program: syz_mount_image$hfs(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x10000, &(0x7f0000000580)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRESHEX=0x0, @ANYRES8], 0x1, 0x32a, &(0x7f0000000800)="$eJzs3U1rE08cB/DvTJJm+2/+dfsggsdqQS+i9SJeIpK3IIgH0bYRiqGiVlAvJuJJRO/efQu+CC+Kb0BPHsSr0F4cmdnZTXZ39iFt2jX6/YC42d3J/CYzk/1NUAZE9M+62vny7uI3/UcANdSAl5cBCcAD6gCO44T3aHtna6fX3cx7o5opgT0FgaCkSN2zsd01fw/ip3U5U8Ly9as6WqPn6HAopa58TZz7LisKhipjZr+DBJp2dprr3pFHlm9Q5ibHeO4fQizTROxiF48xX3UcRERULf38HwRPSv2cb9n8XUpgFRh4f+rzv5z/U2d+VhLHUVK5V0ee/2aVpYTu32Pm0nC9Z5Zw+roMV4llam4kXs8gyMFiCaZwryqHSz4Ti5y9s9Xrntu419uUeI62NVJgOarB0iO0INoVx9o0R4m2C2dGGYQlG7oNaxnxL+2zxhypdDfWIeKD+CRuCh9vsRnlf3UldLQmYD/RU0H857PrmzOl9F2wXxvtdluaNwotmEpOxnsqu5VmFHjuFQnCD3YB8R8I/KI4TanFRKmgdRecBZpRqSVnqbXwVUZdy7FSujXRaM6OcjLUs6wr4rW4LlbwA+/RGcn/pY5vFemZOdIJw1kjVoOJZj7xoD0z7urq5j391JOjjxut+JnoU2xmhb6nBH8SOqCwD19hHZcw//DJ07u1Xq/7QB/cdhzcb0VnGi8A5z0VH6A/PNOEMlI3h9+BseKz9uQYldbGCOzsRFuqJ2LhzXqWJS+FrZzoJz86EsIJO7E+hax+aOWNjc7HxEAqPFC1cnNHNZ0j3C/u94xLv9Q+2p7Ol+nvNOz0qiOhiui8SwTrP5PJ23zf5Gs6W7jWzF6NhItMV8pmEkf7jkrn2NEKyIuVXzRH/8XT6IIV0JzNYxzruD5Say797E+tuU6dAU6Xr9G3cU6H7PTfEh18xi3+/k9ERERERERERERERERERERERERENG3G/98Rs2OWavBflhMRERERERERERERERERERERERERERERHVC0/y/C/X9Rbv/f5PZSdv9fDwX7/66nY0jt//tmG6IPcP9fosP1OwAA//+1UnIe") prlimit64(0x0, 0xe, &(0x7f0000000b40)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000b80)=0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./bus\x00', 0x141842, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c00)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c40)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000c80), 0xfea7) copy_file_range(r1, 0x0, r0, 0x0, 0xffffffffa003e459, 0x700000000000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000cc0)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r3, &(0x7f0000000d00)={0x18}, 0xfffffdef) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r4, 0x84, 0x81, &(0x7f00000003c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000400)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x80082, 0x0) write$vga_arbiter(r5, &(0x7f0000000100)=ANY=[@ANYBLOB='lock io'], 0xc) preadv2(r5, &(0x7f0000000140)=[{&(0x7f0000000180)=""/155, 0x9b}], 0x1, 0x10001, 0x6, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r4, 0x84, 0x15, &(0x7f0000000440)={0x3}, 0x1) sendto$inet6(r4, &(0x7f0000000480)='l', 0x1, 0x0, &(0x7f00000004c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x26, 0x301, 0x270bd1d, 0x25dfdbf4, {0x20}, [@typed={0x5, 0x167, 0x0, 0x0, @str='\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendto$inet6(r4, &(0x7f0000000500)='5', 0x1, 0x20000000, 0x0, 0x0) openat(r1, &(0x7f00000002c0)='./file0\x00', 0x2000, 0xd) sendto$inet6(r4, &(0x7f0000000540)='J', 0x1, 0x4800, 0x0, 0x0) shutdown(r4, 0x1) [ 101.751970][ T4644] Bluetooth: hci0: command tx timeout [ 101.857946][ T5321] loop0: detected capacity change from 0 to 64 [ 101.911367][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911367][ T5321] loop0: rw=8390657, sector=163, nr_sectors = 1 limit=64 [ 101.911420][ T5321] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 101.911447][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911447][ T5321] loop0: rw=8390657, sector=167, nr_sectors = 1 limit=64 [ 101.911461][ T5321] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 101.911474][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911474][ T5321] loop0: rw=8390657, sector=169, nr_sectors = 1 limit=64 [ 101.911495][ T5321] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 101.911508][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911508][ T5321] loop0: rw=8390657, sector=171, nr_sectors = 1 limit=64 [ 101.911521][ T5321] Buffer I/O error on dev loop0, logical block 171, lost async page write [ 101.911533][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911533][ T5321] loop0: rw=8390657, sector=172, nr_sectors = 1 limit=64 [ 101.911545][ T5321] Buffer I/O error on dev loop0, logical block 172, lost async page write [ 101.911558][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911558][ T5321] loop0: rw=8390657, sector=173, nr_sectors = 1 limit=64 [ 101.911571][ T5321] Buffer I/O error on dev loop0, logical block 173, lost async page write [ 101.911582][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911582][ T5321] loop0: rw=8390657, sector=174, nr_sectors = 1 limit=64 [ 101.911596][ T5321] Buffer I/O error on dev loop0, logical block 174, lost async page write [ 101.911607][ T5321] syz.0.0: attempt to access beyond end of device [ 101.911607][ T5321] loop0: rw=8390657, sector=175, nr_sectors = 1 limit=64 [ 101.911619][ T5321] Buffer I/O error on dev loop0, logical block 175, lost async page write [ 101.912031][ T5321] syz.0.0: attempt to access beyond end of device [ 101.912031][ T5321] loop0: rw=8390657, sector=176, nr_sectors = 1 limit=64 [ 101.912047][ T5321] Buffer I/O error on dev loop0, logical block 176, lost async page write [ 101.912061][ T5321] syz.0.0: attempt to access beyond end of device [ 101.912061][ T5321] loop0: rw=8390657, sector=177, nr_sectors = 1 limit=64 [ 101.912074][ T5321] Buffer I/O error on dev loop0, logical block 177, lost async page write [ 103.146836][ T13] [ 103.148146][ T13] ============================================ [ 103.150566][ T13] WARNING: possible recursive locking detected [ 103.152716][ T13] syzkaller #0 Not tainted [ 103.154320][ T13] -------------------------------------------- [ 103.156410][ T13] kworker/u4:1/13 is trying to acquire lock: [ 103.158515][ T13] ffff8880130940a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 103.164817][ T13] [ 103.164817][ T13] but task is already holding lock: [ 103.167372][ T13] ffff8880130940a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 103.170669][ T13] [ 103.170669][ T13] other info that might help us debug this: [ 103.174619][ T13] Possible unsafe locking scenario: [ 103.174619][ T13] [ 103.178130][ T13] CPU0 [ 103.179552][ T13] ---- [ 103.180914][ T13] lock(&tree->tree_lock/1); [ 103.182862][ T13] lock(&tree->tree_lock/1); [ 103.184870][ T13] [ 103.184870][ T13] *** DEADLOCK *** [ 103.184870][ T13] [ 103.187955][ T13] May be due to missing lock nesting notation [ 103.187955][ T13] [ 103.191135][ T13] locks held by kworker/u4:1/13: 5, last CPU#0: [ 103.193618][ T13] #0: ffff88801d37d940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 103.197919][ T13] #1: ffffc9000026fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 103.203088][ T13] #2: ffff88801306a0e8 (&type->s_umount_key#54){.+.+}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 103.207649][ T13] #3: ffff8880130940a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 103.211857][ T13] #4: ffff8880145b80a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 103.216602][ T13] [ 103.216602][ T13] stack backtrace: [ 103.219007][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 103.223037][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.227409][ T13] Workqueue: writeback wb_workfn (flush-7:0) [ 103.229954][ T13] Call Trace: [ 103.233730][ T13] [ 103.235103][ T13] dump_stack_lvl+0xe8/0x150 [ 103.237259][ T13] print_deadlock_bug+0x27a/0x290 [ 103.239361][ T13] __lock_acquire+0x25db/0x2de0 [ 103.241402][ T13] ? __pfx___kfence_alloc+0x10/0x10 [ 103.243660][ T13] ? __kfence_alloc+0x2ed/0x3e0 [ 103.245827][ T13] ? __kmalloc_noprof+0x62b/0x720 [ 103.248108][ T13] ? hfs_find_init+0x9d/0x300 [ 103.250199][ T13] ? hfs_extend_file+0x367/0x1680 [ 103.252442][ T13] ? hfs_bmap_reserve+0x108/0x430 [ 103.254655][ T13] ? __hfs_ext_write_extent+0x1fc/0x470 [ 103.257077][ T13] ? hfs_ext_write_extent+0x17d/0x210 [ 103.259402][ T13] ? hfs_write_inode+0x117/0xa00 [ 103.261346][ T13] ? __writeback_single_inode+0x69d/0x1220 [ 103.263820][ T13] ? writeback_sb_inodes+0x9de/0x1b00 [ 103.266215][ T13] ? __writeback_inodes_wb+0x114/0x240 [ 103.268708][ T13] ? wb_writeback+0x42f/0xad0 [ 103.270753][ T13] ? wb_workfn+0x980/0x10f0 [ 103.272666][ T13] ? process_scheduled_works+0xc3d/0x1630 [ 103.275045][ T13] ? worker_thread+0xa47/0xfb0 [ 103.277029][ T13] lock_acquire+0x115/0x350 [ 103.278907][ T13] ? hfs_find_init+0x18d/0x300 [ 103.280897][ T13] __mutex_lock+0x19d/0x1550 [ 103.285043][ T13] ? hfs_find_init+0x18d/0x300 [ 103.287091][ T13] ? hfs_find_init+0x18d/0x300 [ 103.288949][ T13] ? __pfx___mutex_lock+0x10/0x10 [ 103.290706][ T13] ? rcu_is_watching+0x16/0xb0 [ 103.292418][ T13] ? trace_kmalloc+0x2a/0xf0 [ 103.294060][ T13] ? __kmalloc_noprof+0x38c/0x720 [ 103.296293][ T13] ? hfs_find_init+0x9d/0x300 [ 103.298415][ T13] hfs_find_init+0x18d/0x300 [ 103.300464][ T13] hfs_extend_file+0x367/0x1680 [ 103.302619][ T13] ? __pfx_hfs_extend_file+0x10/0x10 [ 103.304970][ T13] ? _raw_spin_unlock+0x28/0x50 [ 103.307143][ T13] ? hfs_brec_find+0x3db/0x510 [ 103.309346][ T13] hfs_bmap_reserve+0x108/0x430 [ 103.311504][ T13] __hfs_ext_write_extent+0x1fc/0x470 [ 103.313772][ T13] hfs_ext_write_extent+0x17d/0x210 [ 103.315901][ T13] ? __pfx___mpage_writepages+0x10/0x10 [ 103.318333][ T13] ? __pfx_hfs_ext_write_extent+0x10/0x10 [ 103.320742][ T13] hfs_write_inode+0x117/0xa00 [ 103.322774][ T13] ? __pfx_hfs_write_inode+0x10/0x10 [ 103.324842][ T13] ? do_raw_spin_unlock+0x4d/0x200 [ 103.327042][ T13] __writeback_single_inode+0x69d/0x1220 [ 103.329248][ T13] writeback_sb_inodes+0x9de/0x1b00 [ 103.331452][ T13] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 103.333862][ T13] ? irqentry_exit+0x218/0x920 [ 103.335946][ T13] ? __pfx_down_read_trylock+0x10/0x10 [ 103.338305][ T13] ? __pfx___up_read+0x10/0x10 [ 103.340437][ T13] __writeback_inodes_wb+0x114/0x240 [ 103.342678][ T13] wb_writeback+0x42f/0xad0 [ 103.344600][ T13] ? queue_io+0x2b1/0x470 [ 103.346410][ T13] ? __pfx_wb_writeback+0x10/0x10 [ 103.348320][ T13] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.350489][ T13] wb_workfn+0x980/0x10f0 [ 103.352342][ T13] ? __lock_acquire+0x747/0x2de0 [ 103.354156][ T13] ? __pfx_wb_workfn+0x10/0x10 [ 103.355948][ T13] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.358120][ T13] ? lock_acquire+0x115/0x350 [ 103.360184][ T13] ? rcu_is_watching+0x16/0xb0 [ 103.362245][ T13] ? process_scheduled_works+0x97a/0x1630 [ 103.364680][ T13] process_scheduled_works+0xc3d/0x1630 [ 103.366950][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.369192][ T13] ? assign_work+0x3cf/0x5d0 [ 103.371101][ T13] worker_thread+0xa47/0xfb0 [ 103.373018][ T13] kthread+0x38b/0x480 [ 103.374681][ T13] ? __pfx_worker_thread+0x10/0x10 [ 103.376744][ T13] ? __pfx_kthread+0x10/0x10 [ 103.378512][ T13] ret_from_fork+0x514/0xb70 [ 103.380357][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 103.382450][ T13] ? __switch_to+0xc89/0x1420 [ 103.384261][ T13] ? __pfx_kthread+0x10/0x10 [ 103.386216][ T13] ret_from_fork_asm+0x1a/0x30 [ 103.388182][ T13]