program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2d1, &(0x7f0000000280)="$eJzs3b9u01AUx/HfddI2pVVxaRESY6ESLAjKgliCUCaegAkBTZAqoiKgiD9TQUwIwc7GwCvwECwgXgAmJh6gTEb32o6T2I7dqI0b+H6kRnbia58bX9vnRKquAPy3rrd+fLr8y/4Zqaaa9Oaq5ElqSHVJJ3Wq8WR7Z2un22mP2lHNtbB/RmFLk9pmc7uT1dS2cy0ivl2ra7H/vdDCeJ1EriAIrv2sOghUzl39GTxpTrPJemOCMZXxcsx2uwccx7Qxe9rTMy1VHQcAoFrR898LM3ktRvm750nr0WPf5QdH7fk/rr2qAzh0wchP+57/rsoKjD2/x91HSb3nSjj7uRdXiWWOPDO07tJHbyjBNEVVpYvFm7+31e1c2HzQbXt6pWakb7NV99oOh26sINq1jNp0hBJ9N9kZpatXvRnbh40w/qeSBuJfGfOIKWWvTPPFfDO3jK8Pavfyv3pg7GlyZ8ofOlNh/Bfz9+h66dutFN02ms2mN7DJsjvIafWXEkW9bGRXJIpH1LIGfyDwi+J0rU4MtQp7d6mg1Upmq414LafV6kAr25veaM4/3mEz78xNs6bf+qxWX/7v2fjWNfLKTK4asx4OOPeNh/2ZzT5c3e3TT43P9OXS+xbn8kL/M3xPu/ExGH2bQ563uqsrWnr8/MX9WrfbeWQX7mQsPFzsvTPzWsrcpuIF7SbvzClwUhvHD6VJBnb+QHdo7x+FG9ur7EiclH96ofX1sAbSfDRMq+9phfcmTExy0quOBBWxeZcJ67+kXqmHyZ598TPz9JLlRrTHwObYvQouaRuEGbmkY/uq4BbyK7h0zZWqGV3NdeacdLb8Ef0ozmlm+hL4lr7rNr//AwAAAAAAAAAAAAAAAAAATJtJ/DtB1X0EAAAAAAAAAAAAAAAAAAAAAGDa9eb/VTz/r8rN/zs878pBzv/7flvZ8//GcuaaAbAvfwMAAP//QTZ8Yw==") (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141442, 0x2) pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) (async) open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) (async) perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) (async) shutdown(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xd0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41191, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0, 0x1}, 0x2098, 0x3, 0x9, 0x0, 0x10, 0x2, 0x4007, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) recvmsg(r1, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$inet(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)="9f", 0x1}], 0x1}, 0x0) unlink(&(0x7f0000000740)='./file1\x00') (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0xbf) (async, rerun: 64) mount$nfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="612edff85d2e6464723d3132323034392c6d6f756e07000000afdbdcfe39412c706e7470816f746f3d7463702c6e6b6c6f636b2c736f66742c74696d65723986c57265741de8f624d2f07271b4f01d55824f0300052b127700000000007e5e00000000000000000000000000adfae87bb1fbe86ae258c37e5edcf34168594edcb57ebc41f2d8"]) mount$bind(&(0x7f0000000000)='./file1\x00', &(0x7f00000000c0)='./file1\x00', &(0x7f0000000240), 0x2200030, 0x0) [ 105.383306][ T4637] Bluetooth: hci0: command tx timeout [ 105.489463][ T5317] loop0: detected capacity change from 0 to 64 [ 105.514645][ T5317] ======================================================= [ 105.514645][ T5317] WARNING: The mand mount option has been deprecated and [ 105.514645][ T5317] and is ignored by this kernel. Remove the mand [ 105.514645][ T5317] option from the mount to silence this warning. [ 105.514645][ T5317] ======================================================= [ 105.745875][ T5318] [ 105.747024][ T5318] ============================================ [ 105.750068][ T5318] WARNING: possible recursive locking detected [ 105.753044][ T5318] syzkaller #0 Not tainted [ 105.754985][ T5318] -------------------------------------------- [ 105.757772][ T5318] syz.0.0/5318 is trying to acquire lock: [ 105.760196][ T5318] ffff888051cbc0a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 105.764651][ T5318] [ 105.764651][ T5318] but task is already holding lock: [ 105.768355][ T5318] ffff888051ccba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 105.773381][ T5318] [ 105.773381][ T5318] other info that might help us debug this: [ 105.776687][ T5318] Possible unsafe locking scenario: [ 105.776687][ T5318] [ 105.779646][ T5318] CPU0 [ 105.781063][ T5318] ---- [ 105.782484][ T5318] lock(&HFS_I(tree->inode)->extents_lock); [ 105.784998][ T5318] lock(&HFS_I(tree->inode)->extents_lock); [ 105.788092][ T5318] [ 105.788092][ T5318] *** DEADLOCK *** [ 105.788092][ T5318] [ 105.792344][ T5318] May be due to missing lock nesting notation [ 105.792344][ T5318] [ 105.795924][ T5318] 5 locks held by syz.0.0/5318: [ 105.798091][ T5318] #0: ffff88803426c450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 105.801851][ T5318] #1: ffff888051ccb600 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0xae3/0x3830 [ 105.806084][ T5318] #2: ffff888041ea20a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 105.810289][ T5318] #3: ffff888051ccba20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 105.815821][ T5318] #4: ffff888041ea40a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 105.819901][ T5318] [ 105.819901][ T5318] stack backtrace: [ 105.822463][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.822481][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.822489][ T5318] Call Trace: [ 105.822497][ T5318] [ 105.822503][ T5318] dump_stack_lvl+0xe8/0x150 [ 105.822523][ T5318] print_deadlock_bug+0x279/0x290 [ 105.822542][ T5318] __lock_acquire+0x24df/0x2cf0 [ 105.822557][ T5318] ? is_bpf_text_address+0x26/0x2b0 [ 105.822570][ T5318] ? __kasan_check_byte+0x12/0x40 [ 105.822579][ T5318] ? rcu_is_watching+0x15/0xb0 [ 105.822592][ T5318] ? lock_release+0x4b/0x3c0 [ 105.822605][ T5318] ? lock_release+0x4b/0x3c0 [ 105.822617][ T5318] ? hfs_extend_file+0xf9/0x1680 [ 105.822631][ T5318] lock_acquire+0x106/0x350 [ 105.822644][ T5318] ? hfs_extend_file+0xf9/0x1680 [ 105.822657][ T5318] __mutex_lock+0x19d/0x1550 [ 105.822719][ T5318] ? hfs_extend_file+0xf9/0x1680 [ 105.822730][ T5318] ? stack_trace_save+0xa9/0x100 [ 105.822742][ T5318] ? __pfx_stack_trace_save+0x10/0x10 [ 105.822753][ T5318] ? hfs_extend_file+0xf9/0x1680 [ 105.822766][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 105.822779][ T5318] ? add_lock_to_list+0xc7/0x100 [ 105.822794][ T5318] ? lockdep_unlock+0x5d/0xd0 [ 105.822805][ T5318] ? __lock_acquire+0x13e8/0x2cf0 [ 105.822825][ T5318] ? stack_depot_save_flags+0x3ec/0x800 [ 105.822872][ T5318] hfs_extend_file+0xf9/0x1680 [ 105.822888][ T5318] ? __pfx_hfs_extend_file+0x10/0x10 [ 105.822899][ T5318] ? __mutex_trylock_common+0x15f/0x270 [ 105.822913][ T5318] ? __pfx___mutex_trylock_common+0x10/0x10 [ 105.822923][ T5318] ? rcu_is_watching+0x15/0xb0 [ 105.822936][ T5318] ? trace_contention_end+0x3d/0x140 [ 105.822947][ T5318] ? __asan_memset+0x22/0x50 [ 105.822955][ T5318] ? hfs_brec_find+0x19a/0x510 [ 105.822964][ T5318] hfs_bmap_reserve+0x108/0x430 [ 105.822978][ T5318] __hfs_ext_write_extent+0x1fc/0x470 [ 105.822994][ T5318] __hfs_ext_cache_extent+0x6e/0x9b0 [ 105.823007][ T5318] ? hfs_find_init+0x18d/0x300 [ 105.823016][ T5318] hfs_extend_file+0x3a0/0x1680 [ 105.823029][ T5318] ? __pfx___mutex_trylock_common+0x10/0x10 [ 105.823046][ T5318] ? __pfx_hfs_extend_file+0x10/0x10 [ 105.823059][ T5318] ? __mutex_lock+0x30d/0x1550 [ 105.823073][ T5318] ? hfs_find_init+0x18d/0x300 [ 105.823083][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 105.823096][ T5318] ? trace_kmalloc+0x2a/0xf0 [ 105.823108][ T5318] hfs_bmap_reserve+0x108/0x430 [ 105.823122][ T5318] hfs_cat_create+0x221/0x810 [ 105.823135][ T5318] ? __pfx_hfs_cat_create+0x10/0x10 [ 105.823146][ T5318] ? do_raw_spin_lock+0x12b/0x2f0 [ 105.823159][ T5318] ? _raw_spin_unlock+0x28/0x50 [ 105.823170][ T5318] ? hfs_new_inode+0x8b8/0xc10 [ 105.823184][ T5318] hfs_create+0x78/0xe0 [ 105.823196][ T5318] ? __pfx_hfs_create+0x10/0x10 [ 105.823207][ T5318] path_openat+0x133a/0x3830 [ 105.823229][ T5318] do_file_open+0x23e/0x4a0 [ 105.823244][ T5318] ? __pfx_do_file_open+0x10/0x10 [ 105.823261][ T5318] ? _raw_spin_unlock+0x28/0x50 [ 105.823271][ T5318] ? alloc_fd+0x651/0x6c0 [ 105.823284][ T5318] do_sys_openat2+0x115/0x200 [ 105.823295][ T5318] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.823309][ T5318] ? __pfx_do_sys_openat2+0x10/0x10 [ 105.823320][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.823333][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.823343][ T5318] __x64_sys_open+0x11e/0x150 [ 105.823355][ T5318] do_syscall_64+0x174/0x580 [ 105.823370][ T5318] ? trace_irq_disable+0x3b/0x140 [ 105.823384][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 105.823396][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.823407][ T5318] RIP: 0033:0x7fb14959e0d9 [ 105.823420][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.823430][ T5318] RSP: 002b:00007fb14a4f2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 105.823442][ T5318] RAX: ffffffffffffffda RBX: 00007fb149826090 RCX: 00007fb14959e0d9 [ 105.823450][ T5318] RDX: 000000000000002a RSI: 0000000400141042 RDI: 0000200000000040 [ 105.823457][ T5318] RBP: 00007fb149635024 R08: 0000000000000000 R09: 0000000000000000 [ 105.823463][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.823468][ T5318] R13: 00007fb149826128 R14: 00007fb149826090 R15: 00007ffeb94f7028 [ 105.823479][ T5318]