program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) setrlimit(0x2, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x90000, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x81}}, {@default_permissions}, {@allow_other}, {@blksize}], [{@euid_eq={'euid', 0x3d, 0xee01}}, {@euid_lt={'euid<', 0xee00}}, {@appraise}, {@smackfsroot={'smackfsroot', 0x3d, 'memory.stat\x00'}}]}}, 0x0, 0x0, &(0x7f0000000500)="8e9387f4a37a233c430e28fbcbbebcbd6d8c6e01") r2 = openat(r1, &(0x7f0000000240)='./dev/sda\x00', 0x90aca5782df8efe3, 0x30) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x10, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='127.0.0.1:file0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000140)='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,minorversion=1\x00') r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x4c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xb, 0x8}, {}, {0x8, 0xffff}}, [@filter_kind_options=@f_u32={{0x8}, {0x20, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0xd, 0x6, 0x0, 0xfffd, 0x17, 0x9, 0x4, 0x8}}, @TCA_U32_FLAGS={0x8, 0xb, 0x2}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f00000002c0)={0x2, 0x6}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32658aeb}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xd0}}, 0x0) syz_emit_ethernet(0x3b, &(0x7f00000004c0)={@local, @random="429e82211cf8", @void, {@ipv6={0x86dd, @generic={0xa, 0x6, '\b\x00', 0x5, 0x3c, 0x0, @remote, @local, {[], "fde7a4a2d2"}}}}}, 0x0) socket$tipc(0x1e, 0x2, 0x0) [ 93.595876][ T5276] Bluetooth: hci0: command tx timeout [ 93.672566][ T5316] loop0: detected capacity change from 0 to 64 [ 93.681874][ T5316] ======================================================= [ 93.681874][ T5316] WARNING: The mand mount option has been deprecated and [ 93.681874][ T5316] and is ignored by this kernel. Remove the mand [ 93.681874][ T5316] option from the mount to silence this warning. [ 93.681874][ T5316] ======================================================= [ 94.746705][ T5316] hfs: request for non-existent node 8 in B*Tree [ 94.749640][ T5316] hfs: request for non-existent node 8 in B*Tree [ 94.844446][ T5316] [ 94.845597][ T5316] ====================================================== [ 94.848652][ T5316] WARNING: possible circular locking dependency detected [ 94.851771][ T5316] syzkaller #0 Not tainted [ 94.853792][ T5316] ------------------------------------------------------ [ 94.856758][ T5316] syz.0.0/5316 is trying to acquire lock: [ 94.859242][ T5316] ffff8880127520a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 94.863440][ T5316] [ 94.863440][ T5316] but task is already holding lock: [ 94.866679][ T5316] ffff888012327a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 94.871201][ T5316] [ 94.871201][ T5316] which lock already depends on the new lock. [ 94.871201][ T5316] [ 94.875611][ T5316] [ 94.875611][ T5316] the existing dependency chain (in reverse order) is: [ 94.879471][ T5316] [ 94.879471][ T5316] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 94.883558][ T5316] __mutex_lock+0x19d/0x1550 [ 94.885859][ T5316] hfs_extend_file+0xf9/0x1680 [ 94.888237][ T5316] hfs_bmap_reserve+0x108/0x430 [ 94.890620][ T5316] __hfs_ext_write_extent+0x1fc/0x470 [ 94.893160][ T5316] __hfs_ext_cache_extent+0x6e/0x9b0 [ 94.895706][ T5316] hfs_extend_file+0x3ad/0x1680 [ 94.898127][ T5316] hfs_get_block+0x401/0xbf0 [ 94.900446][ T5316] __block_write_begin_int+0x6c2/0x1900 [ 94.903110][ T5316] cont_write_begin+0x71b/0xac0 [ 94.905486][ T5316] hfs_write_begin+0x123/0x1c0 [ 94.907788][ T5316] generic_perform_write+0x2d5/0x8f0 [ 94.910349][ T5316] generic_file_write_iter+0xae/0x330 [ 94.912895][ T5316] vfs_write+0x612/0xba0 [ 94.915045][ T5316] ksys_write+0x150/0x270 [ 94.917229][ T5316] do_syscall_64+0x166/0x520 [ 94.919455][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.922257][ T5316] [ 94.922257][ T5316] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 94.925616][ T5316] __lock_acquire+0x1520/0x2cf0 [ 94.927985][ T5316] lock_acquire+0x106/0x350 [ 94.930147][ T5316] __mutex_lock+0x19d/0x1550 [ 94.932243][ T5316] hfs_find_init+0x18d/0x300 [ 94.934322][ T5316] hfs_extend_file+0x367/0x1680 [ 94.936483][ T5316] hfs_bmap_reserve+0x108/0x430 [ 94.938658][ T5316] hfs_cat_create+0x23d/0x870 [ 94.940783][ T5316] hfs_mkdir+0x73/0xe0 [ 94.942698][ T5316] vfs_mkdir+0x40c/0x620 [ 94.944662][ T5316] filename_mkdirat+0x285/0x510 [ 94.946944][ T5316] __se_sys_mkdirat+0x35/0x150 [ 94.949123][ T5316] do_syscall_64+0x166/0x520 [ 94.951409][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.954142][ T5316] [ 94.954142][ T5316] other info that might help us debug this: [ 94.954142][ T5316] [ 94.958465][ T5316] Possible unsafe locking scenario: [ 94.958465][ T5316] [ 94.961648][ T5316] CPU0 CPU1 [ 94.963892][ T5316] ---- ---- [ 94.966310][ T5316] lock(&HFS_I(tree->inode)->extents_lock); [ 94.968932][ T5316] lock(&tree->tree_lock/1); [ 94.972083][ T5316] lock(&HFS_I(tree->inode)->extents_lock); [ 94.975808][ T5316] lock(&tree->tree_lock/1); [ 94.977861][ T5316] [ 94.977861][ T5316] *** DEADLOCK *** [ 94.977861][ T5316] [ 94.981467][ T5316] locks held by syz.0.0/5316: 4, last CPU#0: [ 94.984112][ T5316] #0: ffff888012d0e460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 94.988043][ T5316] #1: ffff888012327600 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 94.992492][ T5316] #2: ffff8880127500a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 94.996559][ T5316] #3: ffff888012327a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.001061][ T5316] [ 95.001061][ T5316] stack backtrace: [ 95.003574][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.003589][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.003598][ T5316] Call Trace: [ 95.003605][ T5316] [ 95.003611][ T5316] dump_stack_lvl+0xe8/0x150 [ 95.003630][ T5316] print_circular_bug+0x2e1/0x300 [ 95.003644][ T5316] check_noncircular+0x12e/0x150 [ 95.003657][ T5316] __lock_acquire+0x1520/0x2cf0 [ 95.003676][ T5316] ? stack_depot_save_flags+0x404/0x7f0 [ 95.003734][ T5316] ? __kmalloc_noprof+0x1af/0x720 [ 95.003746][ T5316] ? kasan_save_track+0x4f/0x80 [ 95.003757][ T5316] ? kasan_save_track+0x3e/0x80 [ 95.003767][ T5316] ? __kasan_kmalloc+0x93/0xb0 [ 95.003778][ T5316] ? __kmalloc_noprof+0x379/0x720 [ 95.003789][ T5316] ? hfs_find_init+0x9d/0x300 [ 95.003801][ T5316] ? hfs_extend_file+0x367/0x1680 [ 95.003810][ T5316] ? hfs_bmap_reserve+0x108/0x430 [ 95.003825][ T5316] ? hfs_cat_create+0x23d/0x870 [ 95.003840][ T5316] ? hfs_mkdir+0x73/0xe0 [ 95.003849][ T5316] ? vfs_mkdir+0x40c/0x620 [ 95.003859][ T5316] ? hfs_find_init+0x18d/0x300 [ 95.003870][ T5316] lock_acquire+0x106/0x350 [ 95.003882][ T5316] ? hfs_find_init+0x18d/0x300 [ 95.003900][ T5316] __mutex_lock+0x19d/0x1550 [ 95.003914][ T5316] ? hfs_find_init+0x18d/0x300 [ 95.003931][ T5316] ? hfs_find_init+0x18d/0x300 [ 95.003946][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 95.003960][ T5316] ? trace_kmalloc+0x2a/0xf0 [ 95.003978][ T5316] ? __kmalloc_noprof+0x39a/0x720 [ 95.003992][ T5316] ? __kmalloc_noprof+0x1af/0x720 [ 95.004002][ T5316] ? hfs_find_init+0x9d/0x300 [ 95.004018][ T5316] hfs_find_init+0x18d/0x300 [ 95.004033][ T5316] hfs_extend_file+0x367/0x1680 [ 95.004045][ T5316] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.004059][ T5316] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.004070][ T5316] ? __mutex_lock+0x30b/0x1550 [ 95.004084][ T5316] ? hfs_find_init+0x18d/0x300 [ 95.004099][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 95.004110][ T5316] ? trace_kmalloc+0x2a/0xf0 [ 95.004120][ T5316] hfs_bmap_reserve+0x108/0x430 [ 95.004138][ T5316] hfs_cat_create+0x23d/0x870 [ 95.004155][ T5316] ? __pfx_hfs_cat_create+0x10/0x10 [ 95.004176][ T5316] ? _raw_spin_unlock+0x28/0x50 [ 95.004185][ T5316] ? hfs_new_inode+0x8e8/0xc50 [ 95.004197][ T5316] hfs_mkdir+0x73/0xe0 [ 95.004208][ T5316] vfs_mkdir+0x40c/0x620 [ 95.004221][ T5316] filename_mkdirat+0x285/0x510 [ 95.004236][ T5316] ? __pfx_filename_mkdirat+0x10/0x10 [ 95.004250][ T5316] ? do_getname+0x151/0x250 [ 95.004263][ T5316] __se_sys_mkdirat+0x35/0x150 [ 95.004276][ T5316] do_syscall_64+0x166/0x520 [ 95.004289][ T5316] ? trace_irq_disable+0x3b/0x140 [ 95.004302][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.004313][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 95.004325][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.004337][ T5316] RIP: 0033:0x7fa6d2d9e0d9 [ 95.004348][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.004358][ T5316] RSP: 002b:00007fa6d3bb4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 95.004371][ T5316] RAX: ffffffffffffffda RBX: 00007fa6d3025fa0 RCX: 00007fa6d2d9e0d9 [ 95.004380][ T5316] RDX: 00000000000001ff RSI: 0000200000000040 RDI: ffffffffffffff9c [ 95.004387][ T5316] RBP: 00007fa6d2e35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.004395][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.004401][ T5316] R13: 00007fa6d3026038 R14: 00007fa6d3025fa0 R15: 00007ffd841ae588 [ 95.004412][ T5316]