./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2146981637 <...> Warning: Permanently added '10.128.0.95' (ED25519) to the list of known hosts. execve("./syz-executor2146981637", ["./syz-executor2146981637"], 0x7ffe19318470 /* 10 vars */) = 0 brk(NULL) = 0x555555ba2000 brk(0x555555ba2d00) = 0x555555ba2d00 arch_prctl(ARCH_SET_FS, 0x555555ba2380) = 0 set_tid_address(0x555555ba2650) = 5028 set_robust_list(0x555555ba2660, 24) = 0 rseq(0x555555ba2ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2146981637", 4096) = 28 getrandom("\x2e\xb2\xeb\x13\x09\x05\xf2\xde", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555ba2d00 brk(0x555555bc3d00) = 0x555555bc3d00 brk(0x555555bc4000) = 0x555555bc4000 mprotect(0x7fa54a401000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5029 attached , child_tidptr=0x555555ba2650) = 5029 [pid 5029] set_robust_list(0x555555ba2660, 24) = 0 [pid 5029] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5029] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5029] setsid() = 1 [pid 5029] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5029] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5029] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5029] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5029] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5029] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5029] unshare(CLONE_NEWNS) = 0 [pid 5029] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5029] unshare(CLONE_NEWIPC) = 0 [pid 5029] unshare(CLONE_NEWCGROUP) = 0 [pid 5029] unshare(CLONE_NEWUTS) = 0 [pid 5029] unshare(CLONE_SYSVSEM) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "16777216", 8) = 8 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "536870912", 9) = 9 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "1024", 4) = 4 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "8192", 4) = 4 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "1024", 4) = 4 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "1024", 4) = 4 [pid 5029] close(3) = 0 [pid 5029] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5029] close(3) = 0 [pid 5029] getpid() = 1 [pid 5029] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x16d/0x200 [ 61.735974][ T2871] [ 61.735974][ T2871] but task is already holding lock: [ 61.743315][ T2871] ffff8880162b00b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x16d/0x200 [ 61.752960][ T2871] [ 61.752960][ T2871] other info that might help us debug this: [ 61.760996][ T2871] Possible unsafe locking scenario: [ 61.760996][ T2871] [ 61.768443][ T2871] CPU0 [ 61.771709][ T2871] ---- [ 61.774971][ T2871] lock(&tree->tree_lock/1); [ 61.779636][ T2871] lock(&tree->tree_lock/1); [ 61.784303][ T2871] [ 61.784303][ T2871] *** DEADLOCK *** [ 61.784303][ T2871] [ 61.792431][ T2871] May be due to missing lock nesting notation [ 61.792431][ T2871] [ 61.800729][ T2871] 5 locks held by kworker/u4:6/2871: [ 61.806017][ T2871] #0: ffff88814264c138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x96a/0x16f0 [ 61.816628][ T2871] #1: ffffc9000c8a7d80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x99e/0x16f0 [ 61.828515][ T2871] #2: ffff88807c27ac88 (&hip->extents_lock){+.+.}-{3:3}, at: hfsplus_ext_write_extent+0x82/0x200 [ 61.839176][ T2871] #3: ffff8880162b00b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x16d/0x200 [ 61.849283][ T2871] #4: ffff88807c278108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x1c5/0xf90 [ 61.861371][ T2871] [ 61.861371][ T2871] stack backtrace: [ 61.867334][ T2871] CPU: 1 PID: 2871 Comm: kworker/u4:6 Not tainted 6.5.0-rc1-next-20230714-syzkaller #0 [ 61.877225][ T2871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 61.887360][ T2871] Workqueue: writeback wb_workfn (flush-7:0) [ 61.893351][ T2871] Call Trace: [ 61.896657][ T2871] [ 61.899682][ T2871] dump_stack_lvl+0xd9/0x1b0 [ 61.904287][ T2871] __lock_acquire+0x2971/0x5de0 [ 61.909135][ T2871] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 61.915193][ T2871] ? _raw_spin_unlock_irqrestore+0x3b/0x70 [ 61.922482][ T2871] ? __stack_depot_save+0x247/0x510 [ 61.927683][ T2871] lock_acquire+0x1ae/0x510 [ 61.932179][ T2871] ? hfsplus_find_init+0x16d/0x200 [ 61.937457][ T2871] ? lock_sync+0x190/0x190 [ 61.941864][ T2871] ? ret_from_fork_asm+0x11/0x20 [ 61.946814][ T2871] ? preempt_count_sub+0x150/0x150 [ 61.952180][ T2871] __mutex_lock+0x181/0x1340 [ 61.956765][ T2871] ? hfsplus_find_init+0x16d/0x200 [ 61.961872][ T2871] ? hfsplus_find_init+0x16d/0x200 [ 61.966989][ T2871] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 61.972543][ T2871] ? kasan_set_track+0x25/0x30 [ 61.977298][ T2871] ? hfsplus_find_init+0x16d/0x200 [ 61.982404][ T2871] hfsplus_find_init+0x16d/0x200 [ 61.987441][ T2871] hfsplus_ext_read_extent+0x199/0xb00 [ 61.992886][ T2871] ? _raw_spin_unlock+0x28/0x40 [ 61.997721][ T2871] ? hfsplus_free_extents+0x510/0x510 [ 62.003084][ T2871] ? rcu_is_watching+0x12/0xb0 [ 62.007874][ T2871] hfsplus_file_extend+0x699/0xf90 [ 62.012972][ T2871] ? hfsplus_free_fork+0x820/0x820 [ 62.018071][ T2871] ? hfsplus_find_init+0x16d/0x200 [ 62.023178][ T2871] ? hfsplus_brec_find+0x3e8/0x520 [ 62.028280][ T2871] ? hfsplus_brec_remove+0x4f0/0x4f0 [ 62.033556][ T2871] hfsplus_bmap_reserve+0x318/0x410 [ 62.038768][ T2871] __hfsplus_ext_write_extent+0x470/0x5e0 [ 62.044476][ T2871] hfsplus_ext_write_extent+0x1c5/0x200 [ 62.050007][ T2871] ? hfsplus_ext_cmp_key+0x300/0x300 [ 62.055376][ T2871] ? reacquire_held_locks+0x4b0/0x4b0 [ 62.061185][ T2871] ? do_raw_spin_lock+0x12e/0x2b0 [ 62.066200][ T2871] hfsplus_write_inode+0x22/0x4f0 [ 62.071299][ T2871] __writeback_single_inode+0xa81/0xe70 [ 62.076839][ T2871] ? __mark_inode_dirty+0xd50/0xd50 [ 62.082045][ T2871] ? _raw_spin_unlock+0x28/0x40 [ 62.086889][ T2871] ? wbc_attach_and_unlock_inode+0x568/0x910 [ 62.092861][ T2871] writeback_sb_inodes+0x599/0x1010 [ 62.098054][ T2871] ? sync_inode_metadata+0xe0/0xe0 [ 62.103160][ T2871] ? rcu_is_watching+0x12/0xb0 [ 62.107932][ T2871] ? queue_io+0x3ed/0x4e0 [ 62.112256][ T2871] wb_writeback+0x2a5/0xa90 [ 62.116761][ T2871] ? __writeback_inodes_wb+0x2d0/0x2d0 [ 62.122208][ T2871] ? reacquire_held_locks+0x4b0/0x4b0 [ 62.127569][ T2871] ? mark_held_locks+0x9f/0xe0 [ 62.132322][ T2871] wb_workfn+0x29c/0xfd0 [ 62.136561][ T2871] ? inode_wait_for_writeback+0x30/0x30 [ 62.142191][ T2871] ? lock_sync+0x190/0x190 [ 62.146597][ T2871] ? reacquire_held_locks+0x4b0/0x4b0 [ 62.151957][ T2871] ? spin_bug+0x1d0/0x1d0 [ 62.156276][ T2871] process_one_work+0xaa2/0x16f0 [ 62.161202][ T2871] ? lock_sync+0x190/0x190 [ 62.165619][ T2871] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 62.170982][ T2871] ? spin_bug+0x1d0/0x1d0 [ 62.175305][ T2871] worker_thread+0x687/0x1110 [ 62.179970][ T2871] ? __kthread_parkme+0x152/0x220 [ 62.184978][ T2871] ? process_one_work+0x16f0/0x16f0 [ 62.190162][ T2871] kthread+0x33a/0x430 [ 62.194214][ T2871] ? kthread_complete_and_exit+0x40/0x40 [ 62.199840][ T2871] ret_from_fork+0x2c/0x70 [ 62.204251][ T2871] ? kthread_complete_and_exit+0x40/0x40 [ 62.209887][ T2871] ret_from_fork_asm+0x11/0x20 [ 62.214653][ T2871] RIP: 0000:0x0 [ 62.218101][ T2871] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 62.225453][ T2871] RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 [ 62.233865][ T2871] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 62.241925][ T2871] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.249910][ T2871] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 62.257876][ T2871] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 62.265925][ T2871] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 62.273888][ T2871]