program: r0 = syz_mount_image$hfs(&(0x7f0000000340), &(0x7f00000004c0)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d472968786c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc107102000000dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000f3069fe8", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32b, &(0x7f0000000b40)="$eJzs3U1rE0EYB/D/TJJma2PdvojgsVrQi2i9iJeI5CsI4kG0bYRiqKgV1IupeBLRu3e/gh/Ci+IX0JMH8Sq0F0dmdnazL7MvaRvX6v8H4mZ2J/tMZjbzTFAGRPTfutr78u7iN/1HAA00gJeXAQnAA5oAjuOE92hza2Nr0F8veqOGqYFdBYGgpshcs7bZN39vJ4t1PVPD8vWrJjrxMpoMpdSVr6my77KmYKg25ul3kEDbPp3mvPfHIyu2XeUix3geTiCWw0TsYAePMVt3HEREVC89/28HM6We5zs2f5cSWI7P+n/b/F/N0UzJz1rimLCp+AtVeGls/jerLCV0vx8zp0brPbOE0+dluEqsEkbLFZZMJZjCvaocLflMLHL6zsagf27t3mBd4jm6VqzCYrrheoSWRLvkWJsWqNB24cwog7BkS7dhJSf+hT3esUAm3U10iPggPombwsdbrEf5X1MJHa0J2E/1VBD/+fz7zZha+irYr41utyvNG4XmzE1OJnsqv5VmFHjuFQnCD3YOyR8I/LI4Ta35VK2gdRecFdpRrQVnrZXwVc69FhO1dGui0Zwf5cFQz/LOiNfiuljCD7xHL5b/Sx3fMrJPZqwTRk+NsJOC+cSD9ky5b9c07+lnZo4hbnSSJdGn2M4LfVcJ/iS0T2EfvsIqLmH24ZOndxuDQf+BPrjtOLjfiUpaLwDnNTUfYDgqaUMZmYvD78BE9WlbOMZNG2MEdvZAW6ofxNKL9VOWPhW2MiyRjmvGPoiPhPCBPbA+hax/aBWNjd7H1EAqPVCNas+OajtHuF/e7zmnfqk9tD2bL9O/adTpdUdCNdHTgQjWfyaTt/m+ydd0tnCtnb8aCReZrpTNJI72HZXOsaMVkJeoP2+OjiTT6JIV0IzNYxzruCEyay4992fWXKfOAKer39G3cR4O+em/JXr4jFv8/Z+IiIiIiIiIiIiIiIiIiIiIiIiI6LAZ/39HTI9Zq8V/WU5EREREREREREREREREREREREREREREtE/R/r8I9/9Ftf1/09tL2f1/PZTs/7uajSGz/++bTYghwP1/iSbrdwAAAP//kWVv8w==") creat(&(0x7f0000000380)='./file0\x00', 0x44) mount(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='ceph\x00', 0x4, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000980)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000009c0)=0x7) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file3\x00', 0x105042, 0x0) mount(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000080)='nfs\x00', 0x0, &(0x7f00000000c0)='acl') r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000140), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000fddbdf25020000000c001100", @ANYRES32=r4, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x8081}, 0x884) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r5, &(0x7f0000000a40)={0x18}, 0xfffffdef) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r5, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file1\x00'}) ioctl(r0, 0x7, &(0x7f00000003c0)="f1203dbb02fe9ad8d71328b2f92d57e23816a01913e228b953f034a1ae7c31902e09269ce5fed051cbc1f750681ccae0c135f9de6f7cb3cf0b47dcca838c7bec27342fa8bc61128cc4c7509811862d71e043df720d6a859d97c1d5c914ef802912f54dd3bf7c40ca313bad5a104087b11ae55b0624a6abc60cd95ca72ce1eb7b790697d8a5e7cf658a8ae63282e2bc13e6ecd88f3aee43276ae04470fe779d2ccc7e8b2d3196786a8c0fc99ac891023f0800246c76c2191de11f67698856baaa16545585c325d236f2648918fc751a48b576d11085de9723b88aed63a1b31c45f61160c983c6") r6 = syz_open_dev$radio(&(0x7f00000002c0), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r6, 0x40305652, &(0x7f0000000300)={0x0, 0x1, 0x0, 0x0, 0x0, 0x8fc0, 0x65f40}) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000b00)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x6}}, 0x20) [ 93.588154][ T4649] Bluetooth: hci0: command tx timeout [ 93.607958][ T809] cfg80211: failed to load regulatory.db [ 93.654687][ T5330] loop0: detected capacity change from 0 to 64 [ 93.840109][ T5330] ceph: Bad value for 'source' [ 94.793490][ T5330] syz.0.0: attempt to access beyond end of device [ 94.793490][ T5330] loop0: rw=8388608, sector=25903, nr_sectors = 1 limit=64 [ 94.793704][ T5330] Buffer I/O error on dev loop0, logical block 25903, async page read [ 94.793734][ T5330] syz.0.0: attempt to access beyond end of device [ 94.793734][ T5330] loop0: rw=8388608, sector=26319, nr_sectors = 1 limit=64 [ 94.793747][ T5330] Buffer I/O error on dev loop0, logical block 26319, async page read [ 94.793761][ T5330] syz.0.0: attempt to access beyond end of device [ 94.793761][ T5330] loop0: rw=8388608, sector=26320, nr_sectors = 1 limit=64 [ 94.793773][ T5330] Buffer I/O error on dev loop0, logical block 26320, async page read [ 94.840465][ T25] audit: type=1800 audit(1792532632.682:2): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file3" dev="loop0" ino=22 res=0 errno=0 [ 94.948161][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948161][ T1067] loop0: rw=8388609, sector=161, nr_sectors = 1 limit=64 [ 94.948189][ T1067] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 94.948224][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948224][ T1067] loop0: rw=8388609, sector=162, nr_sectors = 1 limit=64 [ 94.948236][ T1067] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 94.948246][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948246][ T1067] loop0: rw=8388609, sector=163, nr_sectors = 1 limit=64 [ 94.948257][ T1067] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 94.948267][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948267][ T1067] loop0: rw=8388609, sector=167, nr_sectors = 1 limit=64 [ 94.948278][ T1067] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 94.948288][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948288][ T1067] loop0: rw=8388609, sector=169, nr_sectors = 1 limit=64 [ 94.948298][ T1067] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 94.948308][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948308][ T1067] loop0: rw=8388609, sector=171, nr_sectors = 1 limit=64 [ 94.948319][ T1067] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 94.948329][ T1067] kworker/u4:12: attempt to access beyond end of device [ 94.948329][ T1067] loop0: rw=8388609, sector=172, nr_sectors = 1 limit=64 [ 94.948340][ T1067] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 95.070946][ T1067] [ 95.140924][ T1067] ============================================ [ 95.143535][ T1067] WARNING: possible recursive locking detected [ 95.146183][ T1067] syzkaller #0 Not tainted [ 95.148151][ T1067] -------------------------------------------- [ 95.150600][ T1067] kworker/u4:12/1067 is trying to acquire lock: [ 95.153293][ T1067] ffff8880439620a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.157411][ T1067] [ 95.157411][ T1067] but task is already holding lock: [ 95.160609][ T1067] ffff8880439620a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.164589][ T1067] [ 95.164589][ T1067] other info that might help us debug this: [ 95.168041][ T1067] Possible unsafe locking scenario: [ 95.168041][ T1067] [ 95.171188][ T1067] CPU0 [ 95.172640][ T1067] ---- [ 95.174137][ T1067] lock(&tree->tree_lock/1); [ 95.176173][ T1067] lock(&tree->tree_lock/1); [ 95.178127][ T1067] [ 95.178127][ T1067] *** DEADLOCK *** [ 95.178127][ T1067] [ 95.181387][ T1067] May be due to missing lock nesting notation [ 95.181387][ T1067] [ 95.184846][ T1067] locks held by kworker/u4:12/1067: 5, last CPU#0: [ 95.187656][ T1067] #0: ffff88801cfb5940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 95.192286][ T1067] #1: ffffc9000166fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 95.197611][ T1067] #2: ffff888035f240e8 (&type->s_umount_key#54){.+.+}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 95.202248][ T1067] #3: ffff8880439620a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 95.206627][ T1067] #4: ffff888053c880a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 95.211100][ T1067] [ 95.211100][ T1067] stack backtrace: [ 95.216234][ T1067] CPU: 0 UID: 0 PID: 1067 Comm: kworker/u4:12 Not tainted syzkaller #0 PREEMPT(full) [ 95.220458][ T1067] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.224576][ T1067] Workqueue: writeback wb_workfn (flush-7:0) [ 95.230804][ T1067] Call Trace: [ 95.232404][ T1067] [ 95.233862][ T1067] dump_stack_lvl+0xe8/0x150 [ 95.235991][ T1067] print_deadlock_bug+0x27a/0x290 [ 95.238247][ T1067] __lock_acquire+0x25db/0x2de0 [ 95.240425][ T1067] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.243073][ T1067] ? stack_depot_save_flags+0x404/0x7f0 [ 95.245431][ T1067] ? kasan_save_track+0x4f/0x80 [ 95.247548][ T1067] ? kasan_save_track+0x3e/0x80 [ 95.249702][ T1067] ? __kasan_kmalloc+0x93/0xb0 [ 95.251787][ T1067] ? __kmalloc_noprof+0x36b/0x720 [ 95.254028][ T1067] ? hfs_find_init+0x9d/0x300 [ 95.256261][ T1067] ? hfs_extend_file+0x367/0x1680 [ 95.258442][ T1067] ? hfs_bmap_reserve+0x108/0x430 [ 95.260593][ T1067] ? __hfs_ext_write_extent+0x1fc/0x470 [ 95.262747][ T1067] lock_acquire+0x115/0x350 [ 95.264551][ T1067] ? hfs_find_init+0x18d/0x300 [ 95.266468][ T1067] __mutex_lock+0x19c/0x15a0 [ 95.268324][ T1067] ? hfs_find_init+0x18d/0x300 [ 95.270338][ T1067] ? hfs_find_init+0x18d/0x300 [ 95.272333][ T1067] ? __pfx___mutex_lock+0x10/0x10 [ 95.274478][ T1067] ? rcu_is_watching+0x16/0xb0 [ 95.276472][ T1067] ? trace_kmalloc+0x2a/0xf0 [ 95.278404][ T1067] ? __kmalloc_noprof+0x38c/0x720 [ 95.280463][ T1067] ? __kmalloc_noprof+0x1ab/0x720 [ 95.282497][ T1067] ? hfs_find_init+0x9d/0x300 [ 95.284443][ T1067] hfs_find_init+0x18d/0x300 [ 95.286382][ T1067] hfs_extend_file+0x367/0x1680 [ 95.288388][ T1067] ? __pfx_hfs_extend_file+0x10/0x10 [ 95.290543][ T1067] ? _raw_spin_unlock+0x28/0x50 [ 95.292537][ T1067] ? hfs_brec_find+0x3db/0x510 [ 95.294401][ T1067] hfs_bmap_reserve+0x108/0x430 [ 95.296533][ T1067] __hfs_ext_write_extent+0x1fc/0x470 [ 95.298838][ T1067] hfs_ext_write_extent+0x17d/0x210 [ 95.301117][ T1067] ? __pfx___mpage_writepages+0x10/0x10 [ 95.303503][ T1067] ? __pfx_hfs_ext_write_extent+0x10/0x10 [ 95.306068][ T1067] hfs_write_inode+0x117/0xa00 [ 95.308283][ T1067] ? __pfx_hfs_write_inode+0x10/0x10 [ 95.310719][ T1067] ? do_raw_spin_unlock+0x4d/0x200 [ 95.313090][ T1067] ? do_raw_spin_unlock+0x4d/0x200 [ 95.315416][ T1067] __writeback_single_inode+0x69d/0x1220 [ 95.317957][ T1067] writeback_sb_inodes+0x9de/0x1b00 [ 95.320318][ T1067] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 95.322866][ T1067] ? __pfx_down_read_trylock+0x10/0x10 [ 95.325334][ T1067] __writeback_inodes_wb+0x114/0x240 [ 95.327543][ T1067] wb_writeback+0x42f/0xad0 [ 95.329566][ T1067] ? queue_io+0x261/0x470 [ 95.331498][ T1067] ? __pfx_wb_writeback+0x10/0x10 [ 95.333785][ T1067] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.336027][ T1067] wb_workfn+0x980/0x10f0 [ 95.337933][ T1067] ? __lock_acquire+0x747/0x2de0 [ 95.339748][ T1067] ? __pfx_wb_workfn+0x10/0x10 [ 95.341835][ T1067] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.344081][ T1067] ? lock_acquire+0x115/0x350 [ 95.346007][ T1067] ? rcu_is_watching+0x16/0xb0 [ 95.348055][ T1067] ? process_scheduled_works+0x97a/0x1630 [ 95.350468][ T1067] process_scheduled_works+0xc3d/0x1630 [ 95.352930][ T1067] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.355592][ T1067] ? assign_work+0x3cf/0x5d0 [ 95.357670][ T1067] worker_thread+0xa47/0xfb0 [ 95.359771][ T1067] ? __kthread_parkme+0x71/0x1f0 [ 95.362055][ T1067] kthread+0x38b/0x480 [ 95.363945][ T1067] ? __pfx_worker_thread+0x10/0x10 [ 95.366239][ T1067] ? __pfx_kthread+0x10/0x10 [ 95.368296][ T1067] ret_from_fork+0x514/0xb70 [ 95.370415][ T1067] ? __pfx_ret_from_fork+0x10/0x10 [ 95.372705][ T1067] ? __switch_to+0xc89/0x1420 [ 95.374693][ T1067] ? __pfx_kthread+0x10/0x10 [ 95.376747][ T1067] ret_from_fork_asm+0x1a/0x30 [ 95.378931][ T1067]