program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000300)='./file0\x00', 0x800084, &(0x7f0000000d80)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRESOCT], 0x1, 0x341, &(0x7f0000000680)="$eJzs3U9r1E4YB/DvJLvd7a/7q6mtCB6rBb2Ify7iZUX2LQjiQbTtCsWlolZQL+6KJxG9e/ct+CK8KL4BPXkoXoX24shMJn9nssnWbWP1+wExm2QyTzKTzfMsSkBE/6yrvS/vLn5TfwTgwwdeXgY8AG2gAeAYjrcfbW5tbA366+MO5OsW2JUQCFsKa5+1zb7+e5RdrdrpFkagPjXQSa+j/SGlvPI1t27bqykYqo2++x08oGXuTr29feCRjTeqspNjPg/3IZbDROxgB48xX3ccRERUL/X8H4VPSvWc75j83fOAFWDU/lOf/9X8b635UUscB0mO3Zp6/usqSwo1vkf0pqTe0yWc2u5FVWKVnpu5zzMIc7BMgincVWVS8ulYvNk7G4P+2bV7g3UPz9E1Ug2W4h4MNUNLol121KYO0U4Vzl04M8owLK+pzuFCQfyLrsNNcrVtVrqbGRDxQXwSN0WAt1iP87+GFCpaHXCQG6kw/nPF/c3pVmovVSyoq9btdj19oMiC7uREdqSKz1LPgra7IkF0YReQ/YEgKItzxpXthmd33tmgFfe1mOvLjGn0KRVVOsKlTCt1NvFsLo5yOuSzoi3itbgulvEd79FL5f+eim8F9p3pJ/MnuWvESnij6Ssens+Mu7uGPmZgPTmGuNHJromnbaso9F0p+JPQHkUXNRrDV1jFJcw/fPL0rj8Y9B+ohduOhfudeE3zBeDcp+YFDJM1LUjN2jmaw5nms2blBJ36EwR2Zqpnqr4/SndWd1l+U3SWU73y6ZkQza2pjSm8fZ826vto7D7j5kbvY24ilS5Iv9q9I1vOGR6Uj3vBpp9yD9fHzpfp75QMet2RUE1U3iXC+k9n8ibf1/mayhautdx5erqGcqVsOns3R5Qqx44roCQVVEXqUb30X7ZuKamA5kzvjjpuCKvmUs9+q+Y6eRo4Vb3HwMR5OBSn/4bo4TNu8fd/IiIiIiIiIiIiIiIiIiIiIiIiIqLDZvL/ODE7Yasm/2U5EREREREREREREREREREREREREREREdFvit//i+j9v6j2/t/866XM+3/bKHn/76odg/X+3zebEEOg9P2/252JzpWIsn4FAAD//0wMcIE=") prlimit64(0x0, 0xe, &(0x7f0000000c40)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000c80)=0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000cc0)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r0, &(0x7f0000000d00)={0x18}, 0xfffffdef) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000d40)=0x101) r1 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000180)={r1, 0x3, 0x2, 0x1}) bind$vsock_stream(r3, &(0x7f0000000440), 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x208a00, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0x6, 0xfffffffd}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBLED(r5, 0x4b65, 0x7d) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_TX_TS(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x2c, r6, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TSID={0x5, 0xd2, 0x8}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x44000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) preadv2(r8, &(0x7f00000000c0), 0x0, 0x8, 0x5, 0x0) sendmmsg$unix(r8, &(0x7f0000000200), 0x400000000000041, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fallocate(r4, 0x4, 0x40, 0x2000404) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x3c, 0x3e9, 0x1, 0x70bd2b, 0x25dfdbfb, {0x6, 0x0, 0x0, 0x0, 0x10000000, 0x8, 0x3, 0x86e, 0x0, 0x2964, 0x2}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000005}, 0x24048180) listen(r2, 0xffffff6c) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) sendto$packet(r9, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847fe7bf05ddc63ff512d4074687760a5fbd1fc97772c6f5027dcea15b6658de3b024a6ea22baafb445bf8427c8055d00", 0xffffff3d, 0x0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) [ 103.087160][ T4669] Bluetooth: hci0: command tx timeout [ 103.196701][ T5354] loop0: detected capacity change from 0 to 64 [ 104.356258][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356258][ T5354] loop0: rw=8388608, sector=25900, nr_sectors = 1 limit=64 [ 104.356517][ T5354] Buffer I/O error on dev loop0, logical block 25900, async page read [ 104.356548][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356548][ T5354] loop0: rw=8388608, sector=25901, nr_sectors = 1 limit=64 [ 104.356561][ T5354] Buffer I/O error on dev loop0, logical block 25901, async page read [ 104.356570][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356570][ T5354] loop0: rw=8388608, sector=26979, nr_sectors = 1 limit=64 [ 104.356578][ T5354] Buffer I/O error on dev loop0, logical block 26979, async page read [ 104.356586][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356586][ T5354] loop0: rw=8388608, sector=26980, nr_sectors = 1 limit=64 [ 104.356594][ T5354] Buffer I/O error on dev loop0, logical block 26980, async page read [ 104.356602][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356602][ T5354] loop0: rw=8388608, sector=26981, nr_sectors = 1 limit=64 [ 104.356614][ T5354] Buffer I/O error on dev loop0, logical block 26981, async page read [ 104.356627][ T5354] syz.0.0: attempt to access beyond end of device [ 104.356627][ T5354] loop0: rw=8388608, sector=26982, nr_sectors = 1 limit=64 [ 104.356639][ T5354] Buffer I/O error on dev loop0, logical block 26982, async page read [ 104.357071][ T5354] syz.0.0: attempt to access beyond end of device [ 104.357071][ T5354] loop0: rw=8388608, sector=25900, nr_sectors = 1 limit=64 [ 104.357086][ T5354] Buffer I/O error on dev loop0, logical block 25900, async page read [ 104.357098][ T5354] syz.0.0: attempt to access beyond end of device [ 104.357098][ T5354] loop0: rw=8388608, sector=25901, nr_sectors = 1 limit=64 [ 104.357110][ T5354] Buffer I/O error on dev loop0, logical block 25901, async page read [ 104.357122][ T5354] syz.0.0: attempt to access beyond end of device [ 104.357122][ T5354] loop0: rw=8388608, sector=26979, nr_sectors = 1 limit=64 [ 104.357134][ T5354] Buffer I/O error on dev loop0, logical block 26979, async page read [ 104.357146][ T5354] syz.0.0: attempt to access beyond end of device [ 104.357146][ T5354] loop0: rw=8388608, sector=26980, nr_sectors = 1 limit=64 [ 104.357158][ T5354] Buffer I/O error on dev loop0, logical block 26980, async page read [ 104.806220][ T197] [ 104.807309][ T197] ============================================ [ 104.809755][ T197] WARNING: possible recursive locking detected [ 104.812104][ T197] syzkaller #0 Not tainted [ 104.813827][ T197] -------------------------------------------- [ 104.816348][ T197] kworker/u4:7/197 is trying to acquire lock: [ 104.818900][ T197] ffff88803894a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.823752][ T197] [ 104.823752][ T197] but task is already holding lock: [ 104.826632][ T197] ffff88803894a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.830431][ T197] [ 104.830431][ T197] other info that might help us debug this: [ 104.833692][ T197] Possible unsafe locking scenario: [ 104.833692][ T197] [ 104.836637][ T197] CPU0 [ 104.838057][ T197] ---- [ 104.839500][ T197] lock(&tree->tree_lock/1); [ 104.841327][ T197] lock(&tree->tree_lock/1); [ 104.843283][ T197] [ 104.843283][ T197] *** DEADLOCK *** [ 104.843283][ T197] [ 104.846373][ T197] May be due to missing lock nesting notation [ 104.846373][ T197] [ 104.850005][ T197] locks held by kworker/u4:7/197: 5, last CPU#0: [ 104.852817][ T197] #0: ffff88801dfbd148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.857770][ T197] #1: ffffc90001b57c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.863006][ T197] #2: ffff88803904e0e8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 104.867499][ T197] #3: ffff88803894a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.871587][ T197] #4: ffff8880544040a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.876039][ T197] [ 104.876039][ T197] stack backtrace: [ 104.878645][ T197] CPU: 0 UID: 0 PID: 197 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 104.882746][ T197] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.886850][ T197] Workqueue: writeback wb_workfn (flush-7:0) [ 104.889291][ T197] Call Trace: [ 104.890750][ T197] [ 104.892010][ T197] dump_stack_lvl+0xe8/0x150 [ 104.893999][ T197] print_deadlock_bug+0x27a/0x290 [ 104.896152][ T197] __lock_acquire+0x25db/0x2de0 [ 104.898336][ T197] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.901710][ T197] ? stack_depot_save_flags+0x404/0x7f0 [ 104.904103][ T197] ? kasan_save_track+0x4f/0x80 [ 104.906229][ T197] ? kasan_save_track+0x3e/0x80 [ 104.908355][ T197] ? __kasan_kmalloc+0x93/0xb0 [ 104.910442][ T197] ? __kmalloc_noprof+0x366/0x710 [ 104.912666][ T197] ? hfs_find_init+0x9d/0x300 [ 104.914479][ T197] ? hfs_extend_file+0x367/0x1680 [ 104.916659][ T197] ? hfs_bmap_reserve+0x108/0x430 [ 104.918905][ T197] ? __hfs_ext_write_extent+0x200/0x620 [ 104.921330][ T197] lock_acquire+0x115/0x350 [ 104.923428][ T197] ? hfs_find_init+0x18d/0x300 [ 104.925572][ T197] __mutex_lock+0x197/0x15a0 [ 104.927798][ T197] ? hfs_find_init+0x18d/0x300 [ 104.929924][ T197] ? hfs_find_init+0x18d/0x300 [ 104.932067][ T197] ? __pfx___mutex_lock+0x10/0x10 [ 104.934251][ T197] ? rcu_is_watching+0x16/0xb0 [ 104.936266][ T197] ? trace_kmalloc+0x2a/0xf0 [ 104.938260][ T197] ? __kmalloc_noprof+0x387/0x710 [ 104.940315][ T197] ? __kmalloc_noprof+0x1a6/0x710 [ 104.942475][ T197] ? hfs_find_init+0x9d/0x300 [ 104.944573][ T197] hfs_find_init+0x18d/0x300 [ 104.946583][ T197] hfs_extend_file+0x367/0x1680 [ 104.948774][ T197] ? folio_mark_accessed+0x44e/0x870 [ 104.951079][ T197] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.953386][ T197] ? _raw_spin_unlock+0x28/0x50 [ 104.955434][ T197] ? hfs_brec_find+0x3db/0x510 [ 104.957550][ T197] hfs_bmap_reserve+0x108/0x430 [ 104.959666][ T197] __hfs_ext_write_extent+0x200/0x620 [ 104.961968][ T197] hfs_ext_write_extent+0x17d/0x210 [ 104.964227][ T197] ? __pfx___mpage_writepages+0x10/0x10 [ 104.966557][ T197] ? __pfx_hfs_ext_write_extent+0x10/0x10 [ 104.969059][ T197] hfs_write_inode+0x117/0xa00 [ 104.971137][ T197] ? __pfx_hfs_write_inode+0x10/0x10 [ 104.973529][ T197] ? do_raw_spin_unlock+0x4d/0x200 [ 104.975823][ T197] __writeback_single_inode+0x69d/0x1220 [ 104.978372][ T197] writeback_sb_inodes+0x9de/0x1af0 [ 104.980700][ T197] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 104.983103][ T197] ? __pfx_down_read_trylock+0x10/0x10 [ 104.985500][ T197] __writeback_inodes_wb+0x114/0x240 [ 104.987784][ T197] wb_writeback+0x42f/0xad0 [ 104.989788][ T197] ? queue_io+0x1f1/0x470 [ 104.991721][ T197] ? __pfx_wb_writeback+0x10/0x10 [ 104.993941][ T197] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.996165][ T197] wb_workfn+0x980/0x10f0 [ 104.998109][ T197] ? __pfx_wb_workfn+0x10/0x10 [ 105.000265][ T197] ? update_protect_slice+0x45/0x320 [ 105.002529][ T197] ? lock_acquire+0x115/0x350 [ 105.004643][ T197] ? rcu_is_watching+0x16/0xb0 [ 105.006739][ T197] ? process_scheduled_works+0x97a/0x1630 [ 105.009198][ T197] process_scheduled_works+0xc3d/0x1630 [ 105.011554][ T197] ? __pfx_process_scheduled_works+0x10/0x10 [ 105.014072][ T197] ? assign_work+0x3cf/0x5d0 [ 105.016116][ T197] worker_thread+0xa47/0xfb0 [ 105.018217][ T197] ? __kthread_parkme+0x71/0x1f0 [ 105.020357][ T197] kthread+0x38b/0x480 [ 105.022143][ T197] ? __pfx_worker_thread+0x10/0x10 [ 105.024392][ T197] ? __pfx_kthread+0x10/0x10 [ 105.026376][ T197] ret_from_fork+0x514/0xb70 [ 105.028391][ T197] ? __pfx_ret_from_fork+0x10/0x10 [ 105.030583][ T197] ? __switch_to+0xc78/0x1410 [ 105.033255][ T197] ? __pfx_kthread+0x10/0x10 [ 105.035204][ T197] ret_from_fork_asm+0x1a/0x30 [ 105.037300][ T197] [ 105.122180][ T4669] Bluetooth: hci0: command tx timeout