program: r0 = syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000002900)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000010, &(0x7f00000022c0)=ANY=[], 0x1, 0x6e6, &(0x7f00000002c0)="$eJzs3c9vHGcZB/DvrNcbb6iC0yY0QkVYidQiRSROrBTCBYMQyqFCVTn0bCVOY3WTVImL0gqBCwhOSBz6BxQk3zggJO5B4cKl3Hr1sVIlLhGHqJdFMztr79rrX7FjO+rnE43nnXnfeeeZZ96Z8a6z2gBfWdfOp/kwRa6df+NBubyyPNNZWZ45Vld3kpTlRtLszVLcSYpHyWxZXwxMGZhv8PHC1bc+e7zyeZJur69mv/3YVtuNMKLtUj1lqu5vauSW4zvdxVIdXl5Icr03bww3ae20r6GGZdLO1XM4dN0Nlnaz+W6uW+CI6T+dit5zc4PJ5HiSifr3gNR3h8bBRfhs7OouBwAAAM+pT+8edgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/Km//7+op0Y9z1SK/vf/t/rr6vIRNLvjlg+faRwAAAAAAAAAsHdf7KDNt5/kSR7kRH+5W1R/8z9bLZzKl93ka3k/9zOfe7mQB5nLYhZzL5eSTA501Howt7h479LqlqXRW14eueXl/TpqAAAAAAAAAPhK+k3aa3//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAo6BIxnqzajpVzzOZRjNrdVlK/pOkddjx7kIxauXDg48DAAAA9mTiKbb5+pM8yYOc6C93i+o1/zeq18sTeT93spiFLKaT+dyoX0O3kmZWlmc6K8szt8spSWO43x/9d1dhtOoexqqlUXs+U7Vo52YWqjUXcr0K5kYavX2fS8704xmIa8BHZUzFD2s7jKxZp7Xc2Z82exdhXwy/FdHYomV7LbhkNSPTdWzllid7GSiqN2qS9ZnY9uw0h5Ymq17HV/d0KY3Vd35O7VPOxwbKx+t5eTy/f6Y5363VTDRSZeJyf/SV18zWmUhe+8dr9XV2//zROaRtjG2yfv2YmBnIxMvbZ+Kvb9/q3Hn31s0jmInmLttPV5k4vbp8LT/Nz3M+U3kz97KQX2Qui5lPt66fq8dz+XNy60zNDi29uV0krd556Xa73R3GNJWfVKW5nK22PZGFFLmbG5nP69W/y7mU7+VKruTqwBk+vWnc1bFVV31j/VXfP9P/HBn8ue/UhfLu9oe1u9zsVke82ejcg+6xgYXevb/M68ne3upjWMpCHq+2OjlwHUwPZOnFfnbGR+7paZ5HzW/WhXIfv93mOXGwJutMlBdQ/ynRj+6lXiaa1bNo4zj/c7fcLp073e6tufc26X9p3fKr9bw8Jcvf2q513+hTsb/K8fJiJuo7yfDoKOteWr3LDNR118Zyr274iVtud7qqK4r+lfqz3K0GwMYrtVX/Drexp8tV3csj62aqujMDdUO/b+VuOrlxAPkD4Gn8++3V4mSOt9pftD9tf9L+XftW+42JHx/7/rFXWhn/1/gPmtNjrzZeKf6eT/Krtdf/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA07v/wYfvznU68/dGFxqbVw0V2lm/ZpueiwyvKeov9NnBvp6LwkSSoTXV9xwdeBjt9WFsKHR/nRx4fvpfIji6zR/LQnPDiBpVmB1a87eNHX60ywiLnV0Xz7DQyMHudCyjB8Ah3pSAA3Fx8fZ7F+9/8OF3F27PvTP/zvyd8StXrk5fvfL6zMWbC5356d7Pw44SeBbWHvqHHQkAAAAAAAAAAACwU6M+GHD2he0+NDJYGNvsMx7+ZyEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwL66dT/NhilyavjBdLq8sz3TKqV9ea9lM0mgkxS+T4lEym96UyYHuivzlUboj9vPxwtW3Pnu88vlaX81e+6RRzze3dW2SpXrKVJKxer4HQ/1d33N/xf/6x1Am7Mtutzu7t/hgf/w/AAD//2fe95g=") r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r1, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x7d, 0xa, 0x8, 0x5, 0x3, 0x6, 0x2eef5e15, 0xf7, 0x38, 0x30b, 0xbc, 0x9, 0x20, 0x2, 0x1, 0x87, 0x401}, [{0x6474e551, 0x6, 0xfffffffd, 0xfffffff9, 0xa1bf, 0xfffffff7, 0x8659, 0x2}, {0x6, 0x3, 0x10000, 0x9, 0x6, 0x7fffffff, 0x1, 0xffffffff}]}, 0x78) close(r1) ioctl$XFS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000002900)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000010, &(0x7f00000022c0)=ANY=[], 0x1, 0x6e6, &(0x7f00000002c0)="$eJzs3c9vHGcZB/DvrNcbb6iC0yY0QkVYidQiRSROrBTCBYMQyqFCVTn0bCVOY3WTVImL0gqBCwhOSBz6BxQk3zggJO5B4cKl3Hr1sVIlLhGHqJdFMztr79rrX7FjO+rnE43nnXnfeeeZZ96Z8a6z2gBfWdfOp/kwRa6df+NBubyyPNNZWZ45Vld3kpTlRtLszVLcSYpHyWxZXwxMGZhv8PHC1bc+e7zyeZJur69mv/3YVtuNMKLtUj1lqu5vauSW4zvdxVIdXl5Icr03bww3ae20r6GGZdLO1XM4dN0Nlnaz+W6uW+CI6T+dit5zc4PJ5HiSifr3gNR3h8bBRfhs7OouBwAAAM+pT+8edgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/Km//7+op0Y9z1SK/vf/t/rr6vIRNLvjlg+faRwAAAAAAAAAsHdf7KDNt5/kSR7kRH+5W1R/8z9bLZzKl93ka3k/9zOfe7mQB5nLYhZzL5eSTA501Howt7h479LqlqXRW14eueXl/TpqAAAAAAAAAPhK+k3aa3//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAo6BIxnqzajpVzzOZRjNrdVlK/pOkddjx7kIxauXDg48DAAAA9mTiKbb5+pM8yYOc6C93i+o1/zeq18sTeT93spiFLKaT+dyoX0O3kmZWlmc6K8szt8spSWO43x/9d1dhtOoexqqlUXs+U7Vo52YWqjUXcr0K5kYavX2fS8704xmIa8BHZUzFD2s7jKxZp7Xc2Z82exdhXwy/FdHYomV7LbhkNSPTdWzllid7GSiqN2qS9ZnY9uw0h5Ymq17HV/d0KY3Vd35O7VPOxwbKx+t5eTy/f6Y5363VTDRSZeJyf/SV18zWmUhe+8dr9XV2//zROaRtjG2yfv2YmBnIxMvbZ+Kvb9/q3Hn31s0jmInmLttPV5k4vbp8LT/Nz3M+U3kz97KQX2Qui5lPt66fq8dz+XNy60zNDi29uV0krd556Xa73R3GNJWfVKW5nK22PZGFFLmbG5nP69W/y7mU7+VKruTqwBk+vWnc1bFVV31j/VXfP9P/HBn8ue/UhfLu9oe1u9zsVke82ejcg+6xgYXevb/M68ne3upjWMpCHq+2OjlwHUwPZOnFfnbGR+7paZ5HzW/WhXIfv93mOXGwJutMlBdQ/ynRj+6lXiaa1bNo4zj/c7fcLp073e6tufc26X9p3fKr9bw8Jcvf2q513+hTsb/K8fJiJuo7yfDoKOteWr3LDNR118Zyr274iVtud7qqK4r+lfqz3K0GwMYrtVX/Drexp8tV3csj62aqujMDdUO/b+VuOrlxAPkD4Gn8++3V4mSOt9pftD9tf9L+XftW+42JHx/7/rFXWhn/1/gPmtNjrzZeKf6eT/Krtdf/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA07v/wYfvznU68/dGFxqbVw0V2lm/ZpueiwyvKeov9NnBvp6LwkSSoTXV9xwdeBjt9WFsKHR/nRx4fvpfIji6zR/LQnPDiBpVmB1a87eNHX60ywiLnV0Xz7DQyMHudCyjB8Ah3pSAA3Fx8fZ7F+9/8OF3F27PvTP/zvyd8StXrk5fvfL6zMWbC5356d7Pw44SeBbWHvqHHQkAAAAAAAAAAACwU6M+GHD2he0+NDJYGNvsMx7+ZyEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwL66dT/NhilyavjBdLq8sz3TKqV9ea9lM0mgkxS+T4lEym96UyYHuivzlUboj9vPxwtW3Pnu88vlaX81e+6RRzze3dW2SpXrKVJKxer4HQ/1d33N/xf/6x1Am7Mtutzu7t/hgf/w/AAD//2fe95g=") (async) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (async) write$binfmt_elf32(r1, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x7d, 0xa, 0x8, 0x5, 0x3, 0x6, 0x2eef5e15, 0xf7, 0x38, 0x30b, 0xbc, 0x9, 0x20, 0x2, 0x1, 0x87, 0x401}, [{0x6474e551, 0x6, 0xfffffffd, 0xfffffff9, 0xa1bf, 0xfffffff7, 0x8659, 0x2}, {0x6, 0x3, 0x10000, 0x9, 0x6, 0x7fffffff, 0x1, 0xffffffff}]}, 0x78) (async) close(r1) (async) ioctl$XFS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) (async) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) (async) [ 306.612790][ T5342] Bluetooth: hci0: command tx timeout [ 306.699606][ T5361] loop0: detected capacity change from 0 to 1024 [ 306.737409][ T5361] [ 306.738578][ T5361] ============================================ [ 306.741732][ T5361] WARNING: possible recursive locking detected [ 306.745057][ T5361] syzkaller #0 Not tainted [ 306.747492][ T5361] -------------------------------------------- [ 306.750790][ T5361] syz.0.0/5361 is trying to acquire lock: [ 306.753937][ T5361] ffff888011dd5548 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_get_block+0x39e/0x1670 [ 306.759173][ T5361] [ 306.759173][ T5361] but task is already holding lock: [ 306.762267][ T5361] ffff888011dd47c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x215/0x1d70 [ 306.766845][ T5361] [ 306.766845][ T5361] other info that might help us debug this: [ 306.770568][ T5361] Possible unsafe locking scenario: [ 306.770568][ T5361] [ 306.773834][ T5361] CPU0 [ 306.775316][ T5361] ---- [ 306.776790][ T5361] lock(&HFSPLUS_I(inode)->extents_lock); [ 306.779498][ T5361] lock(&HFSPLUS_I(inode)->extents_lock); [ 306.781996][ T5361] [ 306.781996][ T5361] *** DEADLOCK *** [ 306.781996][ T5361] [ 306.785380][ T5361] May be due to missing lock nesting notation [ 306.785380][ T5361] [ 306.788885][ T5361] 5 locks held by syz.0.0/5361: [ 306.791030][ T5361] #0: ffff8880118740e0 (&type->s_umount_key#51/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xab0 [ 306.795386][ T5361] #1: ffff888011dce998 (&sbi->vh_mutex){+.+.}-{4:4}, at: hfsplus_fill_super+0x1246/0x1a00 [ 306.799733][ T5361] #2: ffff8880118700b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x168/0x2d0 [ 306.804020][ T5361] #3: ffff888011dd47c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x215/0x1d70 [ 306.808907][ T5361] #4: ffff888011dce8f8 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_block_allocate+0xa7/0xce0 [ 306.813393][ T5361] [ 306.813393][ T5361] stack backtrace: [ 306.815970][ T5361] CPU: 0 UID: 0 PID: 5361 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 306.815985][ T5361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 306.815992][ T5361] Call Trace: [ 306.815999][ T5361] [ 306.816005][ T5361] dump_stack_lvl+0xe8/0x150 [ 306.816022][ T5361] print_deadlock_bug+0x279/0x290 [ 306.816036][ T5361] __lock_acquire+0x253f/0x2cf0 [ 306.816047][ T5361] ? lock_release+0x4b/0x3a0 [ 306.816058][ T5361] ? is_bpf_text_address+0x292/0x2b0 [ 306.816071][ T5361] ? is_bpf_text_address+0x26/0x2b0 [ 306.816083][ T5361] ? kernel_text_address+0xa5/0xe0 [ 306.816097][ T5361] ? hfsplus_get_block+0x39e/0x1670 [ 306.816110][ T5361] lock_acquire+0x106/0x330 [ 306.816119][ T5361] ? hfsplus_get_block+0x39e/0x1670 [ 306.816140][ T5361] __mutex_lock+0x19f/0x1300 [ 306.816892][ T5361] ? hfsplus_get_block+0x39e/0x1670 [ 306.816907][ T5361] ? check_path+0x21/0x40 [ 306.816920][ T5361] ? hfsplus_get_block+0x39e/0x1670 [ 306.816931][ T5361] ? add_lock_to_list+0xc7/0x100 [ 306.816942][ T5361] ? __pfx___mutex_lock+0x10/0x10 [ 306.816959][ T5361] hfsplus_get_block+0x39e/0x1670 [ 306.816975][ T5361] ? __pfx_hfsplus_get_block+0x10/0x10 [ 306.816994][ T5361] ? block_read_full_folio+0x672/0x830 [ 306.817009][ T5361] block_read_full_folio+0x29f/0x830 [ 306.817021][ T5361] ? __pfx_hfsplus_get_block+0x10/0x10 [ 306.817034][ T5361] filemap_read_folio+0x137/0x3b0 [ 306.817047][ T5361] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 306.817059][ T5361] ? __pfx_filemap_read_folio+0x10/0x10 [ 306.817071][ T5361] ? filemap_add_folio+0x356/0x530 [ 306.817085][ T5361] do_read_cache_folio+0x358/0x590 [ 306.817098][ T5361] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 306.817110][ T5361] read_cache_page+0x5d/0x170 [ 306.817122][ T5361] hfsplus_block_allocate+0xf3/0xce0 [ 306.817136][ T5361] hfsplus_file_extend+0xb2d/0x1d70 [ 306.817152][ T5361] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 306.817167][ T5361] ? hfsplus_find_init+0x168/0x2d0 [ 306.817177][ T5361] ? __pfx___mutex_lock+0x10/0x10 [ 306.817191][ T5361] hfsplus_bmap_reserve+0x125/0x510 [ 306.817208][ T5361] hfsplus_create_cat+0x1e2/0x11b0 [ 306.817221][ T5361] ? __lock_acquire+0x146e/0x2cf0 [ 306.817233][ T5361] ? __pfx_hfsplus_create_cat+0x10/0x10 [ 306.817261][ T5361] ? do_raw_spin_unlock+0x4d/0x210 [ 306.817274][ T5361] ? _raw_spin_unlock+0x28/0x50 [ 306.817282][ T5361] ? hfsplus_new_inode+0x6c3/0x900 [ 306.817290][ T5361] hfsplus_fill_super+0x12bb/0x1a00 [ 306.817299][ T5361] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 306.817305][ T5361] ? string+0x279/0x2b0 [ 306.817319][ T5361] ? snprintf+0xe8/0x140 [ 306.817327][ T5361] ? sb_set_blocksize+0x155/0x240 [ 306.817496][ T5361] ? setup_bdev_super+0x4c1/0x5b0 [ 306.817507][ T5361] get_tree_bdev_flags+0x431/0x4f0 [ 306.817518][ T5361] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 306.817529][ T5361] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 306.817542][ T5361] vfs_get_tree+0x92/0x2a0 [ 306.817556][ T5361] do_new_mount+0x341/0xd30 [ 306.817565][ T5361] ? apparmor_capable+0x137/0x1a0 [ 306.817576][ T5361] ? __pfx_do_new_mount+0x10/0x10 [ 306.817587][ T5361] ? ns_capable+0x89/0xe0 [ 306.817599][ T5361] ? user_path_at+0xd4/0x160 [ 306.817613][ T5361] __se_sys_mount+0x31d/0x420 [ 306.817626][ T5361] ? __pfx___se_sys_mount+0x10/0x10 [ 306.817639][ T5361] ? __x64_sys_mount+0x20/0xc0 [ 306.817657][ T5361] do_syscall_64+0x14d/0xf80 [ 306.817672][ T5361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.817682][ T5361] ? trace_irq_disable+0x37/0x100 [ 306.817693][ T5361] ? clear_bhb_loop+0x40/0x90 [ 306.817704][ T5361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.817715][ T5361] RIP: 0033:0x7f4c4cf9d20a [ 306.817723][ T5361] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.817754][ T5361] RSP: 002b:00007f4c4deffe58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 306.817767][ T5361] RAX: ffffffffffffffda RBX: 00007f4c4deffee0 RCX: 00007f4c4cf9d20a [ 306.817775][ T5361] RDX: 0000200000000100 RSI: 0000200000002900 RDI: 00007f4c4deffea0 [ 306.817782][ T5361] RBP: 0000200000000100 R08: 00007f4c4deffee0 R09: 0000000002000010 [ 306.817789][ T5361] R10: 0000000002000010 R11: 0000000000000246 R12: 0000200000002900 [ 306.817795][ T5361] R13: 00007f4c4deffea0 R14: 00000000000006e6 R15: 00002000000022c0 [ 306.817806][ T5361] [ 307.043471][ T5361] process 'syz.0.0' launched './file0' with NULL argv: empty string added [ 307.065375][ T5360] process '/newroot/0/file0' started with executable stack