program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/sysname\x00', 0x2, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) getsockopt$IPT_SO_GET_INFO(r1, 0x29, 0x40, 0x0, &(0x7f0000000200)) syz_open_dev$usbfs(&(0x7f00000000c0), 0xf, 0x8000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x4000, 0x2, 0x1a1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1f, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) write(r0, &(0x7f0000000080)="7379b7000000000000000000000000000000a0d839f9bf354d59d3f40859", 0x1e) futex(&(0x7f0000000000)=0x1, 0xa, 0x2, 0x0, 0x0, 0x1) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) pwrite64(r3, &(0x7f0000000140)='2', 0x1, 0x8080c61) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202000200070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r5, 0x0, 0x0) [ 85.362841][ T5326] loop0: detected capacity change from 0 to 64 [ 85.381267][ T5326] ======================================================= [ 85.381267][ T5326] WARNING: The mand mount option has been deprecated and [ 85.381267][ T5326] and is ignored by this kernel. Remove the mand [ 85.381267][ T5326] option from the mount to silence this warning. [ 85.381267][ T5326] ======================================================= [ 86.093822][ T5326] hfs: request for non-existent node 8 in B*Tree [ 86.096791][ T5326] hfs: request for non-existent node 8 in B*Tree [ 86.101217][ T4649] Bluetooth: hci0: command tx timeout [ 86.135754][ T5326] [ 86.136899][ T5326] ====================================================== [ 86.139939][ T5326] WARNING: possible circular locking dependency detected [ 86.142947][ T5326] syzkaller #0 Not tainted [ 86.144866][ T5326] ------------------------------------------------------ [ 86.147878][ T5326] syz.0.0/5326 is trying to acquire lock: [ 86.150266][ T5326] ffff88803b7380a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 86.154020][ T5326] [ 86.154020][ T5326] but task is already holding lock: [ 86.156960][ T5326] ffff8880527d7a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 86.161204][ T5326] [ 86.161204][ T5326] which lock already depends on the new lock. [ 86.161204][ T5326] [ 86.165316][ T5326] [ 86.165316][ T5326] the existing dependency chain (in reverse order) is: [ 86.169035][ T5326] [ 86.169035][ T5326] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 86.174093][ T5326] __mutex_lock+0x19d/0x1550 [ 86.177219][ T5326] hfs_extend_file+0xf9/0x1680 [ 86.179567][ T5326] hfs_bmap_reserve+0x108/0x430 [ 86.181904][ T5326] __hfs_ext_write_extent+0x1fc/0x470 [ 86.184460][ T5326] __hfs_ext_cache_extent+0x6e/0x9b0 [ 86.187040][ T5326] hfs_extend_file+0x3a0/0x1680 [ 86.189401][ T5326] hfs_get_block+0x401/0xbe0 [ 86.191581][ T5326] __block_write_begin_int+0x6c2/0x1900 [ 86.193956][ T5326] cont_write_begin+0x71b/0xac0 [ 86.196197][ T5326] hfs_write_begin+0x66/0xb0 [ 86.198104][ T5326] cont_write_begin+0x2d6/0xac0 [ 86.200101][ T5326] hfs_write_begin+0x66/0xb0 [ 86.202249][ T5326] generic_perform_write+0x2d5/0x8f0 [ 86.204579][ T5326] generic_file_write_iter+0xae/0x330 [ 86.206987][ T5326] vfs_write+0x612/0xba0 [ 86.208922][ T5326] __x64_sys_pwrite64+0x196/0x220 [ 86.211261][ T5326] do_syscall_64+0x174/0x580 [ 86.213480][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.215950][ T5326] [ 86.215950][ T5326] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 86.219170][ T5326] __lock_acquire+0x1520/0x2cf0 [ 86.221210][ T5326] lock_acquire+0x106/0x350 [ 86.223156][ T5326] __mutex_lock+0x19d/0x1550 [ 86.225246][ T5326] hfs_find_init+0x18d/0x300 [ 86.227255][ T5326] hfs_extend_file+0x35f/0x1680 [ 86.229283][ T5326] hfs_bmap_reserve+0x108/0x430 [ 86.231343][ T5326] hfs_cat_create+0x221/0x810 [ 86.233361][ T5326] hfs_mkdir+0x79/0xe0 [ 86.235209][ T5326] vfs_mkdir+0x406/0x620 [ 86.237110][ T5326] filename_mkdirat+0x285/0x510 [ 86.239323][ T5326] __se_sys_mkdirat+0x35/0x150 [ 86.241502][ T5326] do_syscall_64+0x174/0x580 [ 86.243683][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.246305][ T5326] [ 86.246305][ T5326] other info that might help us debug this: [ 86.246305][ T5326] [ 86.250417][ T5326] Possible unsafe locking scenario: [ 86.250417][ T5326] [ 86.253300][ T5326] CPU0 CPU1 [ 86.255405][ T5326] ---- ---- [ 86.257483][ T5326] lock(&HFS_I(tree->inode)->extents_lock); [ 86.259828][ T5326] lock(&tree->tree_lock/1); [ 86.262845][ T5326] lock(&HFS_I(tree->inode)->extents_lock); [ 86.267301][ T5326] lock(&tree->tree_lock/1); [ 86.269615][ T5326] [ 86.269615][ T5326] *** DEADLOCK *** [ 86.269615][ T5326] [ 86.273017][ T5326] 4 locks held by syz.0.0/5326: [ 86.275015][ T5326] #0: ffff888012904450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 86.278595][ T5326] #1: ffff8880527d7600 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 86.282578][ T5326] #2: ffff88803f2fa0a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 86.286699][ T5326] #3: ffff8880527d7a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 86.291397][ T5326] [ 86.291397][ T5326] stack backtrace: [ 86.293893][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.293904][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.293914][ T5326] Call Trace: [ 86.293938][ T5326] [ 86.293943][ T5326] dump_stack_lvl+0xe8/0x150 [ 86.293956][ T5326] print_circular_bug+0x2e1/0x300 [ 86.293965][ T5326] check_noncircular+0x12e/0x150 [ 86.293973][ T5326] __lock_acquire+0x1520/0x2cf0 [ 86.293985][ T5326] ? stack_depot_save_flags+0x3ec/0x800 [ 86.294021][ T5326] ? __kmalloc_noprof+0x1ad/0x720 [ 86.294033][ T5326] ? kasan_save_track+0x4f/0x80 [ 86.294045][ T5326] ? kasan_save_track+0x3e/0x80 [ 86.294063][ T5326] ? __kasan_kmalloc+0x93/0xb0 [ 86.294076][ T5326] ? __kmalloc_noprof+0x375/0x720 [ 86.294088][ T5326] ? hfs_find_init+0x9d/0x300 [ 86.294097][ T5326] ? hfs_extend_file+0x35f/0x1680 [ 86.294110][ T5326] ? hfs_bmap_reserve+0x108/0x430 [ 86.294123][ T5326] ? hfs_cat_create+0x221/0x810 [ 86.294135][ T5326] ? hfs_mkdir+0x79/0xe0 [ 86.294148][ T5326] ? vfs_mkdir+0x406/0x620 [ 86.294166][ T5326] ? hfs_find_init+0x18d/0x300 [ 86.294176][ T5326] lock_acquire+0x106/0x350 [ 86.294192][ T5326] ? hfs_find_init+0x18d/0x300 [ 86.294202][ T5326] __mutex_lock+0x19d/0x1550 [ 86.294219][ T5326] ? hfs_find_init+0x18d/0x300 [ 86.294227][ T5326] ? hfs_find_init+0x18d/0x300 [ 86.294235][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 86.294245][ T5326] ? trace_kmalloc+0x2a/0xf0 [ 86.294253][ T5326] ? __kmalloc_noprof+0x396/0x720 [ 86.294262][ T5326] ? __kmalloc_noprof+0x1ad/0x720 [ 86.294270][ T5326] ? hfs_find_init+0x9d/0x300 [ 86.294278][ T5326] hfs_find_init+0x18d/0x300 [ 86.294293][ T5326] hfs_extend_file+0x35f/0x1680 [ 86.294303][ T5326] ? __pfx___mutex_trylock_common+0x10/0x10 [ 86.294311][ T5326] ? __pfx_hfs_extend_file+0x10/0x10 [ 86.294321][ T5326] ? __mutex_lock+0x30d/0x1550 [ 86.294336][ T5326] ? hfs_find_init+0x18d/0x300 [ 86.294346][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 86.294358][ T5326] ? trace_kmalloc+0x2a/0xf0 [ 86.294370][ T5326] hfs_bmap_reserve+0x108/0x430 [ 86.294386][ T5326] hfs_cat_create+0x221/0x810 [ 86.294399][ T5326] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.294411][ T5326] ? __pfx_hfs_cat_create+0x10/0x10 [ 86.294424][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 86.294431][ T5326] ? hfs_new_inode+0x8b8/0xc10 [ 86.294441][ T5326] hfs_mkdir+0x79/0xe0 [ 86.294449][ T5326] vfs_mkdir+0x406/0x620 [ 86.294461][ T5326] filename_mkdirat+0x285/0x510 [ 86.294473][ T5326] ? __pfx_filename_mkdirat+0x10/0x10 [ 86.294489][ T5326] ? do_getname+0x151/0x250 [ 86.294500][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.294511][ T5326] __se_sys_mkdirat+0x35/0x150 [ 86.294531][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.294542][ T5326] do_syscall_64+0x174/0x580 [ 86.294556][ T5326] ? trace_irq_disable+0x3b/0x140 [ 86.294571][ T5326] ? clear_bhb_loop+0x40/0x90 [ 86.294582][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.294593][ T5326] RIP: 0033:0x7fd3bbf9e019 [ 86.294644][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.294655][ T5326] RSP: 002b:00007fd3bcf4afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 86.294668][ T5326] RAX: ffffffffffffffda RBX: 00007fd3bc225fa0 RCX: 00007fd3bbf9e019 [ 86.294674][ T5326] RDX: 00000000000001ff RSI: 0000200000000100 RDI: ffffffffffffff9c [ 86.294680][ T5326] RBP: 00007fd3bc03500c R08: 0000000000000000 R09: 0000000000000000 [ 86.294684][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.294689][ T5326] R13: 00007fd3bc226038 R14: 00007fd3bc225fa0 R15: 00007fffe796b628 [ 86.294698][ T5326] [ 86.648679][ T802] cfg80211: failed to load regulatory.db [ 86.777867][ T5307] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.929770][ T5307] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 49, changing to 9 [ 86.934395][ T5307] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 25866, setting to 1024 [ 86.940643][ T5307] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 49, changing to 9 [ 86.945097][ T5307] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 25866, setting to 1024 [ 86.952081][ T5307] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 86.955911][ T5307] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.959422][ T5307] usb 5-1: Product: syz [ 86.961590][ T5307] usb 5-1: Manufacturer: syz [ 86.963751][ T5307] usb 5-1: SerialNumber: syz [ 86.969058][ T5326] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 86.976017][ T5307] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 86.982012][ T5307] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 86.987548][ T5307] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 88.167894][ T4649] Bluetooth: hci0: command tx timeout [ 88.319330][ T802] usb 5-1: USB disconnect, device number 2 [ 88.332515][ T802] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 88.339980][ T802] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 88.344881][ T802] ti_usb_3410_5052 5-1:2.0: device disconnected