program: r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000200), 0xc000, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1e, 0x4000) (async) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x3004048, &(0x7f0000000100)=ANY=[], 0x11, 0x2c6, &(0x7f0000005bc0)="$eJzs3btuE08Ux/HfjJ3E/3+isCFBSJSBSNAgCA2iMUKueAIqBMRGirCCgCAuVUBUCEFPR8Er8BA0IF4AKioeIFSLZmbt9WXXNpbjjcP3I8XatWd2z3gvc46laAXgn3Wt9v3jpZ/uz0gllaTXVyQrqSKVJZ3Qycrjnd3t3WajPmhDJd/D/RmFnqavzdZOI6ur6+d7JCK3VtZS53vB4niDRK44jq/+KDoIFM5f/RmstKD5dL0yxZhG8WLMfnsTjmPWmH3t66mWi44DAFCsZP63IZPXUpK/WyttJNO+zw8O2/w/rv2iAzhw8cBPO+Z/X2XFxh3fY/6jtN7zJZz73LaqxFH2PNez7tNH25NgmmFVpY/F/nd3u9k4v3W/Wbd6qWqio9maf62HU7dlSLTrGbXpACOM3WRnlL5etXNuDJsh/ieSuuJfHXOPYzOfzVdz00R6r3o7/yvHxh0mf6SiniMV4r+Qv0U/ysi1UnLbqFartqvJit/JKXWWEsNGWcmuSNQ6o1bU/QNBNCxO3+t4T68wuotDeq1m9tpsreX0Wuvq5UbTPpvz93fQzFtzw6zrlz6p1pH/WxffhgZemelVYzbCVOC/8TCe+ezdlf02o76Zo/9yaX+LC3mh/+69p13/EA++zSHPG93RZS0/evb8XqnZbDx0C7czFh4std+ZeyVltil4QXvpOwuKvb7GrUlpmoGdm+gG3f1jaGN3lR2Kg3KkF2pfpnsiFbFQ8P0JU5Ee9KIjQUFc3mVC/ZfWK+WQ7LmXKDNPH/GHgGSLscux2xVc2jcOGbmk//+qglvMr+D6a66+mtHXXKfPSmdG32OUxHlEmJq+6Ra//wMAAAAAAAAAAAAAAAAAAMyaafw7QdFjBAAAAAAAAAAAAAAAAAAAAABg1rWf/6vW83812vN/e5+7Msnn/77bUfbzfwFM0p8AAAD//0gLf7E=") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, 0x0, 0x2000000, 0x8010, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000240)="0a5ce00b36adc2f779e6c38fdb5cbcb8a9e2b75fb38e1a60cf85e77e7737a2cdb87e9278a93236d895aaa826496488c80b2b516180c8206a75513710954d40d3d4b1690a5cb1ced0", 0x0, 0x48) (async) open(&(0x7f0000000040)='./bus\x00', 0x64842, 0x0) (async, rerun: 64) creat(&(0x7f0000000100)='./bus\x00', 0x0) (async, rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x5}, 0x3}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) (async, rerun: 32) pwrite64(r2, &(0x7f0000000140)='2', 0x1, 0x8080c61) (async, rerun: 32) r5 = memfd_create(&(0x7f0000001d00)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81\x01\x00\x00\x00\xae\x05\x00\x00\x00\x00\x00\x00\x00_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd93\xf0y\xd6\xb0\xf2\x9f\xa7\xcf\xad\x86\\\xec\xec\xd6\x9d\bT\xcd\xa2\xea%\xc0\xe9\x9d,K\x97\xe1m|g', 0xd) r6 = fcntl$dupfd(r5, 0x0, r5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x12, r6, 0x0) r7 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r7, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) (async, rerun: 64) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) (rerun: 64) [ 86.234332][ T45] Bluetooth: hci0: command tx timeout [ 86.346601][ T5365] loop0: detected capacity change from 0 to 64 [ 86.386789][ T5365] ======================================================= [ 86.386789][ T5365] WARNING: The mand mount option has been deprecated and [ 86.386789][ T5365] and is ignored by this kernel. Remove the mand [ 86.386789][ T5365] option from the mount to silence this warning. [ 86.386789][ T5365] ======================================================= [ 86.488723][ T5365] [ 86.489942][ T5365] ============================================ [ 86.492783][ T5365] WARNING: possible recursive locking detected [ 86.495532][ T5365] syzkaller #0 Not tainted [ 86.497447][ T5365] -------------------------------------------- [ 86.500392][ T5365] syz.0.0/5365 is trying to acquire lock: [ 86.503358][ T5365] ffff888035b180f8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xda/0x1230 [ 86.509090][ T5365] [ 86.509090][ T5365] but task is already holding lock: [ 86.512329][ T5365] ffff888035b18778 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xda/0x1230 [ 86.517657][ T5365] [ 86.517657][ T5365] other info that might help us debug this: [ 86.521380][ T5365] Possible unsafe locking scenario: [ 86.521380][ T5365] [ 86.524817][ T5365] CPU0 [ 86.526745][ T5365] ---- [ 86.528682][ T5365] lock(&HFS_I(tree->inode)->extents_lock); [ 86.531450][ T5365] lock(&HFS_I(tree->inode)->extents_lock); [ 86.534068][ T5365] [ 86.534068][ T5365] *** DEADLOCK *** [ 86.534068][ T5365] [ 86.537668][ T5365] May be due to missing lock nesting notation [ 86.537668][ T5365] [ 86.541127][ T5365] 5 locks held by syz.0.0/5365: [ 86.543290][ T5365] #0: ffff88803ddac428 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 86.547934][ T5365] #1: ffff888035b18fa0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0x8da/0x3830 [ 86.553378][ T5365] #2: ffff8880362b40b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x184/0x200 [ 86.557881][ T5365] #3: ffff888035b18778 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xda/0x1230 [ 86.562444][ T5365] #4: ffff8880362b20b0 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x184/0x200 [ 86.566810][ T5365] [ 86.566810][ T5365] stack backtrace: [ 86.569566][ T5365] CPU: 0 UID: 0 PID: 5365 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.569585][ T5365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.569594][ T5365] Call Trace: [ 86.569602][ T5365] [ 86.569608][ T5365] dump_stack_lvl+0x189/0x250 [ 86.569637][ T5365] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.569651][ T5365] ? __pfx__printk+0x10/0x10 [ 86.569668][ T5365] ? print_lock_name+0xde/0x100 [ 86.569684][ T5365] print_deadlock_bug+0x28b/0x2a0 [ 86.569697][ T5365] validate_chain+0x1a3f/0x2140 [ 86.569708][ T5365] ? rcu_is_watching+0x15/0xb0 [ 86.569721][ T5365] ? rcu_is_watching+0x15/0xb0 [ 86.569731][ T5365] ? lock_release+0x4b/0x3e0 [ 86.569747][ T5365] ? lock_release+0x4b/0x3e0 [ 86.569762][ T5365] ? look_up_lock_class+0x74/0x170 [ 86.569825][ T5365] ? register_lock_class+0x51/0x320 [ 86.569842][ T5365] __lock_acquire+0xab9/0xd20 [ 86.569859][ T5365] ? hfs_extend_file+0xda/0x1230 [ 86.569872][ T5365] lock_acquire+0x120/0x360 [ 86.569888][ T5365] ? hfs_extend_file+0xda/0x1230 [ 86.569905][ T5365] __mutex_lock+0x187/0x1350 [ 86.569921][ T5365] ? hfs_extend_file+0xda/0x1230 [ 86.569937][ T5365] ? lockdep_unlock+0x89/0x120 [ 86.569951][ T5365] ? hfs_extend_file+0xda/0x1230 [ 86.569965][ T5365] ? __pfx___mutex_lock+0x10/0x10 [ 86.569984][ T5365] hfs_extend_file+0xda/0x1230 [ 86.570001][ T5365] ? __pfx_hfs_extend_file+0x10/0x10 [ 86.570015][ T5365] ? __pfx___mutex_trylock_common+0x10/0x10 [ 86.570026][ T5365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.570039][ T5365] ? rcu_is_watching+0x15/0xb0 [ 86.570050][ T5365] ? trace_contention_end+0x39/0x120 [ 86.570061][ T5365] ? __mutex_lock+0x335/0x1350 [ 86.570076][ T5365] ? hfs_brec_find+0x18e/0x500 [ 86.570089][ T5365] hfs_bmap_reserve+0x107/0x430 [ 86.570105][ T5365] __hfs_ext_write_extent+0x1fa/0x470 [ 86.570120][ T5365] __hfs_ext_cache_extent+0x6b/0x9b0 [ 86.570135][ T5365] ? hfs_find_init+0x184/0x200 [ 86.570145][ T5365] hfs_extend_file+0x316/0x1230 [ 86.570162][ T5365] ? __pfx_hfs_extend_file+0x10/0x10 [ 86.570175][ T5365] ? __mutex_lock+0x335/0x1350 [ 86.570194][ T5365] ? __pfx___mutex_lock+0x10/0x10 [ 86.570210][ T5365] hfs_bmap_reserve+0x107/0x430 [ 86.570226][ T5365] hfs_cat_create+0x1b3/0x640 [ 86.570240][ T5365] ? do_raw_spin_lock+0x121/0x290 [ 86.570253][ T5365] ? __pfx_hfs_cat_create+0x10/0x10 [ 86.570270][ T5365] ? _raw_spin_unlock+0x28/0x50 [ 86.570283][ T5365] ? hfs_new_inode+0x7c9/0xba0 [ 86.570299][ T5365] hfs_create+0x66/0xe0 [ 86.570312][ T5365] ? __pfx_hfs_create+0x10/0x10 [ 86.570325][ T5365] path_openat+0x14f1/0x3830 [ 86.570337][ T5365] ? arch_stack_walk+0xfc/0x150 [ 86.570358][ T5365] ? __pfx_path_openat+0x10/0x10 [ 86.570368][ T5365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.570383][ T5365] do_filp_open+0x1fa/0x410 [ 86.570393][ T5365] ? __lock_acquire+0xab9/0xd20 [ 86.570409][ T5365] ? __pfx_do_filp_open+0x10/0x10 [ 86.570425][ T5365] ? _raw_spin_unlock+0x28/0x50 [ 86.570437][ T5365] ? alloc_fd+0x64c/0x6c0 [ 86.570453][ T5365] do_sys_openat2+0x121/0x1c0 [ 86.570472][ T5365] ? __pfx_do_sys_openat2+0x10/0x10 [ 86.570489][ T5365] ? rcu_is_watching+0x15/0xb0 [ 86.570501][ T5365] __x64_sys_creat+0x8f/0xc0 [ 86.570512][ T5365] do_syscall_64+0xfa/0x3b0 [ 86.570527][ T5365] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.570541][ T5365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.570552][ T5365] ? clear_bhb_loop+0x60/0xb0 [ 86.570565][ T5365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.570576][ T5365] RIP: 0033:0x7fdbb618ebe9 [ 86.570589][ T5365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.570598][ T5365] RSP: 002b:00007fdbb7071038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 86.570620][ T5365] RAX: ffffffffffffffda RBX: 00007fdbb63b6090 RCX: 00007fdbb618ebe9 [ 86.570628][ T5365] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100 [ 86.570635][ T5365] RBP: 00007fdbb6211e19 R08: 0000000000000000 R09: 0000000000000000 [ 86.570641][ T5365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.570648][ T5365] R13: 00007fdbb63b6128 R14: 00007fdbb63b6090 R15: 00007ffe02296cc8 [ 86.570660][ T5365]