program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") creat(&(0x7f0000000380)='./bus\x00', 0x0) (async) r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) (async) r1 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$BLKROSET(r1, 0x125d, &(0x7f00000001c0)=0x4) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) (async) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f0000000240)={[{@grpquota}, {@auto_da_alloc}, {@minixdf}]}, 0x1, 0x50c, &(0x7f0000000ac0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLEaGVEHsEqRsSN4pix1HsLJvQQ3rmikQlTvTIH8C5Jw7cuCC4cSkHJH5EoAaJg9GMJ6mb2o3VJHYUfz7SaObNm/r7fXH8Xuc59gtgZF2PiP2ImIiITyNiNjufy7b4qL0l1z05uLdyeHBvJRet1if/zKX1ybno+DeJa9ljFiPihw8jfpJ7Pm5jd29juVqtbGfl+WZta76xu3drvba8VlmrbJbLS4tLCx/cfr98bm19qzaRHX318R/2v/WzJK2Z7ExnO85Tu+mF4ziJ8Yj4/kUEG4KxrD0Tw06El5KPiNcj4u309T8bY+mzCQBcZa3WbLRmO8sAwFWXT+fAcvlSNhcwE/l8qdSew3sjpvPVeqN58259Z3O1PVc2F4X83fVqZSGbK5yLQi4pL6bHT8vlE+XbEfFaRPxiciotl1bq1dVh/scHAEbYtRPj/38m2+M/AHDFFYedAAAwcD3G//1B5wEADI77fwAYPcZ/ABg97fF/athpAAAD5P4fAEaP8R8ARsoPPv442VqH2fdfr362u7NR/+zWaqWxUartrJRW6ttbpbV6fS39zp7aaY9Xrde3Ft+Lnc/nvr3VaM43dvfu1Oo7m8076fd636kU0qt8sgAAhum1tx79OZeMyB9OpVt0rOVQGGpmwEXLDzsBYGjGhp0AMDRW+4LRdYZ7fNMDcEV0WaL3GcVuHxBqtVqti0sJuGA3vmT+H0ZVx/y/vwKGEWP+H0aX+X8YXa1Wrt81/6PfCwGAy80cP9Dj/f/Xs/1vsjcHfrx68ooHF5kVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXG5H6/+WsrXAZyKfL5UiXomIuSjk7q5XKwsR8WpE/GmyMJmUF4ecMwBwVvm/5bL1v27MvjvzTNWb144PJyLip7/65JefLzeb23+MmMj9a/LofPNBdr48+OwBgNMdjdPpvuNG/snBvZWjbZD5/P27EVFsxz88mIjD4/jjMZ7ui1GIiOl/57JyW65j7uIs9u9HxBe7tT8XM+kcSHvl05Pxk9ivDDR+/pn4+bSuvU9+Fl84h1xg1DxK+p+Pur3+8nE93Xd//RfTHurssv4veaiVw7QPfBr/qP8b69H/Xe83xnu/+177aOr5uvsRXx6POIp92NH/HMXP9Yj/bp/x//KVN9/uVdf6dcSN6B6/M9Z8s7Y139jdu7VeW16rrFU2y+WlxaWFD26/X55P56jne48G//jw5qu96pL2T/eIXzyl/V/vs/0P//fpj772gvjffKdb/Hy88YL4yZj4jT7jL0//ttirLom/2qP9pz3/N/uM//ive88tGw4ADE9jd29juVqtbI/kQfR38e+zH9alyHmkD5Jn4RKk0fXgO4OKNRHdq37+TvvXdDKi8xe71XqpWL16jPOYdQMug+MXfUT8d9jJAAAAAAAAAAAAAAAAXQ3iE0vDbiMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABX1/8DAAD//9RMyv0=") r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x44042, 0x1ff) inotify_init() (async) r4 = inotify_init() inotify_add_watch(r4, &(0x7f0000000000)='.\x00', 0x400017e) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000040)='./file1\x00') r5 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0xa040, 0x0) ioctl$BLKFLSBUF(r5, 0x1261, &(0x7f0000000080)=0x10000) sendfile(r3, r5, 0x0, 0x20fffe82) [ 111.395894][ T5288] Bluetooth: hci0: command tx timeout [ 111.466587][ T5332] loop0: detected capacity change from 0 to 1024 [ 111.699804][ T5332] Trying to write to read-only block-device loop0 [ 111.817631][ T25] audit: type=1800 audit(1788739294.160:2): pid=5334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 111.879329][ T5332] syz.0.0: attempt to access beyond end of device [ 111.879329][ T5332] loop0: rw=34817, sector=5778, nr_sectors = 2 limit=1024 [ 111.896531][ T5332] [ 111.897892][ T5332] ====================================================== [ 111.901187][ T5332] WARNING: possible circular locking dependency detected [ 111.904162][ T5332] syzkaller #0 Not tainted [ 111.906262][ T5332] ------------------------------------------------------ [ 111.909789][ T5332] syz.0.0/5332 is trying to acquire lock: [ 111.912847][ T5332] ffff8880371ec0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 111.917488][ T5332] [ 111.917488][ T5332] but task is already holding lock: [ 111.920984][ T5332] ffff888052a7da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 111.926410][ T5332] [ 111.926410][ T5332] which lock already depends on the new lock. [ 111.926410][ T5332] [ 111.930613][ T5332] [ 111.930613][ T5332] the existing dependency chain (in reverse order) is: [ 111.934912][ T5332] [ 111.934912][ T5332] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 111.939234][ T5332] __mutex_lock+0x19d/0x1550 [ 111.941722][ T5332] hfsplus_file_extend+0x21c/0x1df0 [ 111.944152][ T5332] hfsplus_bmap_reserve+0x170/0x590 [ 111.947045][ T5332] __hfsplus_ext_write_extent+0x295/0x690 [ 111.951026][ T5332] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 111.954370][ T5332] hfsplus_file_extend+0x502/0x1df0 [ 111.956766][ T5332] hfsplus_get_block+0x41f/0x1610 [ 111.959145][ T5332] __block_write_begin_int+0x6c2/0x1900 [ 111.962034][ T5332] cont_write_begin+0x71b/0xac0 [ 111.964657][ T5332] hfsplus_write_begin+0x126/0x1e0 [ 111.967634][ T5332] generic_perform_write+0x2d5/0x8f0 [ 111.970711][ T5332] generic_file_write_iter+0xae/0x330 [ 111.973406][ T5332] aio_write+0x5d0/0x870 [ 111.975567][ T5332] io_submit_one+0x798/0x13d0 [ 111.978010][ T5332] __se_sys_io_submit+0x195/0x340 [ 111.981376][ T5332] do_syscall_64+0x166/0x520 [ 111.984286][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.987270][ T5332] [ 111.987270][ T5332] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 111.990890][ T5332] __lock_acquire+0x15ff/0x2e50 [ 111.993321][ T5332] lock_acquire+0x115/0x350 [ 111.995711][ T5332] __mutex_lock+0x19d/0x1550 [ 111.998644][ T5332] hfsplus_find_init+0x179/0x2e0 [ 112.001617][ T5332] hfsplus_file_truncate+0x3e0/0xd20 [ 112.004294][ T5332] hfsplus_direct_IO+0x320/0x370 [ 112.006839][ T5332] generic_file_direct_write+0x1d0/0x3f0 [ 112.010292][ T5332] __generic_file_write_iter+0x11d/0x230 [ 112.013713][ T5332] generic_file_write_iter+0xae/0x330 [ 112.016478][ T5332] iter_file_splice_write+0xa31/0x1240 [ 112.019317][ T5332] direct_splice_actor+0x101/0x160 [ 112.022383][ T5332] splice_direct_to_actor+0x57b/0xcb0 [ 112.025489][ T5332] do_splice_direct+0x195/0x290 [ 112.028285][ T5332] do_sendfile+0x52e/0x7c0 [ 112.030724][ T5332] __se_sys_sendfile64+0x144/0x1a0 [ 112.033258][ T5332] do_syscall_64+0x166/0x520 [ 112.035659][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.039151][ T5332] [ 112.039151][ T5332] other info that might help us debug this: [ 112.039151][ T5332] [ 112.045113][ T5332] Possible unsafe locking scenario: [ 112.045113][ T5332] [ 112.048515][ T5332] CPU0 CPU1 [ 112.051047][ T5332] ---- ---- [ 112.053547][ T5332] lock(&HFSPLUS_I(inode)->extents_lock); [ 112.056670][ T5332] lock(&tree->tree_lock/1); [ 112.060474][ T5332] lock(&HFSPLUS_I(inode)->extents_lock); [ 112.064361][ T5332] lock(&tree->tree_lock/1); [ 112.066597][ T5332] [ 112.066597][ T5332] *** DEADLOCK *** [ 112.066597][ T5332] [ 112.070990][ T5332] locks held by syz.0.0/5332: 3, last CPU#0: [ 112.074414][ T5332] #0: ffff88803aa38460 (sb_writers#11){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 [ 112.078822][ T5332] #1: ffff888052a7db98 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 112.084559][ T5332] #2: ffff888052a7da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 112.090310][ T5332] [ 112.090310][ T5332] stack backtrace: [ 112.093110][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 112.097300][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.102702][ T5332] Call Trace: [ 112.104275][ T5332] [ 112.105650][ T5332] dump_stack_lvl+0xe8/0x150 [ 112.107755][ T5332] print_circular_bug+0x2e2/0x300 [ 112.110601][ T5332] check_noncircular+0x12f/0x150 [ 112.113532][ T5332] __lock_acquire+0x15ff/0x2e50 [ 112.115975][ T5332] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 112.118646][ T5332] ? kasan_save_track+0x4f/0x80 [ 112.120935][ T5332] ? kasan_save_track+0x3e/0x80 [ 112.123244][ T5332] ? __kasan_kmalloc+0x93/0xb0 [ 112.125465][ T5332] ? __kmalloc_noprof+0x36b/0x720 [ 112.128355][ T5332] ? hfsplus_find_init+0x9d/0x2e0 [ 112.131141][ T5332] ? hfsplus_file_truncate+0x3e0/0xd20 [ 112.133809][ T5332] ? hfsplus_direct_IO+0x320/0x370 [ 112.136014][ T5332] ? generic_file_direct_write+0x1d0/0x3f0 [ 112.138597][ T5332] lock_acquire+0x115/0x350 [ 112.140786][ T5332] ? hfsplus_find_init+0x179/0x2e0 [ 112.143295][ T5332] __mutex_lock+0x19d/0x1550 [ 112.145585][ T5332] ? hfsplus_find_init+0x179/0x2e0 [ 112.147989][ T5332] ? hfsplus_find_init+0x179/0x2e0 [ 112.150300][ T5332] ? __pfx___mutex_lock+0x10/0x10 [ 112.152583][ T5332] ? rcu_is_watching+0x16/0xb0 [ 112.154732][ T5332] ? trace_kmalloc+0x2a/0xf0 [ 112.156825][ T5332] ? __kmalloc_noprof+0x38c/0x720 [ 112.159217][ T5332] ? __kmalloc_noprof+0x1ab/0x720 [ 112.161898][ T5332] ? hfsplus_find_init+0x9d/0x2e0 [ 112.164388][ T5332] hfsplus_find_init+0x179/0x2e0 [ 112.166686][ T5332] hfsplus_file_truncate+0x3e0/0xd20 [ 112.169119][ T5332] ? __pfx___up_read+0x10/0x10 [ 112.171742][ T5332] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 112.174903][ T5332] ? __pfx_unmap_mapping_range+0x10/0x10 [ 112.177530][ T5332] hfsplus_direct_IO+0x320/0x370 [ 112.180047][ T5332] generic_file_direct_write+0x1d0/0x3f0 [ 112.183079][ T5332] __generic_file_write_iter+0x11d/0x230 [ 112.185834][ T5332] ? generic_file_write_iter+0x9a/0x330 [ 112.188308][ T5332] generic_file_write_iter+0xae/0x330 [ 112.190943][ T5332] iter_file_splice_write+0xa31/0x1240 [ 112.193792][ T5332] ? __pfx_iter_file_splice_write+0x10/0x10 [ 112.197033][ T5332] ? __pfx_iter_file_splice_write+0x10/0x10 [ 112.199936][ T5332] direct_splice_actor+0x101/0x160 [ 112.202351][ T5332] splice_direct_to_actor+0x57b/0xcb0 [ 112.204818][ T5332] ? __pfx_direct_splice_actor+0x10/0x10 [ 112.208088][ T5332] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 112.211659][ T5332] do_splice_direct+0x195/0x290 [ 112.213948][ T5332] ? __pfx_do_splice_direct+0x10/0x10 [ 112.216382][ T5332] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 112.219043][ T5332] ? rw_verify_area+0x203/0x4c0 [ 112.221456][ T5332] do_sendfile+0x52e/0x7c0 [ 112.223640][ T5332] ? __pfx_do_sendfile+0x10/0x10 [ 112.226375][ T5332] ? __se_sys_futex+0x3a8/0x450 [ 112.228732][ T5332] __se_sys_sendfile64+0x144/0x1a0 [ 112.231030][ T5332] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 112.233320][ T5332] do_syscall_64+0x166/0x520 [ 112.235214][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.238131][ T5332] ? clear_bhb_loop+0x70/0xc0 [ 112.241542][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.244743][ T5332] RIP: 0033:0x7f0e9d19e159 [ 112.247649][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.256363][ T5332] RSP: 002b:00007f0e9dfb0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 112.260820][ T5332] RAX: ffffffffffffffda RBX: 00007f0e9d425fa0 RCX: 00007f0e9d19e159 [ 112.264885][ T5332] RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000008 [ 112.268236][ T5332] RBP: 00007f0e9d235024 R08: 0000000000000000 R09: 0000000000000000 [ 112.271797][ T5332] R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000 [ 112.275907][ T5332] R13: 00007f0e9d426038 R14: 00007f0e9d425fa0 R15: 00007ffdc1759608 [ 112.280439][ T5332]