program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) open(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000013000100ecff00000000000000000100", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r2, @ANYBLOB="1400350064756d6d793000"/20], 0x3c}}, 0x0) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="01002dbd700109dbdf250e000000"], 0x14}, 0x1, 0x0, 0x0, 0x44840}, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000080100480000000000470e8def4b3cd145f50587e875124ae2626c833aab00a50a5d9267419a11c6ec0637185cc2c8b4ce79e41e9833680c20f861b48babacef3df3f26e6d207a16f5a912007d3bf13b9591f97de4cbc1a95df4788e8f6ae739430dd1a5ba6f3a7e6703dd9641290662d5d7755f2985f9a6e85a1652e2af483e9e7df9b35dd82fd8db6724c79cc6094ab2d28d575dab2bfd308cc61b5"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="0500"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r7}, &(0x7f00000006c0), &(0x7f0000000700)=r6}, 0x20) sendmsg$inet(r5, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0900000004000000040000000400000000000000", @ANYRES32, @ANYBLOB="0700000000000000001c09000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000002e3075df228ff9210400000000000000f836bbe9961e881313a8865590dc72088a647ede8fae57a6dd6b4044b90869fc51d374c1ad166a1ccddf5303d490e6c7257f2cfe671b2b82f85f2642f3690c89e06c13a45f10ac42750d4b02c5839bd180f999802a1e241b6ffd6683c2b51e028333466b2f"], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, &(0x7f0000000080)={[{@nr_inodes={'nr_inodes', 0x3d, [0x34]}}]}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0xa0, &(0x7f0000000700)=ANY=[], 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0xe9) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1f, 0x17, &(0x7f0000000080)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x6, 0xe7030000}, {0x4, 0x0, 0x0, 0x6}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x14}}], {{0x5, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xb7}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x56, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000c0009"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) [ 86.911107][ T5274] Bluetooth: hci0: command tx timeout [ 86.924608][ T10] cfg80211: failed to load regulatory.db [ 87.004363][ T5310] batman_adv: batadv0: Adding interface: dummy0 [ 87.008429][ T5310] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.020892][ T5310] batman_adv: batadv0: Interface activated: dummy0 [ 87.027667][ T5310] loop0: detected capacity change from 0 to 64 [ 87.073097][ T5310] ======================================================= [ 87.073097][ T5310] WARNING: The mand mount option has been deprecated and [ 87.073097][ T5310] and is ignored by this kernel. Remove the mand [ 87.073097][ T5310] option from the mount to silence this warning. [ 87.073097][ T5310] ======================================================= [ 87.952144][ T5310] hfs: request for non-existent node 8 in B*Tree [ 87.954974][ T5310] hfs: request for non-existent node 8 in B*Tree [ 88.017757][ T5310] batadv0: mtu less than device minimum [ 88.021918][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.028755][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.034336][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.038877][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.044435][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.049823][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.054897][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.059897][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.065531][ T5310] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.142817][ T5311] [ 88.143947][ T5311] ====================================================== [ 88.146986][ T5311] WARNING: possible circular locking dependency detected [ 88.149875][ T5311] syzkaller #0 Not tainted [ 88.151743][ T5311] ------------------------------------------------------ [ 88.154652][ T5311] syz.0.0/5311 is trying to acquire lock: [ 88.157418][ T5311] ffff88800e9380a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 88.161587][ T5311] [ 88.161587][ T5311] but task is already holding lock: [ 88.164766][ T5311] ffff888052277a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 88.169585][ T5311] [ 88.169585][ T5311] which lock already depends on the new lock. [ 88.169585][ T5311] [ 88.174116][ T5311] [ 88.174116][ T5311] the existing dependency chain (in reverse order) is: [ 88.177947][ T5311] [ 88.177947][ T5311] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 88.181768][ T5311] __mutex_lock+0x19d/0x1550 [ 88.184073][ T5311] hfs_extend_file+0xf9/0x1680 [ 88.186403][ T5311] hfs_bmap_reserve+0x108/0x430 [ 88.188834][ T5311] __hfs_ext_write_extent+0x1fc/0x470 [ 88.191492][ T5311] __hfs_ext_cache_extent+0x6e/0x9b0 [ 88.194160][ T5311] hfs_extend_file+0x3ad/0x1680 [ 88.196508][ T5311] hfs_get_block+0x401/0xbf0 [ 88.198845][ T5311] __block_write_begin_int+0x6c2/0x1900 [ 88.201563][ T5311] cont_write_begin+0x71b/0xac0 [ 88.203898][ T5311] hfs_write_begin+0x123/0x1c0 [ 88.206144][ T5311] generic_perform_write+0x2d5/0x8f0 [ 88.208699][ T5311] generic_file_write_iter+0xae/0x330 [ 88.211152][ T5311] vfs_write+0x612/0xba0 [ 88.213187][ T5311] ksys_write+0x150/0x270 [ 88.215262][ T5311] do_syscall_64+0x166/0x520 [ 88.217510][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.220215][ T5311] [ 88.220215][ T5311] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 88.223571][ T5311] __lock_acquire+0x1520/0x2cf0 [ 88.225933][ T5311] lock_acquire+0x106/0x350 [ 88.228052][ T5311] __mutex_lock+0x19d/0x1550 [ 88.230144][ T5311] hfs_find_init+0x18d/0x300 [ 88.232306][ T5311] hfs_extend_file+0x367/0x1680 [ 88.234476][ T5311] hfs_bmap_reserve+0x108/0x430 [ 88.236323][ T5311] hfs_cat_create+0x23d/0x870 [ 88.238195][ T5311] hfs_mkdir+0x73/0xe0 [ 88.239809][ T5311] vfs_mkdir+0x40c/0x620 [ 88.241552][ T5311] filename_mkdirat+0x285/0x510 [ 88.243931][ T5311] __se_sys_mkdirat+0x35/0x150 [ 88.246213][ T5311] do_syscall_64+0x166/0x520 [ 88.248436][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.251244][ T5311] [ 88.251244][ T5311] other info that might help us debug this: [ 88.251244][ T5311] [ 88.255705][ T5311] Possible unsafe locking scenario: [ 88.255705][ T5311] [ 88.259004][ T5311] CPU0 CPU1 [ 88.261317][ T5311] ---- ---- [ 88.263687][ T5311] lock(&HFS_I(tree->inode)->extents_lock); [ 88.266134][ T5311] lock(&tree->tree_lock/1); [ 88.268916][ T5311] lock(&HFS_I(tree->inode)->extents_lock); [ 88.272028][ T5311] lock(&tree->tree_lock/1); [ 88.273832][ T5311] [ 88.273832][ T5311] *** DEADLOCK *** [ 88.273832][ T5311] [ 88.277158][ T5311] locks held by syz.0.0/5311: 4, last CPU#0: [ 88.279747][ T5311] #0: ffff88800e93a460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 88.283241][ T5311] #1: ffff888052277600 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 88.287364][ T5311] #2: ffff888041e060a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 88.291818][ T5311] #3: ffff888052277a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 88.296314][ T5311] [ 88.296314][ T5311] stack backtrace: [ 88.298786][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 88.298802][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.298808][ T5311] Call Trace: [ 88.298816][ T5311] [ 88.298821][ T5311] dump_stack_lvl+0xe8/0x150 [ 88.298841][ T5311] print_circular_bug+0x2e1/0x300 [ 88.298854][ T5311] check_noncircular+0x12e/0x150 [ 88.298867][ T5311] __lock_acquire+0x1520/0x2cf0 [ 88.298883][ T5311] ? stack_depot_save_flags+0x404/0x7f0 [ 88.298948][ T5311] ? __kmalloc_noprof+0x1af/0x720 [ 88.298960][ T5311] ? kasan_save_track+0x4f/0x80 [ 88.298972][ T5311] ? kasan_save_track+0x3e/0x80 [ 88.298982][ T5311] ? __kasan_kmalloc+0x93/0xb0 [ 88.298994][ T5311] ? __kmalloc_noprof+0x379/0x720 [ 88.299003][ T5311] ? hfs_find_init+0x9d/0x300 [ 88.299016][ T5311] ? hfs_extend_file+0x367/0x1680 [ 88.299025][ T5311] ? hfs_bmap_reserve+0x108/0x430 [ 88.299039][ T5311] ? hfs_cat_create+0x23d/0x870 [ 88.299053][ T5311] ? hfs_mkdir+0x73/0xe0 [ 88.299061][ T5311] ? vfs_mkdir+0x40c/0x620 [ 88.299073][ T5311] ? hfs_find_init+0x18d/0x300 [ 88.299085][ T5311] lock_acquire+0x106/0x350 [ 88.299099][ T5311] ? hfs_find_init+0x18d/0x300 [ 88.299115][ T5311] __mutex_lock+0x19d/0x1550 [ 88.299127][ T5311] ? hfs_find_init+0x18d/0x300 [ 88.299142][ T5311] ? hfs_find_init+0x18d/0x300 [ 88.299156][ T5311] ? __pfx___mutex_lock+0x10/0x10 [ 88.299168][ T5311] ? trace_kmalloc+0x2a/0xf0 [ 88.299179][ T5311] ? __kmalloc_noprof+0x39a/0x720 [ 88.299189][ T5311] ? __kmalloc_noprof+0x1af/0x720 [ 88.299199][ T5311] ? hfs_find_init+0x9d/0x300 [ 88.299212][ T5311] hfs_find_init+0x18d/0x300 [ 88.299225][ T5311] hfs_extend_file+0x367/0x1680 [ 88.299236][ T5311] ? __pfx___mutex_trylock_common+0x10/0x10 [ 88.299248][ T5311] ? __pfx_hfs_extend_file+0x10/0x10 [ 88.299258][ T5311] ? __mutex_lock+0x30b/0x1550 [ 88.299271][ T5311] ? hfs_find_init+0x18d/0x300 [ 88.299285][ T5311] ? __pfx___mutex_lock+0x10/0x10 [ 88.299296][ T5311] ? trace_kmalloc+0x2a/0xf0 [ 88.299307][ T5311] hfs_bmap_reserve+0x108/0x430 [ 88.299324][ T5311] hfs_cat_create+0x23d/0x870 [ 88.299339][ T5311] ? __pfx_hfs_cat_create+0x10/0x10 [ 88.299358][ T5311] ? _raw_spin_unlock+0x28/0x50 [ 88.299367][ T5311] ? hfs_new_inode+0x8e8/0xc50 [ 88.299379][ T5311] hfs_mkdir+0x73/0xe0 [ 88.299389][ T5311] vfs_mkdir+0x40c/0x620 [ 88.299401][ T5311] filename_mkdirat+0x285/0x510 [ 88.299422][ T5311] ? __pfx_filename_mkdirat+0x10/0x10 [ 88.299435][ T5311] ? do_getname+0x151/0x250 [ 88.299449][ T5311] __se_sys_mkdirat+0x35/0x150 [ 88.299461][ T5311] do_syscall_64+0x166/0x520 [ 88.299474][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.299484][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 88.299495][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.299506][ T5311] RIP: 0033:0x7f948eb9e0d9 [ 88.299517][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.299526][ T5311] RSP: 002b:00007f948fa40fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 88.299537][ T5311] RAX: ffffffffffffffda RBX: 00007f948ee26090 RCX: 00007f948eb9e0d9 [ 88.299545][ T5311] RDX: 00000000000001c0 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 88.299553][ T5311] RBP: 00007f948ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 88.299560][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.299565][ T5311] R13: 00007f948ee26128 R14: 00007f948ee26090 R15: 00007fff06f0e9a8 [ 88.299576][ T5311] [ 88.456133][ T5312] syz.0.0: attempt to access beyond end of device [ 88.456133][ T5312] loop0: rw=8388608, sector=27859, nr_sectors = 1 limit=64 [ 88.462253][ T5312] Buffer I/O error on dev loop0, logical block 27859, async page read [ 88.488842][ T5312] syz.0.0: attempt to access beyond end of device [ 88.488842][ T5312] loop0: rw=8388608, sector=27862, nr_sectors = 1 limit=64 [ 88.495435][ T5312] Buffer I/O error on dev loop0, logical block 27862, async page read [ 88.499061][ T5312] syz.0.0: attempt to access beyond end of device [ 88.499061][ T5312] loop0: rw=8388608, sector=27869, nr_sectors = 1 limit=64 [ 88.505253][ T5312] Buffer I/O error on dev loop0, logical block 27869, async page read [ 88.510835][ T5311] syz.0.0: attempt to access beyond end of device [ 88.510835][ T5311] loop0: rw=8388608, sector=27859, nr_sectors = 1 limit=64 [ 88.516913][ T5311] Buffer I/O error on dev loop0, logical block 27859, async page read [ 88.520478][ T5311] syz.0.0: attempt to access beyond end of device [ 88.520478][ T5311] loop0: rw=8388608, sector=27862, nr_sectors = 1 limit=64 [ 88.526752][ T5311] Buffer I/O error on dev loop0, logical block 27862, async page read [ 88.530301][ T5311] syz.0.0: attempt to access beyond end of device [ 88.530301][ T5311] loop0: rw=8388608, sector=27869, nr_sectors = 1 limit=64 [ 88.537117][ T5311] Buffer I/O error on dev loop0, logical block 27869, async page read [ 88.546239][ T5311] No such timeout policy ""