program: r0 = syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000540), 0x1, 0x4ae, &(0x7f0000000a40)="$eJzs3c1rXOUaAPBnZpo0SXNvP+7l0vbCbaEXej9oJh9cmlzduFIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLOzLT5mjjYNKM5vx+cznnPezrP+2Z4Xs6855w5AWTW6eSfXMRgRHwaEYcbxY07nG68rN29PpUsuajXL36TS/dLyq1dW//vUESsRkRfRDz9eMQLua1xq8srs5PlcmmxWS7W5haK1eWVc1fmJmdKM6X5kfHzExPjw2OjE9GzS329+dpLNy988GTv+z+8euf26x99mDRrsFm3vh+7qdH1nji6btuBiHj0YQTrgkKzP/3dbgi/SfL5/SUizqT5fzgK6acJZEG9Xq//XD/Yrnq1Duxb+fQYOJcfiojGej4/NNQ4hv9rDOTLlWrtv5crS/PTjWPlI9GTv3ylXBpuflc4Ej25pDySrt8vj24qj0Wkx8BvFPrT8tBUpTy9t0MdsMmhTfn/faGR/0BG+MoP2SX/IbvkP2SX/Ifskv+QXfIfskv+Q3bJf8gu+Q/ZJf8hu+Q/ZNJTFy4kS711//v01eWl2crVc9Ol6uzQ3NLU0FRlcWFoplKZSe/Zmfu19ytXKgsj/4ula8VaqVorVpdXLs1VluZrl9L7+i+VdutefuDBHT116/NcRKz+vz9dEr3NOrkK+1u9notu34MMdEeh2wMQ0DWm/iC7fMcHtvmJ3g362lUs7H5bgL2R73YDgK45e8L5P8gq8/+QXeb/Ibsc4wPm/yF7zP9Ddg22ef7Xn9Y9u2s4Iv4cEZ8Veg62nvUF7Af5r3LN4/+zh/85uLm2N/djeoqgNyJefufiW9cma7XFkWT7t/e2195ubh/tRvuBTrXytJXHAEB2rd29PtVa9jLu1481LkLYGv9Ac26yLz1HObCW23CtQm6Xrl1YvRERx7eLn2s+77xx5mNgrbAl/rHma67xFml7D6TPTd+b+CfWxf/HuvgnH/ivAtlwKxl/hrfLv3ya03Ev/zaOP4O7dO1E+/Evf2/8K7QZ/051GOPFd1/5sm38GxEnt43fiteXxtocP2nb2Q7j33numb+1q6u/13if7eK3JGvF2txCsbq8ci79HbmZ0vzI+PmJifHhsdGJYjpHXWzNVG/1yPFPbu/U/4E28Xfqf7Lt3x32/6e/f/zs6R3i/+vM9p//sR3i90fEfzqM/93oF8+3q0viT7fpf36H+Mm2sQ7jV9984mCHuwIAe6C6vDI7WS6XFq1Y+cOttK5e+720Zz+tdHlgAh66+0nf7ZYAAAAAAAAAAAAAndqLy4m73UcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP3glwAAAP//cePS8w==") creat(&(0x7f0000000040)='./bus\x00', 0x122dfb579e447c7a) open(&(0x7f0000000240)='./file1\x00', 0x13f903, 0x2c) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x6, 0x4, 0x11, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100172a00ffffff00f7ffffff000000f3e7f20000000200000000000600", "b7326736181c208220fffff2ff00000000000000000e00", [0x4]}) (async, rerun: 32) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1db) (rerun: 32) write$FUSE_OPEN(r2, &(0x7f0000003fc0)={0x20, 0x0, 0x0, {0x0, 0xc}}, 0x20) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x480240, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async, rerun: 32) pwrite64(r3, &(0x7f0000000140)='2', 0x1, 0x8080c61) (async, rerun: 32) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000003c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r6 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r6, 0x10c, 0x2, &(0x7f0000000000)=0x3, 0x4) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) (async) setsockopt$ALG_SET_KEY(r4, 0x117, 0x7, &(0x7f00000000c0)="fe03ff6a", 0x4) (async) open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) (async) r7 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11000000040000000400000005"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xe, 0x0, &(0x7f0000000040)="388688a800a34400000000000000", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$F2FS_IOC_MOVE_RANGE(r7, 0xc020f509, &(0x7f00000000c0)={r0, 0x8, 0x8, 0x3}) [ 134.667768][ T5298] Bluetooth: hci0: command tx timeout [ 134.804247][ T5339] loop0: detected capacity change from 0 to 64 [ 134.822106][ T5339] ======================================================= [ 134.822106][ T5339] WARNING: The mand mount option has been deprecated and [ 134.822106][ T5339] and is ignored by this kernel. Remove the mand [ 134.822106][ T5339] option from the mount to silence this warning. [ 134.822106][ T5339] ======================================================= [ 134.971791][ T5340] [ 134.972839][ T5340] ============================================ [ 134.975430][ T5340] WARNING: possible recursive locking detected [ 134.977981][ T5340] syzkaller #0 Not tainted [ 134.980003][ T5340] -------------------------------------------- [ 134.983009][ T5340] syz.0.0/5340 is trying to acquire lock: [ 134.985604][ T5340] ffff8880528fc0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 134.990231][ T5340] [ 134.990231][ T5340] but task is already holding lock: [ 134.993410][ T5340] ffff8880528fba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 134.998241][ T5340] [ 134.998241][ T5340] other info that might help us debug this: [ 135.001980][ T5340] Possible unsafe locking scenario: [ 135.001980][ T5340] [ 135.005165][ T5340] CPU0 [ 135.006588][ T5340] ---- [ 135.008072][ T5340] lock(&HFS_I(tree->inode)->extents_lock); [ 135.010797][ T5340] lock(&HFS_I(tree->inode)->extents_lock); [ 135.013690][ T5340] [ 135.013690][ T5340] *** DEADLOCK *** [ 135.013690][ T5340] [ 135.017093][ T5340] May be due to missing lock nesting notation [ 135.017093][ T5340] [ 135.020538][ T5340] 5 locks held by syz.0.0/5340: [ 135.022580][ T5340] #0: ffff8880335f4450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 135.027431][ T5340] #1: ffff8880528fb600 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: path_openat+0xae3/0x3830 [ 135.031861][ T5340] #2: ffff88801d0e80a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 135.035672][ T5340] #3: ffff8880528fba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 135.040527][ T5340] #4: ffff888012cc00a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 135.045427][ T5340] [ 135.045427][ T5340] stack backtrace: [ 135.048025][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 135.048041][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.048047][ T5340] Call Trace: [ 135.048055][ T5340] [ 135.048061][ T5340] dump_stack_lvl+0xe8/0x150 [ 135.048079][ T5340] print_deadlock_bug+0x279/0x290 [ 135.048094][ T5340] __lock_acquire+0x24df/0x2cf0 [ 135.048108][ T5340] ? pick_next_entity+0xd7e/0xf50 [ 135.048126][ T5340] ? hfs_extend_file+0xf9/0x1680 [ 135.048137][ T5340] lock_acquire+0x106/0x350 [ 135.048148][ T5340] ? hfs_extend_file+0xf9/0x1680 [ 135.048161][ T5340] __mutex_lock+0x19d/0x1550 [ 135.048219][ T5340] ? hfs_extend_file+0xf9/0x1680 [ 135.048227][ T5340] ? rcu_is_watching+0x15/0xb0 [ 135.048236][ T5340] ? trace_sched_exit_tp+0x3a/0x130 [ 135.048244][ T5340] ? __schedule+0x17ef/0x56c0 [ 135.048251][ T5340] ? hfs_extend_file+0xf9/0x1680 [ 135.048258][ T5340] ? __pfx___mutex_lock+0x10/0x10 [ 135.048270][ T5340] hfs_extend_file+0xf9/0x1680 [ 135.048281][ T5340] ? __pfx___schedule+0x10/0x10 [ 135.048291][ T5340] ? irqentry_exit+0x218/0x8f0 [ 135.048306][ T5340] ? __pfx_hfs_extend_file+0x10/0x10 [ 135.048316][ T5340] ? __mutex_trylock_common+0x15f/0x270 [ 135.048326][ T5340] ? preempt_schedule_thunk+0x16/0x40 [ 135.048338][ T5340] ? preempt_schedule_common+0x82/0xd0 [ 135.048351][ T5340] ? preempt_schedule_thunk+0x16/0x40 [ 135.048363][ T5340] ? __asan_memset+0x22/0x50 [ 135.048372][ T5340] ? hfs_brec_find+0x19a/0x510 [ 135.048383][ T5340] hfs_bmap_reserve+0x108/0x430 [ 135.048391][ T5340] __hfs_ext_write_extent+0x1fc/0x470 [ 135.048404][ T5340] __hfs_ext_cache_extent+0x6e/0x9b0 [ 135.048414][ T5340] ? hfs_find_init+0x18d/0x300 [ 135.048427][ T5340] hfs_extend_file+0x3a0/0x1680 [ 135.048437][ T5340] ? __pfx___mutex_trylock_common+0x10/0x10 [ 135.048448][ T5340] ? __pfx_hfs_extend_file+0x10/0x10 [ 135.048458][ T5340] ? __mutex_lock+0x30d/0x1550 [ 135.048472][ T5340] ? hfs_find_init+0x18d/0x300 [ 135.048485][ T5340] ? __pfx___mutex_lock+0x10/0x10 [ 135.048498][ T5340] ? trace_kmalloc+0x2a/0xf0 [ 135.048510][ T5340] hfs_bmap_reserve+0x108/0x430 [ 135.048523][ T5340] hfs_cat_create+0x221/0x810 [ 135.048536][ T5340] ? __pfx_hfs_cat_create+0x10/0x10 [ 135.048544][ T5340] ? do_raw_spin_lock+0x12b/0x2f0 [ 135.048555][ T5340] ? _raw_spin_unlock+0x28/0x50 [ 135.048567][ T5340] ? hfs_new_inode+0x8b8/0xc10 [ 135.048578][ T5340] hfs_create+0x78/0xe0 [ 135.048588][ T5340] ? __pfx_hfs_create+0x10/0x10 [ 135.048598][ T5340] path_openat+0x133a/0x3830 [ 135.048617][ T5340] do_file_open+0x23e/0x4a0 [ 135.048630][ T5340] ? __pfx_do_file_open+0x10/0x10 [ 135.048645][ T5340] ? _raw_spin_unlock+0x28/0x50 [ 135.048655][ T5340] ? alloc_fd+0x651/0x6c0 [ 135.048667][ T5340] do_sys_openat2+0x115/0x200 [ 135.048680][ T5340] ? __pfx_do_sys_openat2+0x10/0x10 [ 135.048691][ T5340] ? rcu_is_watching+0x15/0xb0 [ 135.048710][ T5340] __x64_sys_openat+0x138/0x170 [ 135.048721][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.048729][ T5340] do_syscall_64+0x174/0x580 [ 135.048738][ T5340] ? trace_irq_disable+0x3b/0x140 [ 135.048747][ T5340] ? clear_bhb_loop+0x40/0x90 [ 135.048754][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.048763][ T5340] RIP: 0033:0x7f706279de59 [ 135.048775][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.048783][ T5340] RSP: 002b:00007f7063680fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 135.048794][ T5340] RAX: ffffffffffffffda RBX: 00007f7062a26090 RCX: 00007f706279de59 [ 135.048801][ T5340] RDX: 0000000000105042 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 135.048808][ T5340] RBP: 00007f7062833e6f R08: 0000000000000000 R09: 0000000000000000 [ 135.048815][ T5340] R10: 00000000000001db R11: 0000000000000246 R12: 0000000000000000 [ 135.048821][ T5340] R13: 00007f7062a26128 R14: 00007f7062a26090 R15: 00007ffddf21b268 [ 135.048838][ T5340]