program: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) (async, rerun: 32) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f00000000c0)={0x7, 0x9, 0xfffffffffffffffd}) (async) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000080)=ANY=[@ANYRES64=0x0], 0x1, 0x30d, &(0x7f0000000380)="$eJzs3btuE00YxvFn1k7sfInyOSQIiTIQCRoEoUE0RsgVV0CFgNhIEVYQEMShISAqhKCno+AW6GlpgrgBqKi4AKdaNLMHn2Z9SIwXi/9PijVr75x29vC+SGgF4J91tfb948Wf9s9IBRWk15elQFJZKko6rhPlRzu727vNRn1QQwVXw/4ZRTVN3z5bOw1fVVvP1YhV7FZRS53fRRYPN0lkCsPwyo+8B4HcuavfI5BKmm9vl6c4plG8OGS9vQmPY9aYlp7nPQYAQP7i538QRfJaiuP3IJA24se+iw/+tuf/mEpJoZXvOKYgHPiraamlJ1pOMq/Q2PX93/3UzvdcCmd/D5Is0dtWz/Zcz7YLH4OeANMMyyrdWIKFO9vNxrmte816oJeqxjritzX3WY9O3UTXaPvz0HXPdwMMmvuCkj58EaXLV4M5O4fNaPyPJdnxp1bH7THLqFem+WK+mhumovequ/W3iqGxy+RWqtKzUoHdapzPbtHNsmJnqfhwV6vVoGuXFdfJSXWmEsNmWfZnJErOqBV1/wOBG8Ggcbpax3pqRatzYUitVW+tzWQro9ZaVy07m/Rszu7vTzNvzXWzrl/6pFq6/nYOhehWP+DKbF81ZmPfXeXuiEfzmfd3V3RtVvrOz/7LJT2KpayhH/Te0659CAff5pDljW7rkpYfPn12t9BsNh7Ywi1P4f5S+s3cK8m7z3gFu/hHqO5pcK/9TUmh07dz8lAaseXCJGZ6dkITjAr2/jF0Z3uVTbLTEQsH/Qf8KAUjk8csRi7U9kc+kcYsxPGEDt9OueskSR6h47eT030JU9Ve9LxHgpzYuMtE+V87XylGwZ79qHjj9Mx0ozsYjlsMbYydZnDtumEUkUv6T/rckTh29OnL1RazM7j+nCvJGVMu5zp1Rjotb48+lXics8x0BPA1fdPNjvgfAAAAAAAAAAAAAAAAAAAAM2Ea/18i7zkCAAAAAAAAAAAAAAAAAAAAADDr0vf/Knn/r0Z7/2/ve1cm+f7fdzvyv/83kfGuGQBj+R0AAP//Hu11Xw==") r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) (async, rerun: 32) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x25, &(0x7f0000000000)={0x1, 0xffffffffffffffff, 0x0, {0x5, 0x7}, 0x1}, 0x1) (async) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async, rerun: 64) listen(r5, 0x0) (async, rerun: 64) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r6, 0x0, 0x15, &(0x7f0000000000)=0x3, 0x4) (async) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) (async) r7 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) ftruncate(r7, 0x2007ffc) (async) fstat(0xffffffffffffffff, 0xfffffffffffffffc) (async, rerun: 64) sendto$inet6(r3, &(0x7f0000000280), 0x0, 0x800, 0x0, 0x0) (async, rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r3, 0x40189429, &(0x7f0000000200)={0x0, 0x9, 0x9}) (async) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newlink={0x68, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}, @IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x7, 0xffffffff}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 135.239119][ T5292] Bluetooth: hci0: command tx timeout [ 135.301447][ T5335] netlink: 'syz.0.0': attribute type 1 has an invalid length. [ 135.405027][ T5338] loop0: detected capacity change from 0 to 64 [ 135.429122][ T5338] ======================================================= [ 135.429122][ T5338] WARNING: The mand mount option has been deprecated and [ 135.429122][ T5338] and is ignored by this kernel. Remove the mand [ 135.429122][ T5338] option from the mount to silence this warning. [ 135.429122][ T5338] ======================================================= [ 135.674607][ T5335] [ 135.675701][ T5335] ============================================ [ 135.678282][ T5335] WARNING: possible recursive locking detected [ 135.680840][ T5335] syzkaller #0 Not tainted [ 135.682646][ T5335] -------------------------------------------- [ 135.685581][ T5335] syz.0.0/5335 is trying to acquire lock: [ 135.689486][ T5335] ffff88805109c0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 135.695304][ T5335] [ 135.695304][ T5335] but task is already holding lock: [ 135.699043][ T5335] ffff8880510aba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 135.703216][ T5335] [ 135.703216][ T5335] other info that might help us debug this: [ 135.706919][ T5335] Possible unsafe locking scenario: [ 135.706919][ T5335] [ 135.710731][ T5335] CPU0 [ 135.712348][ T5335] ---- [ 135.713833][ T5335] lock(&HFS_I(tree->inode)->extents_lock); [ 135.716416][ T5335] lock(&HFS_I(tree->inode)->extents_lock); [ 135.719050][ T5335] [ 135.719050][ T5335] *** DEADLOCK *** [ 135.719050][ T5335] [ 135.723033][ T5335] May be due to missing lock nesting notation [ 135.723033][ T5335] [ 135.727289][ T5335] 5 locks held by syz.0.0/5335: [ 135.729402][ T5335] #0: ffff8880348c2450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 135.733325][ T5335] #1: ffff8880510ab600 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0xae3/0x3830 [ 135.737436][ T5335] #2: ffff8880331ac0a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 135.742267][ T5335] #3: ffff8880510aba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 135.747435][ T5335] #4: ffff8880347880a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 135.751273][ T5335] [ 135.751273][ T5335] stack backtrace: [ 135.753538][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 135.753552][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.753557][ T5335] Call Trace: [ 135.753565][ T5335] [ 135.753570][ T5335] dump_stack_lvl+0xe8/0x150 [ 135.753590][ T5335] print_deadlock_bug+0x279/0x290 [ 135.753606][ T5335] __lock_acquire+0x24df/0x2cf0 [ 135.753619][ T5335] ? is_bpf_text_address+0x26/0x2b0 [ 135.753634][ T5335] ? __kasan_check_byte+0x12/0x40 [ 135.753648][ T5335] ? rcu_is_watching+0x15/0xb0 [ 135.753663][ T5335] ? lock_release+0x4b/0x3c0 [ 135.753674][ T5335] ? lock_release+0x4b/0x3c0 [ 135.753687][ T5335] ? hfs_extend_file+0xf9/0x1680 [ 135.753699][ T5335] lock_acquire+0x106/0x350 [ 135.753711][ T5335] ? hfs_extend_file+0xf9/0x1680 [ 135.753724][ T5335] __mutex_lock+0x19d/0x1550 [ 135.753775][ T5335] ? hfs_extend_file+0xf9/0x1680 [ 135.753782][ T5335] ? stack_trace_save+0xa9/0x100 [ 135.753790][ T5335] ? __pfx_stack_trace_save+0x10/0x10 [ 135.753798][ T5335] ? hfs_extend_file+0xf9/0x1680 [ 135.753805][ T5335] ? __pfx___mutex_lock+0x10/0x10 [ 135.753813][ T5335] ? add_lock_to_list+0xc7/0x100 [ 135.753819][ T5335] ? lockdep_unlock+0x5d/0xd0 [ 135.753826][ T5335] ? __lock_acquire+0x13e8/0x2cf0 [ 135.753834][ T5335] ? stack_depot_save_flags+0x3ec/0x800 [ 135.753867][ T5335] hfs_extend_file+0xf9/0x1680 [ 135.753876][ T5335] ? __pfx_hfs_extend_file+0x10/0x10 [ 135.753883][ T5335] ? __mutex_trylock_common+0x15f/0x270 [ 135.753890][ T5335] ? __pfx___mutex_trylock_common+0x10/0x10 [ 135.753896][ T5335] ? rcu_is_watching+0x15/0xb0 [ 135.753906][ T5335] ? trace_contention_end+0x3d/0x140 [ 135.753916][ T5335] ? __asan_memset+0x22/0x50 [ 135.753925][ T5335] ? hfs_brec_find+0x19a/0x510 [ 135.753940][ T5335] hfs_bmap_reserve+0x108/0x430 [ 135.753954][ T5335] __hfs_ext_write_extent+0x1fc/0x470 [ 135.753968][ T5335] __hfs_ext_cache_extent+0x6e/0x9b0 [ 135.753979][ T5335] ? hfs_find_init+0x18d/0x300 [ 135.753993][ T5335] hfs_extend_file+0x3a0/0x1680 [ 135.754004][ T5335] ? __pfx___mutex_trylock_common+0x10/0x10 [ 135.754015][ T5335] ? __pfx_hfs_extend_file+0x10/0x10 [ 135.754026][ T5335] ? __mutex_lock+0x30d/0x1550 [ 135.754039][ T5335] ? hfs_find_init+0x18d/0x300 [ 135.754052][ T5335] ? __pfx___mutex_lock+0x10/0x10 [ 135.754065][ T5335] ? trace_kmalloc+0x2a/0xf0 [ 135.754076][ T5335] hfs_bmap_reserve+0x108/0x430 [ 135.754089][ T5335] hfs_cat_create+0x221/0x810 [ 135.754101][ T5335] ? __pfx_hfs_cat_create+0x10/0x10 [ 135.754111][ T5335] ? do_raw_spin_lock+0x12b/0x2f0 [ 135.754120][ T5335] ? _raw_spin_unlock+0x28/0x50 [ 135.754127][ T5335] ? hfs_new_inode+0x8b8/0xc10 [ 135.754136][ T5335] hfs_create+0x78/0xe0 [ 135.754142][ T5335] ? __pfx_hfs_create+0x10/0x10 [ 135.754149][ T5335] path_openat+0x133a/0x3830 [ 135.754162][ T5335] do_file_open+0x23e/0x4a0 [ 135.754171][ T5335] ? __pfx_do_file_open+0x10/0x10 [ 135.754181][ T5335] ? _raw_spin_unlock+0x28/0x50 [ 135.754188][ T5335] ? alloc_fd+0x651/0x6c0 [ 135.754196][ T5335] do_sys_openat2+0x115/0x200 [ 135.754207][ T5335] ? __se_sys_futex+0x3a8/0x450 [ 135.754221][ T5335] ? __pfx_do_sys_openat2+0x10/0x10 [ 135.754232][ T5335] ? rcu_is_watching+0x15/0xb0 [ 135.754246][ T5335] __x64_sys_openat+0x138/0x170 [ 135.754264][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.754275][ T5335] do_syscall_64+0x174/0x580 [ 135.754289][ T5335] ? trace_irq_disable+0x3b/0x140 [ 135.754301][ T5335] ? clear_bhb_loop+0x40/0x90 [ 135.754312][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.754323][ T5335] RIP: 0033:0x7fdaac99de59 [ 135.754334][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.754340][ T5335] RSP: 002b:00007fdaad819fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 135.754348][ T5335] RAX: ffffffffffffffda RBX: 00007fdaacc25fa0 RCX: 00007fdaac99de59 [ 135.754353][ T5335] RDX: 0000000000000042 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 135.754358][ T5335] RBP: 00007fdaaca33e6f R08: 0000000000000000 R09: 0000000000000000 [ 135.754362][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.754366][ T5335] R13: 00007fdaacc26038 R14: 00007fdaacc25fa0 R15: 00007ffe7126f1d8 [ 135.754373][ T5335]