program: syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fc000000000000"], 0x1c}}, 0x0) r2 = syz_mount_image$hfsplus(&(0x7f0000000300), &(0x7f0000000140)='./file1\x00', 0x1008400, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0x85, 0x696, &(0x7f0000001180)="$eJzs3c1vHGcdB/DvrNcvG0ripkmbokqJGgkQEYkdKwVzaUAI5VChqhw4W4mTWNmkxXGRWyFq3q895A8oh9w4ICTuEeXCBW494mMlBJdeMKdFMzu73vjdiV8a9/OpxvPMPG+/+e3M7FujDfCFde1Cmo9S5NqFNxbL7eWHU+3lh1N3B5qMJmkkze4qxX87nc7HydV0l7xc7qzbFpvN82Bu+q1PPlv+tD9iNV7VvrFVv51ZqpecSzJUr/dqvOvbjTe23XBF/wjLhJ3vJQ4O23CSTuXfD7p7fvK35/o1A1ob9d72zAeeAUX3eXOd8eRYfaFXz9pL3d2Ng41u7y0ddgAAAADwBJq7bH9iJStZzPF9CgcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACOpPr3/4t6afTK51L0fv9/pN6Xuvz5cnZ3zR/tVxwAAAAAAAAAcIDOrmQlizne2+4U1Xf+r1Ybp6q/X8q7Gcts5nMxi5nJQhYyn8kk4wMDjSzOLCzMT/Z79v7PgPvrel7esOflbQIdrdetvThqAAAAAAAAADhyfplrq9//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA50GRDHVX1XKqVx5Po5lkLMlI2W4p+Uev/Cx7dNgBAAAAwFPoDJTHtmh3YiUrWczxfr+ies//YvW+fyzv5l4WMpeFtDObG9VnAd13/Y3lh1Pt5YdTd8tl/bjf/c+uwq1GTPezh41nPlO1aOVm5qo9F3M9b6cobqRR9Syd6cWzcVy/KGMqXu8a3mFkN+p1eeQf1us1Grs61M3t8sOU8Wrq4X5GJurYynCe3zoTu3x01s40mUY/2FNrZlpzEI/l/PUdznesXpfH89uNc75vlrasXZuJywNn34tb5zz52p//8OPb7Xt3bt+8f+EgD2kvDNXr7n2ltT4TUwOZeOkIZGKn94dkosrE6f72tfwgP8qFnMubmc9cfpqZLGQ25/L9qjRTn8/FwCW/SaauPrb15naRjNRnaPfBejymbBPTq1Xf45nLD/N2bmQ2r1X/Xc5kvpUruZLpgUf49A7utI3eVX/i8crOlzcM/vzX60Irye/qdeVWc33rvbrnbmBo3Z4yr88P5HU4H/TvueNV3eBdeDVLJ3fxfNS7N/5x6+CaX6kL5Ry/2t9E7NLaTEwOZOKFrTPx++q2cr9978787Zl3djbdyQ/rQnkd/eaAnyW2Vp4vJ8sHq9p6/Owo616o64arZTVfI/U3Lt1+jXV1p/t13St1adMrdaR+Dbd+pMtV3Usb1k1VdWcG6ta+3mr3Xw8dhS9/AI6sY984NtL6V+vvrY9av27dbr0x9r3Rb4++MpLhvw5/pzkx9NXGK8Wf8lF+vvr+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHL333v/zky7PTu/ptDpdD7YpOpZLvR+4+kAJ335ueSwDnkkyd4N+M+n6P6/TqdT7ymeLoyx0WS/U9cpjabzhN3/kmRnjZtJNqo6e+hXSvuQb0zAvru0cPedS/ffe/+bc3dnbs3emr03feXK9MT0ldemLt2ca89OdP8edpTAflh90j/sSAAAAAAAAAAAAICdOoh/TrB2zrENSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACbuXYhzUcpMjlxcaLcXn441S6XXnm1ZTNJI0nxs6T4OLma7pLxgeGKzeZ5MDf91iefLX+6Olaz176xVb+dWaqXnEsyVK/3arzrTz1e0T/CMmHne4mDw/b/AAAA//8CLgKv") openat(r2, &(0x7f0000000000)='./file1\x00', 0x141a42, 0x1c2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0xfea7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) (async) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) (async) open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) (async) io_setup(0x1, &(0x7f00000004c0)=0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x0) io_submit(r4, 0x1, &(0x7f00000002c0)=[&(0x7f0000000040)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x7, r5, &(0x7f0000000500)="840e9e87d40d79da1cf69055ebceb97e4bc9be3aa193b8cc110dca9f409847730b11c4a281a25ec7c8fbbfc4a5e859f8b1ccf1c7bc2147fe4181f0ff23592c5bf46b7ec1c4a39483f24c82548bab41572a1f3bb39642a075dba6749bdf7391479be4ac889e576ba4d26ec8f058dd60b7fcb9c8a3735f62a6e96f347609a275483cba6fda0399484e0e8332c77561392eb2c5e076f9af3e533b4d89078c482613f37d23a7d0a5b956c64cff22e69c9452ee5118bfc3054281a4", 0xb9, 0x9fd}]) (async) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x2, 0x0, 0x10001}) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x111) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000800)={'bond0\x00', 0x0}) (async) r9 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r9, 0x0, 0xcc, &(0x7f0000000000)={@broadcast, @empty, 0x0, "53ea6f3a98b2fd0a67a479c1a6d0c0a530d50539d27a63c3a17c15ad04230dc3", 0x7ff, 0x101, 0x96, 0x3}, 0x3c) (async) setsockopt$MRT_FLUSH(r9, 0x0, 0xd4, &(0x7f0000001140)=0x5, 0x4) (async) r10 = socket(0x11, 0x3, 0x0) sendto$packet(r10, &(0x7f0000000840)="1412e0c84935a9738e0ff2f70800", 0xe, 0x0, &(0x7f00000007c0)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) pwrite64(r6, &(0x7f0000000140)='2', 0xfdef, 0xe7c) (async) r11 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000001c0)={'ip6tnl0\x00'}) (async) r12 = syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x0) syz_usb_disconnect(r12) r13 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_ep_write(r13, 0x81, 0x0, 0x0) [ 93.499674][ T10] cfg80211: failed to load regulatory.db [ 93.512881][ T4648] Bluetooth: hci0: command tx timeout [ 93.695593][ T5321] loop0: detected capacity change from 0 to 1024 [ 93.819336][ T5321] [ 93.820418][ T5321] ====================================================== [ 93.823344][ T5321] WARNING: possible circular locking dependency detected [ 93.826273][ T5321] syzkaller #0 Not tainted [ 93.828203][ T5321] ------------------------------------------------------ [ 93.831111][ T5321] syz.0.0/5321 is trying to acquire lock: [ 93.833508][ T5321] ffff888052b620f0 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_block_allocate+0xa9/0xd30 [ 93.837848][ T5321] [ 93.837848][ T5321] but task is already holding lock: [ 93.841779][ T5321] ffff888051915a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 93.846834][ T5321] [ 93.846834][ T5321] which lock already depends on the new lock. [ 93.846834][ T5321] [ 93.851146][ T5321] [ 93.851146][ T5321] the existing dependency chain (in reverse order) is: [ 93.855247][ T5321] [ 93.855247][ T5321] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 93.860429][ T5321] __mutex_lock+0x19d/0x1550 [ 93.862694][ T5321] hfsplus_get_block+0x391/0x1610 [ 93.865087][ T5321] block_read_full_folio+0x29f/0x810 [ 93.867624][ T5321] filemap_read_folio+0x12c/0x3a0 [ 93.870057][ T5321] do_read_cache_folio+0x354/0x590 [ 93.872611][ T5321] read_cache_page+0x5d/0x170 [ 93.875276][ T5321] hfsplus_block_allocate+0xf7/0xd30 [ 93.877964][ T5321] hfsplus_file_extend+0xb77/0x1df0 [ 93.880214][ T5321] hfsplus_get_block+0x41f/0x1610 [ 93.882357][ T5321] __block_write_begin_int+0x6c2/0x1900 [ 93.884650][ T5321] cont_write_begin+0x71b/0xac0 [ 93.886555][ T5321] hfsplus_write_begin+0x66/0xb0 [ 93.888528][ T5321] generic_perform_write+0x2d5/0x8f0 [ 93.890532][ T5321] generic_file_write_iter+0xae/0x330 [ 93.892570][ T5321] vfs_write+0x612/0xba0 [ 93.894140][ T5321] ksys_write+0x150/0x270 [ 93.895821][ T5321] do_syscall_64+0x174/0x580 [ 93.897626][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.899911][ T5321] [ 93.899911][ T5321] -> #0 (&sbi->alloc_mutex){+.+.}-{4:4}: [ 93.902681][ T5321] __lock_acquire+0x1520/0x2cf0 [ 93.904665][ T5321] lock_acquire+0x106/0x350 [ 93.906598][ T5321] __mutex_lock+0x19d/0x1550 [ 93.908475][ T5321] hfsplus_block_allocate+0xa9/0xd30 [ 93.910810][ T5321] hfsplus_file_extend+0xb77/0x1df0 [ 93.913109][ T5321] hfsplus_get_block+0x41f/0x1610 [ 93.915385][ T5321] __block_write_begin_int+0x6c2/0x1900 [ 93.917946][ T5321] cont_write_begin+0x71b/0xac0 [ 93.920262][ T5321] hfsplus_write_begin+0x66/0xb0 [ 93.922201][ T5321] cont_write_begin+0x7b2/0xac0 [ 93.924103][ T5321] hfsplus_write_begin+0x66/0xb0 [ 93.926161][ T5321] generic_perform_write+0x2d5/0x8f0 [ 93.928333][ T5321] generic_file_write_iter+0xae/0x330 [ 93.930515][ T5321] aio_write+0x5cd/0x870 [ 93.932422][ T5321] io_submit_one+0x798/0x13d0 [ 93.934673][ T5321] __se_sys_io_submit+0x195/0x340 [ 93.936969][ T5321] do_syscall_64+0x174/0x580 [ 93.939131][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.941758][ T5321] [ 93.941758][ T5321] other info that might help us debug this: [ 93.941758][ T5321] [ 93.945931][ T5321] Possible unsafe locking scenario: [ 93.945931][ T5321] [ 93.949086][ T5321] CPU0 CPU1 [ 93.951383][ T5321] ---- ---- [ 93.953417][ T5321] lock(&HFSPLUS_I(inode)->extents_lock); [ 93.955407][ T5321] lock(&sbi->alloc_mutex); [ 93.957957][ T5321] lock(&HFSPLUS_I(inode)->extents_lock); [ 93.960750][ T5321] lock(&sbi->alloc_mutex); [ 93.962461][ T5321] [ 93.962461][ T5321] *** DEADLOCK *** [ 93.962461][ T5321] [ 93.965536][ T5321] 2 locks held by syz.0.0/5321: [ 93.967421][ T5321] #0: ffff888051915b98 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 93.971796][ T5321] #1: ffff888051915a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 93.976057][ T5321] [ 93.976057][ T5321] stack backtrace: [ 93.978177][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.978191][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.978198][ T5321] Call Trace: [ 93.978206][ T5321] [ 93.978211][ T5321] dump_stack_lvl+0xe8/0x150 [ 93.978231][ T5321] print_circular_bug+0x2e1/0x300 [ 93.978240][ T5321] check_noncircular+0x12e/0x150 [ 93.978247][ T5321] __lock_acquire+0x1520/0x2cf0 [ 93.978258][ T5321] ? check_path+0x21/0x40 [ 93.978263][ T5321] ? check_noncircular+0xda/0x150 [ 93.978269][ T5321] ? add_lock_to_list+0xc7/0x100 [ 93.978275][ T5321] ? lockdep_unlock+0x5d/0xd0 [ 93.978283][ T5321] ? __lock_acquire+0x13e8/0x2cf0 [ 93.978293][ T5321] ? hfsplus_block_allocate+0xa9/0xd30 [ 93.978304][ T5321] lock_acquire+0x106/0x350 [ 93.978312][ T5321] ? hfsplus_block_allocate+0xa9/0xd30 [ 93.978322][ T5321] __mutex_lock+0x19d/0x1550 [ 93.978332][ T5321] ? hfsplus_block_allocate+0xa9/0xd30 [ 93.978345][ T5321] ? __pfx___mutex_trylock_common+0x10/0x10 [ 93.978356][ T5321] ? hfsplus_block_allocate+0xa9/0xd30 [ 93.978368][ T5321] ? trace_contention_end+0x3d/0x140 [ 93.978378][ T5321] ? __pfx___mutex_lock+0x10/0x10 [ 93.978389][ T5321] ? __mutex_lock+0x30d/0x1550 [ 93.978398][ T5321] ? unwind_next_frame+0x8f/0x2550 [ 93.978407][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 93.978418][ T5321] hfsplus_block_allocate+0xa9/0xd30 [ 93.978429][ T5321] hfsplus_file_extend+0xb77/0x1df0 [ 93.978437][ T5321] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 93.978444][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 93.978453][ T5321] ? __lock_acquire+0x683/0x2cf0 [ 93.978466][ T5321] hfsplus_get_block+0x41f/0x1610 [ 93.978477][ T5321] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.978486][ T5321] ? filemap_get_entry+0xcd/0x3f0 [ 93.978506][ T5321] __block_write_begin_int+0x6c2/0x1900 [ 93.978522][ T5321] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.978531][ T5321] ? __pfx___block_write_begin_int+0x10/0x10 [ 93.978544][ T5321] cont_write_begin+0x71b/0xac0 [ 93.978554][ T5321] ? __pfx_cont_write_begin+0x10/0x10 [ 93.978560][ T5321] ? __lock_acquire+0x13e8/0x2cf0 [ 93.978568][ T5321] ? set_normalized_timespec64+0xf0/0x1a0 [ 93.978580][ T5321] hfsplus_write_begin+0x66/0xb0 [ 93.978590][ T5321] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.978597][ T5321] cont_write_begin+0x7b2/0xac0 [ 93.978604][ T5321] ? ktime_get_coarse_real_ts64_mg+0x1c5/0x1e0 [ 93.978615][ T5321] ? __pfx_cont_write_begin+0x10/0x10 [ 93.978622][ T5321] ? inode_set_ctime_current+0x27c/0xb50 [ 93.978633][ T5321] hfsplus_write_begin+0x66/0xb0 [ 93.978642][ T5321] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.978648][ T5321] generic_perform_write+0x2d5/0x8f0 [ 93.978657][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 93.978663][ T5321] ? file_update_time_flags+0x400/0x4a0 [ 93.978672][ T5321] ? __generic_file_write_iter+0xf9/0x230 [ 93.978678][ T5321] ? generic_file_write_iter+0x9a/0x330 [ 93.978685][ T5321] generic_file_write_iter+0xae/0x330 [ 93.978692][ T5321] aio_write+0x5cd/0x870 [ 93.978703][ T5321] ? __pfx_aio_write+0x10/0x10 [ 93.978713][ T5321] ? __might_fault+0xaf/0x130 [ 93.978721][ T5321] io_submit_one+0x798/0x13d0 [ 93.978731][ T5321] ? lockdep_hardirqs_on+0x7a/0x110 [ 93.978739][ T5321] ? irqentry_exit+0x218/0x8f0 [ 93.978746][ T5321] ? __pfx_io_submit_one+0x10/0x10 [ 93.978755][ T5321] ? __might_fault+0xaf/0x130 [ 93.978762][ T5321] ? __might_fault+0xaf/0x130 [ 93.978768][ T5321] __se_sys_io_submit+0x195/0x340 [ 93.978776][ T5321] ? __pfx___se_sys_io_submit+0x10/0x10 [ 93.978795][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.978804][ T5321] do_syscall_64+0x174/0x580 [ 93.978816][ T5321] ? trace_irq_disable+0x3b/0x140 [ 93.978829][ T5321] ? clear_bhb_loop+0x40/0x90 [ 93.978841][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.978851][ T5321] RIP: 0033:0x7f3c9d99e019 [ 93.978861][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.978867][ T5321] RSP: 002b:00007f3c9e7befe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 93.978875][ T5321] RAX: ffffffffffffffda RBX: 00007f3c9dc25fa0 RCX: 00007f3c9d99e019 [ 93.978880][ T5321] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 00007f3c9e77d000 [ 93.978914][ T5321] RBP: 00007f3c9da3500c R08: 0000000000000000 R09: 0000000000000000 [ 93.978918][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.978922][ T5321] R13: 00007f3c9dc26038 R14: 00007f3c9dc25fa0 R15: 00007fff4d91d908 [ 93.978929][ T5321]