program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") r0 = creat(&(0x7f00000002c0)='./file1\x00', 0xa) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000180)={0x0, 0x2, 0x4, {0x6, @sliced={0x0, [], 0x2}}}) ppoll(&(0x7f0000000280)=[{r1, 0x8001}], 0x1, 0x0, 0x0, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r3, &(0x7f0000000200)={0x2, @long}, 0x8) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000040)={0xb, 0x8, 0x2, 0x4000}) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) socket$kcm(0x29, 0x2, 0x0) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000140)=0x8001) qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xb5000) [ 94.502464][ T5277] Bluetooth: hci0: command tx timeout [ 94.540840][ T1021] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 94.543655][ T1021] ata1: failed to read log page 10h (errno=-5) [ 94.546261][ T1021] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 94.569254][ T1021] ata1.00: irq_stat 0x41000000 [ 94.577741][ T1021] ata1.00: failed command: WRITE FPDMA QUEUED [ 94.585591][ T5317] loop0: detected capacity change from 0 to 1024 [ 94.590213][ T1021] ata1.00: cmd 61/a8:70:0e:0a:08/05:00:00:00:00/40 tag 14 ncq dma 741376 out [ 94.590213][ T1021] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 94.611968][ T1021] ata1.00: status: { DRDY } [ 94.618485][ T1021] ata1.00: failed command: WRITE FPDMA QUEUED [ 94.627228][ T1021] ata1.00: cmd 61/e0:78:b6:0f:08/02:00:00:00:00/40 tag 15 ncq dma 376832 out [ 94.627228][ T1021] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 94.647567][ T1021] ata1.00: status: { DRDY } [ 94.656087][ T1021] ata1.00: configured for UDMA/100 [ 94.667802][ T1021] ata1: EH complete [ 94.670895][ T5317] hfsplus: can't free extent: start 2889, count 1 [ 94.775343][ T5317] [ 94.776439][ T5317] ============================================ [ 94.778968][ T5317] WARNING: possible recursive locking detected [ 94.781584][ T5317] syzkaller #0 Not tainted [ 94.783443][ T5317] -------------------------------------------- [ 94.785971][ T5317] syz.0.0/5317 is trying to acquire lock: [ 94.788324][ T5317] ffff8880502c4740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.792899][ T5317] [ 94.792899][ T5317] but task is already holding lock: [ 94.795967][ T5317] ffff8880502ca040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.800561][ T5317] [ 94.800561][ T5317] other info that might help us debug this: [ 94.803971][ T5317] Possible unsafe locking scenario: [ 94.803971][ T5317] [ 94.807139][ T5317] CPU0 [ 94.808588][ T5317] ---- [ 94.810034][ T5317] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.812425][ T5317] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.814829][ T5317] [ 94.814829][ T5317] *** DEADLOCK *** [ 94.814829][ T5317] [ 94.818268][ T5317] May be due to missing lock nesting notation [ 94.818268][ T5317] [ 94.821719][ T5317] locks held by syz.0.0/5317: 3, last CPU#0: [ 94.824319][ T5317] #0: ffff8880502ca1d8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 94.828999][ T5317] #1: ffff8880502ca040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.833722][ T5317] #2: ffff8880357980a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.837981][ T5317] [ 94.837981][ T5317] stack backtrace: [ 94.840479][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.840495][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.840502][ T5317] Call Trace: [ 94.840510][ T5317] [ 94.840516][ T5317] dump_stack_lvl+0xe8/0x150 [ 94.840537][ T5317] print_deadlock_bug+0x279/0x290 [ 94.840552][ T5317] __lock_acquire+0x24df/0x2cf0 [ 94.840571][ T5317] ? __pfx_hlock_conflict+0x10/0x10 [ 94.840584][ T5317] ? check_path+0x21/0x40 [ 94.840601][ T5317] ? check_noncircular+0xda/0x150 [ 94.840615][ T5317] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.840631][ T5317] lock_acquire+0x106/0x350 [ 94.840647][ T5317] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.840665][ T5317] __mutex_lock+0x19d/0x1550 [ 94.840728][ T5317] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.840744][ T5317] ? __bfs+0x153/0x290 [ 94.840760][ T5317] ? __pfx_hlock_conflict+0x10/0x10 [ 94.840773][ T5317] ? check_path+0x21/0x40 [ 94.840785][ T5317] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.840801][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 94.840816][ T5317] ? stack_depot_save_flags+0x404/0x7f0 [ 94.840870][ T5317] hfsplus_file_extend+0x21c/0x1df0 [ 94.840889][ T5317] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.840905][ T5317] ? __pfx___mutex_trylock_common+0x10/0x10 [ 94.840918][ T5317] ? rcu_is_watching+0x16/0xb0 [ 94.840931][ T5317] ? trace_contention_end+0x3d/0x140 [ 94.840944][ T5317] ? __asan_memset+0x22/0x50 [ 94.840956][ T5317] ? hfsplus_brec_find+0x19a/0x510 [ 94.840971][ T5317] hfsplus_bmap_reserve+0x170/0x590 [ 94.840991][ T5317] __hfsplus_ext_write_extent+0x295/0x690 [ 94.841008][ T5317] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.841023][ T5317] ? hfsplus_find_init+0x179/0x2e0 [ 94.841036][ T5317] hfsplus_file_extend+0x502/0x1df0 [ 94.841053][ T5317] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.841066][ T5317] ? clean_bdev_aliases+0x62e/0x750 [ 94.841080][ T5317] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 94.841093][ T5317] hfsplus_get_block+0x41f/0x1610 [ 94.841109][ T5317] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.841123][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.841133][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 94.841142][ T5317] ? create_empty_buffers+0x460/0x520 [ 94.841156][ T5317] __block_write_begin_int+0x6c2/0x1900 [ 94.841174][ T5317] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.841189][ T5317] ? __pfx___block_write_begin_int+0x10/0x10 [ 94.841207][ T5317] cont_write_begin+0x71b/0xac0 [ 94.841223][ T5317] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.841239][ T5317] ? __pfx_cont_write_begin+0x10/0x10 [ 94.841255][ T5317] ? rcu_is_watching+0x16/0xb0 [ 94.841268][ T5317] hfsplus_write_begin+0x126/0x1e0 [ 94.841282][ T5317] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.841299][ T5317] generic_perform_write+0x2d5/0x8f0 [ 94.841314][ T5317] ? __pfx_generic_perform_write+0x10/0x10 [ 94.841325][ T5317] ? file_update_time_flags+0x1e0/0x440 [ 94.841338][ T5317] ? __generic_file_write_iter+0xf9/0x230 [ 94.841349][ T5317] ? generic_file_write_iter+0x9a/0x330 [ 94.841360][ T5317] generic_file_write_iter+0xae/0x330 [ 94.841372][ T5317] aio_write+0x5d0/0x870 [ 94.841388][ T5317] ? __pfx_aio_write+0x10/0x10 [ 94.841404][ T5317] ? __might_fault+0xaf/0x130 [ 94.841425][ T5317] io_submit_one+0x798/0x13d0 [ 94.841439][ T5317] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.841451][ T5317] ? irqentry_exit+0x218/0x910 [ 94.841465][ T5317] ? __pfx_io_submit_one+0x10/0x10 [ 94.841477][ T5317] ? __might_fault+0xaf/0x130 [ 94.841497][ T5317] ? __might_fault+0xaf/0x130 [ 94.841514][ T5317] __se_sys_io_submit+0x195/0x340 [ 94.841526][ T5317] ? __pfx___se_sys_io_submit+0x10/0x10 [ 94.841540][ T5317] do_syscall_64+0x166/0x520 [ 94.841553][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.841568][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.841580][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.841600][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.841613][ T5317] RIP: 0033:0x7f79b0d9e0d9 [ 94.841626][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.841636][ T5317] RSP: 002b:00007f79b1cc8fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 94.841649][ T5317] RAX: ffffffffffffffda RBX: 00007f79b1025fa0 RCX: 00007f79b0d9e0d9 [ 94.841657][ T5317] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f79b1c7f000 [ 94.841666][ T5317] RBP: 00007f79b0e35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.841674][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.841681][ T5317] R13: 00007f79b1026038 R14: 00007f79b1025fa0 R15: 00007ffd24a58908 [ 94.841695][ T5317]