program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2d1, &(0x7f0000000280)="$eJzs3b9u01AUx/HfddI2pVVxaRESY6ESLAjKgliCUCaegAkBTZAqoiKgiD9TQUwIwc7GwCvwECwgXgAmJh6gTEb32o6T2I7dqI0b+H6kRnbia58bX9vnRKquAPy3rrd+fLr8y/4Zqaaa9Oaq5ElqSHVJJ3Wq8WR7Z2un22mP2lHNtbB/RmFLk9pmc7uT1dS2cy0ivl2ra7H/vdDCeJ1EriAIrv2sOghUzl39GTxpTrPJemOCMZXxcsx2uwccx7Qxe9rTMy1VHQcAoFrR898LM3ktRvm750nr0WPf5QdH7fk/rr2qAzh0wchP+57/rsoKjD2/x91HSb3nSjj7uRdXiWWOPDO07tJHbyjBNEVVpYvFm7+31e1c2HzQbXt6pWakb7NV99oOh26sINq1jNp0hBJ9N9kZpatXvRnbh40w/qeSBuJfGfOIKWWvTPPFfDO3jK8Pavfyv3pg7GlyZ8ofOlNh/Bfz9+h66dutFN02ms2mN7DJsjvIafWXEkW9bGRXJIpH1LIGfyDwi+J0rU4MtQp7d6mg1Upmq414LafV6kAr25veaM4/3mEz78xNs6bf+qxWX/7v2fjWNfLKTK4asx4OOPeNh/2ZzT5c3e3TT43P9OXS+xbn8kL/M3xPu/ExGH2bQ563uqsrWnr8/MX9WrfbeWQX7mQsPFzsvTPzWsrcpuIF7SbvzClwUhvHD6VJBnb+QHdo7x+FG9ur7EiclH96ofX1sAbSfDRMq+9phfcmTExy0quOBBWxeZcJ67+kXqmHyZ598TPz9JLlRrTHwObYvQouaRuEGbmkY/uq4BbyK7h0zZWqGV3NdeacdLb8Ef0ozmlm+hL4lr7rNr//AwAAAAAAAAAAAAAAAAAATJtJ/DtB1X0EAAAAAAAAAAAAAAAAAAAAAGDa9eb/VTz/r8rN/zs878pBzv/7flvZ8//GcuaaAbAvfwMAAP//QTZ8Yw==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) ftruncate(r0, 0x2007ffc) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000540), 0x44800, 0x0) (async, rerun: 32) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) (rerun: 32) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x15) (async, rerun: 64) r4 = open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4) (rerun: 64) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8088e3ad122bc192, 0x4002011, r4, 0x1000000) (async) ioctl$TCSETS(r3, 0x40384708, 0x0) (async) read$FUSE(r0, &(0x7f0000000580)={0x2020}, 0x2020) sendfile(r1, r2, 0x0, 0xfffe82) [ 84.499281][ T5330] loop0: detected capacity change from 0 to 64 [ 84.544789][ T5330] ======================================================= [ 84.544789][ T5330] WARNING: The mand mount option has been deprecated and [ 84.544789][ T5330] and is ignored by this kernel. Remove the mand [ 84.544789][ T5330] option from the mount to silence this warning. [ 84.544789][ T5330] ======================================================= [ 84.666279][ T24] audit: type=1800 audit(1779919769.118:2): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 85.476573][ T5330] hfs: request for non-existent node 8 in B*Tree [ 85.479615][ T5330] hfs: request for non-existent node 8 in B*Tree [ 85.485509][ T5290] Bluetooth: hci0: command tx timeout [ 85.537410][ T5330] [ 85.538634][ T5330] ====================================================== [ 85.541803][ T5330] WARNING: possible circular locking dependency detected [ 85.544800][ T5330] syzkaller #0 Not tainted [ 85.546658][ T5330] ------------------------------------------------------ [ 85.549636][ T5330] syz.0.0/5330 is trying to acquire lock: [ 85.551656][ T5330] ffff8880416c40a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 85.555507][ T5330] [ 85.555507][ T5330] but task is already holding lock: [ 85.558553][ T5330] ffff8880417b40f0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 85.562604][ T5330] [ 85.562604][ T5330] which lock already depends on the new lock. [ 85.562604][ T5330] [ 85.566746][ T5330] [ 85.566746][ T5330] the existing dependency chain (in reverse order) is: [ 85.570388][ T5330] [ 85.570388][ T5330] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 85.574507][ T5330] __mutex_lock+0x1a3/0x1550 [ 85.576886][ T5330] hfs_extend_file+0xf2/0x15e0 [ 85.579253][ T5330] hfs_bmap_reserve+0x107/0x430 [ 85.581802][ T5330] __hfs_ext_write_extent+0x1fa/0x470 [ 85.584601][ T5330] __hfs_ext_cache_extent+0x6b/0x9b0 [ 85.587294][ T5330] hfs_extend_file+0x39b/0x15e0 [ 85.589778][ T5330] hfs_get_block+0x412/0xc50 [ 85.592156][ T5330] __block_write_begin_int+0x6c6/0x1910 [ 85.594831][ T5330] cont_write_begin+0x737/0xae0 [ 85.597108][ T5330] hfs_write_begin+0x66/0xb0 [ 85.599102][ T5330] cont_write_begin+0x2e7/0xae0 [ 85.601529][ T5330] hfs_write_begin+0x66/0xb0 [ 85.603711][ T5330] hfs_file_truncate+0x1cf/0xb70 [ 85.605934][ T5330] hfs_inode_setattr+0x4a9/0x670 [ 85.608224][ T5330] notify_change+0xc1a/0xf40 [ 85.610273][ T5330] do_truncate+0x1c2/0x250 [ 85.612335][ T5330] do_ftruncate+0x490/0x540 [ 85.614484][ T5330] __x64_sys_ftruncate+0x8f/0xe0 [ 85.616842][ T5330] do_syscall_64+0x174/0x580 [ 85.618972][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.621695][ T5330] [ 85.621695][ T5330] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 85.625012][ T5330] __lock_acquire+0x15a5/0x2cf0 [ 85.627383][ T5330] lock_acquire+0x106/0x350 [ 85.629625][ T5330] __mutex_lock+0x1a3/0x1550 [ 85.631884][ T5330] hfs_find_init+0x18e/0x300 [ 85.634026][ T5330] hfs_extend_file+0x35c/0x15e0 [ 85.636352][ T5330] hfs_bmap_reserve+0x107/0x430 [ 85.638728][ T5330] hfs_cat_create+0x20f/0x800 [ 85.641060][ T5330] hfs_create+0x75/0xe0 [ 85.643171][ T5330] path_openat+0x1395/0x3860 [ 85.645396][ T5330] do_file_open+0x23e/0x4a0 [ 85.647640][ T5330] do_sys_openat2+0x113/0x200 [ 85.649962][ T5330] __x64_sys_open+0x11e/0x150 [ 85.652268][ T5330] do_syscall_64+0x174/0x580 [ 85.654544][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.657328][ T5330] [ 85.657328][ T5330] other info that might help us debug this: [ 85.657328][ T5330] [ 85.661793][ T5330] Possible unsafe locking scenario: [ 85.661793][ T5330] [ 85.665019][ T5330] CPU0 CPU1 [ 85.667366][ T5330] ---- ---- [ 85.669792][ T5330] lock(&HFS_I(tree->inode)->extents_lock); [ 85.672507][ T5330] lock(&tree->tree_lock/1); [ 85.675753][ T5330] lock(&HFS_I(tree->inode)->extents_lock); [ 85.679387][ T5330] lock(&tree->tree_lock/1); [ 85.681628][ T5330] [ 85.681628][ T5330] *** DEADLOCK *** [ 85.681628][ T5330] [ 85.685191][ T5330] 4 locks held by syz.0.0/5330: [ 85.687425][ T5330] #0: ffff8880417ce410 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 85.691498][ T5330] #1: ffff8880417b3ad0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0xb4c/0x3860 [ 85.695477][ T5330] #2: ffff8880416c20a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 85.699347][ T5330] #3: ffff8880417b40f0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 85.703865][ T5330] [ 85.703865][ T5330] stack backtrace: [ 85.706375][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.706392][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.706399][ T5330] Call Trace: [ 85.706407][ T5330] [ 85.706413][ T5330] dump_stack_lvl+0xe8/0x150 [ 85.706429][ T5330] print_circular_bug+0x2e1/0x300 [ 85.706453][ T5330] check_noncircular+0x12e/0x150 [ 85.706469][ T5330] __lock_acquire+0x15a5/0x2cf0 [ 85.706481][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 85.706498][ T5330] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 85.706511][ T5330] ? stack_depot_save_flags+0x3f3/0x810 [ 85.706573][ T5330] ? kasan_save_track+0x4f/0x80 [ 85.706586][ T5330] ? kasan_save_track+0x3e/0x80 [ 85.706598][ T5330] ? hfs_find_init+0x18e/0x300 [ 85.706613][ T5330] lock_acquire+0x106/0x350 [ 85.706623][ T5330] ? hfs_find_init+0x18e/0x300 [ 85.706640][ T5330] __mutex_lock+0x1a3/0x1550 [ 85.706650][ T5330] ? hfs_find_init+0x18e/0x300 [ 85.706666][ T5330] ? hfs_find_init+0x18e/0x300 [ 85.706680][ T5330] ? __pfx___mutex_lock+0x10/0x10 [ 85.706689][ T5330] ? rcu_is_watching+0x15/0xb0 [ 85.706703][ T5330] ? __kmalloc_noprof+0x37d/0x760 [ 85.706716][ T5330] ? kasan_save_track+0x4f/0x80 [ 85.706728][ T5330] ? hfs_find_init+0xaa/0x300 [ 85.706740][ T5330] ? __kmalloc_noprof+0x1b8/0x760 [ 85.706753][ T5330] hfs_find_init+0x18e/0x300 [ 85.706767][ T5330] hfs_extend_file+0x35c/0x15e0 [ 85.706780][ T5330] ? __pfx_hfs_extend_file+0x10/0x10 [ 85.706789][ T5330] ? __mutex_lock+0x319/0x1550 [ 85.706801][ T5330] ? hfs_find_init+0x18e/0x300 [ 85.706815][ T5330] ? __pfx___mutex_lock+0x10/0x10 [ 85.706824][ T5330] ? rcu_is_watching+0x15/0xb0 [ 85.706836][ T5330] hfs_bmap_reserve+0x107/0x430 [ 85.706850][ T5330] hfs_cat_create+0x20f/0x800 [ 85.706860][ T5330] ? do_raw_spin_lock+0x12b/0x2f0 [ 85.706874][ T5330] ? __pfx_hfs_cat_create+0x10/0x10 [ 85.706887][ T5330] ? _raw_spin_unlock+0x28/0x50 [ 85.706900][ T5330] ? hfs_new_inode+0x92d/0xc70 [ 85.706913][ T5330] hfs_create+0x75/0xe0 [ 85.706923][ T5330] ? __pfx_hfs_create+0x10/0x10 [ 85.706932][ T5330] path_openat+0x1395/0x3860 [ 85.706953][ T5330] ? __pfx_path_openat+0x10/0x10 [ 85.706965][ T5330] ? __x64_sys_open+0x11e/0x150 [ 85.706979][ T5330] do_file_open+0x23e/0x4a0 [ 85.706993][ T5330] ? __pfx_do_file_open+0x10/0x10 [ 85.707011][ T5330] ? _raw_spin_unlock+0x28/0x50 [ 85.707023][ T5330] ? alloc_fd+0x64b/0x6c0 [ 85.707035][ T5330] do_sys_openat2+0x113/0x200 [ 85.707045][ T5330] ? __se_sys_futex+0x3a8/0x450 [ 85.707059][ T5330] ? __pfx_do_sys_openat2+0x10/0x10 [ 85.707070][ T5330] ? rcu_is_watching+0x15/0xb0 [ 85.707082][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.707093][ T5330] __x64_sys_open+0x11e/0x150 [ 85.707104][ T5330] do_syscall_64+0x174/0x580 [ 85.707119][ T5330] ? trace_irq_disable+0x3b/0x140 [ 85.707135][ T5330] ? clear_bhb_loop+0x40/0x90 [ 85.707146][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.707157][ T5330] RIP: 0033:0x7f48a139ce59 [ 85.707169][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.707177][ T5330] RSP: 002b:00007f48a218cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 85.707190][ T5330] RAX: ffffffffffffffda RBX: 00007f48a1615fa0 RCX: 00007f48a139ce59 [ 85.707197][ T5330] RDX: 0000000000000004 RSI: 000000000004a37e RDI: 0000200000000180 [ 85.707204][ T5330] RBP: 00007f48a1432d6f R08: 0000000000000000 R09: 0000000000000000 [ 85.707210][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.707216][ T5330] R13: 00007f48a1616038 R14: 00007f48a1615fa0 R15: 00007ffdb83f4e48 [ 85.707227][ T5330] [ 85.918591][ T24] audit: type=1800 audit(1779919769.938:3): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 85.926902][ T5330] syz.0.0: attempt to access beyond end of device [ 85.926902][ T5330] loop0: rw=0, sector=27869, nr_sectors = 1 limit=64 [ 85.932692][ T5330] Buffer I/O error on dev loop0, logical block 27869, async page read [ 85.936499][ T5330] syz.0.0: attempt to access beyond end of device [ 85.936499][ T5330] loop0: rw=0, sector=27871, nr_sectors = 1 limit=64 [ 85.942112][ T5330] Buffer I/O error on dev loop0, logical block 27871, async page read [ 85.945875][ T5330] syz.0.0: attempt to access beyond end of device [ 85.945875][ T5330] loop0: rw=0, sector=27872, nr_sectors = 1 limit=64 [ 85.951583][ T5330] Buffer I/O error on dev loop0, logical block 27872, async page read [ 85.955702][ T5330] syz.0.0: attempt to access beyond end of device [ 85.955702][ T5330] loop0: rw=0, sector=27869, nr_sectors = 1 limit=64 [ 85.961863][ T5330] Buffer I/O error on dev loop0, logical block 27869, async page read [ 85.965332][ T5330] syz.0.0: attempt to access beyond end of device [ 85.965332][ T5330] loop0: rw=0, sector=27871, nr_sectors = 1 limit=64 [ 85.970872][ T5330] Buffer I/O error on dev loop0, logical block 27871, async page read [ 85.974488][ T5330] syz.0.0: attempt to access beyond end of device [ 85.974488][ T5330] loop0: rw=0, sector=27872, nr_sectors = 1 limit=64 [ 85.980576][ T5330] Buffer I/O error on dev loop0, logical block 27872, async page read [ 85.984670][ T5330] syz.0.0: attempt to access beyond end of device [ 85.984670][ T5330] loop0: rw=0, sector=27869, nr_sectors = 1 limit=64 [ 85.990326][ T5330] Buffer I/O error on dev loop0, logical block 27869, async page read [ 85.993859][ T5330] syz.0.0: attempt to access beyond end of device [ 85.993859][ T5330] loop0: rw=0, sector=27871, nr_sectors = 1 limit=64 [ 85.999575][ T5330] Buffer I/O error on dev loop0, logical block 27871, async page read [ 86.002785][ T5330] syz.0.0: attempt to access beyond end of device [ 86.002785][ T5330] loop0: rw=0, sector=27872, nr_sectors = 1 limit=64 [ 86.008278][ T5330] Buffer I/O error on dev loop0, logical block 27872, async page read [ 86.012224][ T5330] syz.0.0: attempt to access beyond end of device [ 86.012224][ T5330] loop0: rw=0, sector=27869, nr_sectors = 1 limit=64 [ 86.018941][ T5330] Buffer I/O error on dev loop0, logical block 27869, async page read