program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x64d, &(0x7f0000000680)="$eJzs3c1rHOcdB/DvrNay1gZHaWzHLYGYGNJSU1svKK16qVtKUSGUkB56FraMhddOKilFCaVR3+i1h/wB6UG3ngq9FAqC9NzectUxUOglJ+W0ZWZnpZX10lUkeWX38zEz88w8M8/8nt/OM7O7RmyA/1tzN9PcSJG5m2+uluub69PtzfXpR71ykvNJGkmzu0jxOCk+Se6kO+Wr5ca6ueKg83y0OPv2p59vftZda9ZTtX/jsOMGs1ZPuZ5kpF52nTt2e3d3tfdlFNs9LBN2o5c4GLZyeHR2+fnVnZrDXTj2uAXOgqJ6bu6M+U49sserYZ6x+n1A96nYfWY/09a+GHYEAAAAcMLG9m56YStbWc2lYYQDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz6ru7/+n+tX/se1NKa6n6P3+/2ivPsnFIYZ6uNHBdttonHYgAAAAAAAAAHD6Xt3KVlZzqbfeKdJI8lq1crmaX8x7Wc5ClnIrq5nPSlaylMkk430Nja7Or6wsTQ5w5NS+R04NGHDr+H0GAAAAAAAAgOfQbzK38///AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwFhTJSHdRTZd75fE0mknGkoyW+60l/+qVn2Ubww4AAAAAnoIXtrKV1VzqfZLvFNVn/qvV5/6xvJfHWcliVtLOQu5V3wV0P/U3Nten25vr04/KaW+73//PkcKoWkz3u4f9z3yt2qOV+1msttzK3byTdu6lUR1ZutaLZ/+4fl3GVHyvNmBk9+pl2fM/1ss9Ro7U2QEM0uB4lZFz2xmZqGMrs/Hi4ZnY/eqsHfVMk2lsf/Nz+RRyfqFeFsnFHx+U86GoM/Fq6kxM9V19Vw/PRPL1v/75Zw/ajx8+uL988+x06QjOdzqdXvnJa2K6LxMvP/eZ6DdRZeLK9vpcfpSf5mau5600k/wi81nJQq7nh1Vpvr6ey/n44Zm6s2vtrWreOjiS0fp16d49DoppKYv7xPRadeylLOYneSf3spA3qn9Tmcy3M5OZzPa9wlcGGPWNo436G9+oC2UH/3B4R5+yMq8v1nn9MNl1zx2v6vq37GQpRU763tj8Wl0oz/Hbenk2PJmJyb5MvHT49fKn6ray3H78cOnB/LsDnu/1elmOo9+fqadEeb18pXyxqrXdV0dZ99K+dZNV3eXtusaeuivbdf9rpI7W7+H2tjRV1b28b910VXetr26/91sAnHkXvnlhtPXv1j9bH7d+13rQenPsB+e/c/6V0Zz7x7nvNidGXm+8UvwlH+dXuTTsSAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Hmw/P4HD+fb7YWlJwqdTufDA6q+bGEkRznq7387ybP3fo/oBLtzsoWxo+zcORsxH6XwRafTOZEG1w65aI9RaKV/S6d2JlI3pMKQb0zAqbu98ujd28vvf/Ctxd4jcmZmdmJ25o3p2/cX2wsT3fmQgwROxc5Df9iRAAAAAAAAAAAAAIN6Gn9OMOw+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+2uZtpbqTI5MStiXJ9c326XU698s6ezSSNJMUvk+KT5E66U8b7miv2nmGjmn+0OPv2p59vfrbTVrO3f2P/445irZ5yPclIvTyp9u4eu71iu4dlwm70EgfD9t8AAAD//wTcD9I=") ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@private0={0xfc, 0x0, '\x00', 0x1}, @multicast2, 0x20, 0x15}}) r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80940, 0xd2) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32], 0x68}, 0x1, 0x0, 0x0, 0x810}, 0x140) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0xffffffffffffff4c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}]}}}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}}]}, 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000280)='./file0\x00', 0x180c8, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00fc403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a736464bb62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1ca202650fe2628e15341e45dce6c0de2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c73055fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3"], 0x1, 0x242, &(0x7f0000000300)="$eJzs3bFqFFEUBuBjskmWNKYWiwEbq0WtbBeJIA4IK1No5UC0SUSYNKPVPIbP4CP5GKnSjZhZsklcbczm7s58Hyz3wM/Cuc3eLc6d+fDw8/HRl9NP7c/vMR5nMYpo2jbiILZiOzr35uvWRb0bVzUBAGya2aycpu6B1aqqabkTEXt/JMWPJA0BAAAAAAAAAADw35bN/8e5+X8A6DPz//1XVdNyf/7/7Trz/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA65217v/3HJ3V/AMDtc/4DwPA4/wFgeJz/ADA8b9+9fz3N88NZlo0jzpq6qItu7fKXr/LDJ9mFg8W3zuq62L7Mn3Z5dj3fif15/mxpvhuPH3X57+zFm/xGvhdHq98+AAAAAAAAAAAAAAAAAAAArIVJdmnp/f7J5G95V115PsCN+/ujeDC6s20AAAAAAAAAAAAAAAAAAADARjv9+u24PDn5WCl6U8TztWjjrouItWijL0XqXyYAAAAAAAAAAAAAAAAAABiexaXf1J0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDqL9/+vroiIpu2k3i4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQY78CAAD//139ms4=") r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x80241, 0x48) pwrite64(r6, &(0x7f0000000140)='2', 0xfdef, 0xfecc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x6042, 0x101) sendfile(r7, r7, 0x0, 0xe3aa6ea) mount$9p_fd(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000280), 0x4000, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="00ec580b3783ab", @ANYRESHEX=r2, @ANYBLOB=',\x00']) r8 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$BLKROSET(r8, 0x125d, &(0x7f00000001c0)=0x4) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r9, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) [ 93.267478][ T4650] Bluetooth: hci0: command tx timeout [ 93.278945][ T1915] cfg80211: failed to load regulatory.db [ 93.305494][ T5320] loop0: detected capacity change from 0 to 1024 [ 93.442584][ T5320] syz.0.0: attempt to access beyond end of device [ 93.442584][ T5320] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 93.458721][ T5320] Buffer I/O error on dev loop0, logical block 2889, async page read [ 93.484651][ T5320] syz.0.0: attempt to access beyond end of device [ 93.484651][ T5320] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 93.484704][ T5320] Buffer I/O error on dev loop0, logical block 2889, async page read [ 93.495927][ T25] audit: type=1800 audit(1788614530.441:2): pid=5320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 93.507652][ T5320] netlink: 40 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.527686][ T5320] netlink: 24 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.564486][ T25] audit: type=1804 audit(1788614530.521:3): pid=5320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.0" name="/newroot/0/file1/file1" dev="loop0" ino=20 res=1 errno=0 [ 93.593362][ T5320] hfsplus: can't free extent: start 2889, count 1 [ 93.609868][ T5320] [ 93.610936][ T5320] ============================================ [ 93.613453][ T5320] WARNING: possible recursive locking detected [ 93.616106][ T5320] syzkaller #0 Not tainted [ 93.617997][ T5320] -------------------------------------------- [ 93.620575][ T5320] syz.0.0/5320 is trying to acquire lock: [ 93.622942][ T5320] ffff8880525ac740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 93.627701][ T5320] [ 93.627701][ T5320] but task is already holding lock: [ 93.630776][ T5320] ffff8880525a9a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 93.635556][ T5320] [ 93.635556][ T5320] other info that might help us debug this: [ 93.639022][ T5320] Possible unsafe locking scenario: [ 93.639022][ T5320] [ 93.642053][ T5320] CPU0 [ 93.643505][ T5320] ---- [ 93.644913][ T5320] lock(&HFSPLUS_I(inode)->extents_lock); [ 93.647246][ T5320] lock(&HFSPLUS_I(inode)->extents_lock); [ 93.649684][ T5320] [ 93.649684][ T5320] *** DEADLOCK *** [ 93.649684][ T5320] [ 93.653599][ T5320] May be due to missing lock nesting notation [ 93.653599][ T5320] [ 93.657442][ T5320] locks held by syz.0.0/5320: 4, last CPU#0: [ 93.659856][ T5320] #0: ffff8880426ca460 (sb_writers#11){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 93.663503][ T5320] #1: ffff8880525a9b98 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 93.668289][ T5320] #2: ffff8880525a9a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 93.673048][ T5320] #3: ffff88803f4420a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 93.677234][ T5320] [ 93.677234][ T5320] stack backtrace: [ 93.679835][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.683512][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.687614][ T5320] Call Trace: [ 93.689058][ T5320] [ 93.690397][ T5320] dump_stack_lvl+0xe8/0x150 [ 93.692548][ T5320] print_deadlock_bug+0x27a/0x290 [ 93.694875][ T5320] __lock_acquire+0x261c/0x2e50 [ 93.697046][ T5320] ? lock_acquire+0x115/0x350 [ 93.699074][ T5320] lock_acquire+0x115/0x350 [ 93.701088][ T5320] ? hfsplus_file_extend+0x21c/0x1df0 [ 93.703419][ T5320] __mutex_lock+0x19d/0x1550 [ 93.705449][ T5320] ? hfsplus_file_extend+0x21c/0x1df0 [ 93.707772][ T5320] ? kernel_text_address+0xa5/0xe0 [ 93.710016][ T5320] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.712158][ T5320] ? lock_acquire+0x115/0x350 [ 93.714208][ T5320] ? hfsplus_file_extend+0x21c/0x1df0 [ 93.716665][ T5320] ? __pfx___mutex_lock+0x10/0x10 [ 93.718854][ T5320] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 93.721473][ T5320] hfsplus_file_extend+0x21c/0x1df0 [ 93.723800][ T5320] ? hfsplus_file_extend+0x4b8/0x1df0 [ 93.726051][ T5320] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 93.728424][ T5320] ? __pfx___mutex_trylock_common+0x10/0x10 [ 93.730841][ T5320] ? rcu_is_watching+0x16/0xb0 [ 93.732917][ T5320] ? trace_contention_end+0x3d/0x140 [ 93.735089][ T5320] ? __asan_memset+0x22/0x50 [ 93.737128][ T5320] ? hfsplus_brec_find+0x19a/0x510 [ 93.739354][ T5320] hfsplus_bmap_reserve+0x170/0x590 [ 93.741642][ T5320] __hfsplus_ext_write_extent+0x295/0x690 [ 93.744069][ T5320] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 93.746468][ T5320] ? hfsplus_find_init+0x179/0x2e0 [ 93.748787][ T5320] hfsplus_file_extend+0x502/0x1df0 [ 93.751012][ T5320] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 93.753456][ T5320] ? clean_bdev_aliases+0x62e/0x750 [ 93.755729][ T5320] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 93.758114][ T5320] hfsplus_get_block+0x41f/0x1610 [ 93.760355][ T5320] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.762647][ T5320] ? do_raw_spin_unlock+0x4d/0x200 [ 93.764841][ T5320] ? _raw_spin_unlock+0x28/0x50 [ 93.766899][ T5320] ? create_empty_buffers+0x460/0x520 [ 93.769172][ T5320] __block_write_begin_int+0x6c2/0x1900 [ 93.771564][ T5320] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.773904][ T5320] ? __pfx___block_write_begin_int+0x10/0x10 [ 93.776477][ T5320] cont_write_begin+0x71b/0xac0 [ 93.778548][ T5320] ? lockdep_hardirqs_on+0x7b/0x110 [ 93.780836][ T5320] ? __pfx_cont_write_begin+0x10/0x10 [ 93.783081][ T5320] ? rcu_is_watching+0x16/0xb0 [ 93.785106][ T5320] hfsplus_write_begin+0x126/0x1e0 [ 93.787400][ T5320] ? __pfx_hfsplus_get_block+0x10/0x10 [ 93.789836][ T5320] generic_perform_write+0x2d5/0x8f0 [ 93.792153][ T5320] ? __pfx_generic_perform_write+0x10/0x10 [ 93.794656][ T5320] ? file_update_time_flags+0x1e0/0x440 [ 93.796970][ T5320] ? __generic_file_write_iter+0xf9/0x230 [ 93.799358][ T5320] ? generic_file_write_iter+0x9a/0x330 [ 93.801732][ T5320] generic_file_write_iter+0xae/0x330 [ 93.804033][ T5320] vfs_write+0x612/0xba0 [ 93.805816][ T5320] ? __pfx_vfs_write+0x10/0x10 [ 93.807836][ T5320] ? __fget_files+0x2a/0x420 [ 93.809805][ T5320] __x64_sys_pwrite64+0x196/0x220 [ 93.812049][ T5320] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 93.814487][ T5320] do_syscall_64+0x166/0x520 [ 93.816512][ T5320] ? trace_irq_disable+0x3b/0x140 [ 93.818626][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.821379][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 93.823449][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.826028][ T5320] RIP: 0033:0x7fd038b9e159 [ 93.827887][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.835964][ T5320] RSP: 002b:00007fd039a87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 93.839597][ T5320] RAX: ffffffffffffffda RBX: 00007fd038e25fa0 RCX: 00007fd038b9e159 [ 93.843114][ T5320] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 000000000000000a [ 93.846492][ T5320] RBP: 00007fd038c35024 R08: 0000000000000000 R09: 0000000000000000 [ 93.849859][ T5320] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 [ 93.853271][ T5320] R13: 00007fd038e26038 R14: 00007fd038e25fa0 R15: 00007ffce5868558 [ 93.856717][ T5320] [ 93.895183][ T25] audit: type=1800 audit(1788614530.851:4): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 93.913295][ T5320] 9pnet_fd: Insufficient options for proto=fd