.509688][ T5317] ? __pfx_unmap_mapping_range+0x10/0x10 [ 95.512086][ T5317] ? current_time+0x25a/0x380 [ 95.514151][ T5317] ? truncate_setsize+0xcf/0xf0 [ 95.516122][ T5317] hfsplus_setattr+0x1b5/0x260 [ 95.518280][ T5317] ? __pfx_hfsplus_setattr+0x10/0x10 [ 95.520544][ T5317] notify_change+0xbba/0xea0 [ 95.522533][ T5317] do_truncate+0x1c2/0x250 [ 95.524323][ T5317] ? __pfx_do_truncate+0x10/0x10 [ 95.526302][ T5317] ? apparmor_file_truncate+0x39f/0x470 [ 95.528471][ T5317] ? ima_file_truncate+0x10a/0x170 [ 95.530631][ T5317] path_openat+0x15b5/0x1d60 [ 95.532625][ T5317] do_file_open+0x23e/0x4a0 [ 95.534545][ T5317] ? __pfx_do_file_open+0x10/0x10 [ 95.536597][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 95.538793][ T5317] ? alloc_fd+0x651/0x6c0 [ 95.540630][ T5317] do_sys_openat2+0x115/0x200 [ 95.542447][ T5317] ? __se_sys_futex+0x3a8/0x450 [ 95.544530][ T5317] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.546749][ T5317] ? rcu_is_watching+0x16/0xb0 [ 95.548899][ T5317] __x64_sys_openat+0x138/0x170 [ 95.551145][ T5317] do_syscall_64+0x166/0x520 [ 95.553741][ T5317] ? trace_irq_disable+0x3b/0x140 [ 95.556328][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.558991][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.561087][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.563701][ T5317] RIP: 0033:0x7f97af99e159 [ 95.565709][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.574026][ T5317] RSP: 002b:00007f97b089bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 95.577552][ T5317] RAX: ffffffffffffffda RBX: 00007f97afc25fa0 RCX: 00007f97af99e159 [ 95.581020][ T5317] RDX: 0000000000141a42 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 95.584296][ T5317] RBP: 00007f97afa35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.587513][ T5317] R10: 00000000000001c2 R11: 0000000000000246 R12: 0000000000000000 [ 95.590820][ T5317] R13: 00007f97afc26038 R14: 00007f97afc25fa0 R15: 00007ffea4346998 [ 95.594039][ T5317] [ 95.649681][ T5317] hfsplus: can't free extent: start 2889, count 1 [ 95.668789][ T5318] loop0: detected capacity change from 1024 to 64 [ 95.683172][ T5317] syz.0.0: attempt to access beyond end of device [ 95.683172][ T5317] loop0: rw=8388608, sector=206, nr_sectors = 2 limit=64 [ 95.688447][ T5317] Buffer I/O error on dev loop0, logical block 103, async page read [ 95.693266][ T5317] syz.0.0: attempt to access beyond end of device [ 95.693266][ T5317] loop0: rw=8388608, sector=208, nr_sectors = 2 limit=64 [ 95.699942][ T5317] Buffer I/O error on dev loop0, logical block 104, async page read [ 95.703497][ T5317] syz.0.0: attempt to access beyond end of device [ 95.703497][ T5317] loop0: rw=8388608, sector=210, nr_sectors = 2 limit=64 [ 95.709465][ T5317] Buffer I/O error on dev loop0, logical block 105, async page read [ 95.713183][ T5317] syz.0.0: attempt to access beyond end of device [ 95.713183][ T5317] loop0: rw=8388608, sector=212, nr_sectors = 2 limit=64 [ 95.719968][ T5317] Buffer I/O error on dev loop0, logical block 106, async page read