program: syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x30000c8, &(0x7f0000000100)=ANY=[], 0x11, 0x2e6, &(0x7f0000000a80)="$eJzs3b9u02oYx/Hf66RNelr1uKc9QmIsVIIFQVkQSxDKxBUwIaAJUkVUBBTxZyqICSHY2Ri4BS6CBcQNwMTEBZTJ6H1tx0n8J25JY6J+P1Ir2/FjP2/873kqVRaAY+tq+9uHiz/sj5FqqkmvLkuepKZUl/S/TjQf7exu7/a6naIN1VyE/TEKI01qna2dblaojXMREd/O1bU0uCy0eLhBIlcQBFe+V50EKueu/gye1NB8Mt+cYk5lPD9k3N6E85g1Zl/7eqLlqvMAAFQrev57YSWvpah+9zxpI3rsu/rgb3v+H1AjntivNo8pCAo/HXj+uy4rMPb4/us+Svo918LZz724Syyz57mReVc+eiMFphnXVbpcvIU7273uua17vY6nF2pFBlZbc7874akbG8o23YeuZywrUGLsJruidP2qN2fHsBnm/1jSUP6rh9xjStkr03wyX8wN4+udOv36rx4Ye5jckfJHjpRn57rn87foRunbUSr6ulutlje0yorbyUkNthLjRtnM7kgUn1ErGv4DgcugKE8X9d9IVHh0LoyJWs2M2ozncqLWhqLsaPpnc/7+jpp5Y66bdf3UR7UH6n/P5rehwiszuWrMRnjCuW88HM989u7qbpt+6vxMXy79b7GRl/qv0XvatfdB8W0OeV7rti5p+eHTZ3drvV73gZ24lTFxf6m/ZO6llLnOwSbswf+D8IwN7iVLGgqc1MrxQ2lSOy0zcXaiG7T3j7Er26tsegM8rhPtz0d1Ii1Ep2n1I63w3oSpSQ561ZmgIrbuMmH/l/Qr9bDYs7/8zDo9t90YLoajLQa2xu53cElsEFbkkv4p6ODSFvM7uHTPleoZXc916ox0uvwe/SjPWWYGCvi2vuomf/8HAAAAAAAAAAAAAAAAAACYNdP4d4KqxwgAAAAAAAAAAAAAAAAAAAAAwKzrv/9X8ft/Ve79v6PvXZnk+3/f7ij7/b+xnHfNADiQ3wEAAP//NVZ57Q==") prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) r1 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) (async) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) read$hiddev(r2, &(0x7f0000000400)=""/127, 0x7f) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) write$cgroup_int(r2, &(0x7f0000000540), 0xfffffdd8) r3 = syz_pidfd_open(r1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0xff06, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r0, 0x40044103, &(0x7f00000003c0)=0x100) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x0, 0x3, 0x80, "5df2bf014db168a75684d990dc64e738c4947afa7b704340f5ff31e0fe615b44", 0xb5315258}) write(r4, &(0x7f0000000000)='3', 0x4e) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000200)=@v1={0x1000000, [{0x6016, 0x1}]}, 0xc, 0x2) (async) futex(0x0, 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) (async) ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f00000004c0)={&(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x5}) [ 101.667744][ T4645] Bluetooth: hci0: command tx timeout [ 101.759549][ T5323] loop0: detected capacity change from 0 to 64 [ 101.825757][ T5323] ======================================================= [ 101.825757][ T5323] WARNING: The mand mount option has been deprecated and [ 101.825757][ T5323] and is ignored by this kernel. Remove the mand [ 101.825757][ T5323] option from the mount to silence this warning. [ 101.825757][ T5323] ======================================================= [ 103.881723][ T4645] Bluetooth: hci0: command tx timeout [ 104.109100][ T5323] syz.0.0: attempt to access beyond end of device [ 104.109100][ T5323] loop0: rw=8388608, sector=2339, nr_sectors = 1 limit=64 [ 104.109155][ T5323] Buffer I/O error on dev loop0, logical block 2339, async page read [ 104.109183][ T5323] syz.0.0: attempt to access beyond end of device [ 104.109183][ T5323] loop0: rw=8388608, sector=2340, nr_sectors = 1 limit=64 [ 104.109197][ T5323] Buffer I/O error on dev loop0, logical block 2340, async page read [ 104.109210][ T5323] syz.0.0: attempt to access beyond end of device [ 104.109210][ T5323] loop0: rw=8388608, sector=2341, nr_sectors = 1 limit=64 [ 104.109223][ T5323] Buffer I/O error on dev loop0, logical block 2341, async page read [ 104.109334][ T5323] syz.0.0: attempt to access beyond end of device [ 104.109334][ T5323] loop0: rw=8388608, sector=2342, nr_sectors = 1 limit=64 [ 104.109347][ T5323] Buffer I/O error on dev loop0, logical block 2342, async page read [ 104.110810][ T5323] syz.0.0: attempt to access beyond end of device [ 104.110810][ T5323] loop0: rw=8388608, sector=2339, nr_sectors = 1 limit=64 [ 104.110823][ T5323] Buffer I/O error on dev loop0, logical block 2339, async page read [ 104.110830][ T5323] syz.0.0: attempt to access beyond end of device [ 104.110830][ T5323] loop0: rw=8388608, sector=2340, nr_sectors = 1 limit=64 [ 104.110838][ T5323] Buffer I/O error on dev loop0, logical block 2340, async page read [ 104.110845][ T5323] syz.0.0: attempt to access beyond end of device [ 104.110845][ T5323] loop0: rw=8388608, sector=2341, nr_sectors = 1 limit=64 [ 104.110853][ T5323] Buffer I/O error on dev loop0, logical block 2341, async page read [ 104.110860][ T5323] syz.0.0: attempt to access beyond end of device [ 104.110860][ T5323] loop0: rw=8388608, sector=2342, nr_sectors = 1 limit=64 [ 104.110925][ T5323] Buffer I/O error on dev loop0, logical block 2342, async page read [ 104.111197][ T5323] [ 104.185690][ T5323] ============================================ [ 104.188478][ T5323] WARNING: possible recursive locking detected [ 104.191190][ T5323] syzkaller #0 Not tainted [ 104.193362][ T5323] -------------------------------------------- [ 104.196303][ T5323] syz.0.0/5323 is trying to acquire lock: [ 104.198852][ T5323] ffff88801d1800a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.203550][ T5323] [ 104.203550][ T5323] but task is already holding lock: [ 104.206638][ T5323] ffff888012a83a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.211150][ T5323] [ 104.211150][ T5323] other info that might help us debug this: [ 104.214724][ T5323] Possible unsafe locking scenario: [ 104.214724][ T5323] [ 104.218306][ T5323] CPU0 [ 104.220171][ T5323] ---- [ 104.221969][ T5323] lock(&HFS_I(tree->inode)->extents_lock); [ 104.224955][ T5323] lock(&HFS_I(tree->inode)->extents_lock); [ 104.227389][ T5323] [ 104.227389][ T5323] *** DEADLOCK *** [ 104.227389][ T5323] [ 104.230832][ T5323] May be due to missing lock nesting notation [ 104.230832][ T5323] [ 104.234557][ T5323] locks held by syz.0.0/5323: 5, last CPU#0: [ 104.237344][ T5323] #0: ffff8880125e2460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 104.241707][ T5323] #1: ffff888012a83600 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 104.246185][ T5323] #2: ffff8880125fe0a8 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.250741][ T5323] #3: ffff888012a83a20 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.255735][ T5323] #4: ffff8880125e00a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.260367][ T5323] [ 104.260367][ T5323] stack backtrace: [ 104.263489][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.267178][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.271600][ T5323] Call Trace: [ 104.273022][ T5323] [ 104.274198][ T5323] dump_stack_lvl+0xe8/0x150 [ 104.276066][ T5323] print_deadlock_bug+0x27a/0x290 [ 104.278129][ T5323] __lock_acquire+0x25db/0x2de0 [ 104.280023][ T5323] ? rcu_is_watching+0x16/0xb0 [ 104.281769][ T5323] ? lock_release+0x4b/0x3c0 [ 104.283549][ T5323] ? lock_release+0x4b/0x3c0 [ 104.285290][ T5323] lock_acquire+0x115/0x350 [ 104.287049][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 104.289110][ T5323] __mutex_lock+0x19d/0x1550 [ 104.291056][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 104.293140][ T5323] ? stack_trace_save+0xa9/0x100 [ 104.295543][ T5323] ? __pfx_stack_trace_save+0x10/0x10 [ 104.297973][ T5323] ? hfs_extend_file+0xf9/0x1680 [ 104.300204][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 104.302479][ T5323] ? add_lock_to_list+0xc7/0x100 [ 104.304675][ T5323] ? lockdep_unlock+0x5c/0xd0 [ 104.306768][ T5323] ? __lock_acquire+0x1511/0x2de0 [ 104.308982][ T5323] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.311406][ T5323] ? stack_depot_save_flags+0x404/0x7f0 [ 104.313603][ T5323] hfs_extend_file+0xf9/0x1680 [ 104.315484][ T5323] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.317775][ T5323] ? __mutex_trylock_common+0x15f/0x270 [ 104.320361][ T5323] ? __pfx___mutex_trylock_common+0x10/0x10 [ 104.322867][ T5323] ? rcu_is_watching+0x16/0xb0 [ 104.324832][ T5323] ? trace_contention_end+0x3d/0x140 [ 104.326977][ T5323] ? __asan_memset+0x22/0x50 [ 104.328871][ T5323] ? hfs_brec_find+0x19a/0x510 [ 104.331060][ T5323] hfs_bmap_reserve+0x108/0x430 [ 104.333235][ T5323] __hfs_ext_write_extent+0x1fc/0x470 [ 104.335661][ T5323] __hfs_ext_cache_extent+0x6e/0x9b0 [ 104.338090][ T5323] ? hfs_find_init+0x18d/0x300 [ 104.340319][ T5323] hfs_extend_file+0x3ad/0x1680 [ 104.342544][ T5323] ? __pfx___mutex_trylock_common+0x10/0x10 [ 104.345209][ T5323] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.347557][ T5323] ? __mutex_lock+0x30b/0x1550 [ 104.349642][ T5323] ? hfs_find_init+0x18d/0x300 [ 104.351926][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 104.354591][ T5323] ? rcu_is_watching+0x16/0xb0 [ 104.357223][ T5323] ? trace_kmalloc+0x2a/0xf0 [ 104.359513][ T5323] hfs_bmap_reserve+0x108/0x430 [ 104.361749][ T5323] hfs_cat_create+0x23d/0x870 [ 104.363985][ T5323] ? __pfx_hfs_cat_create+0x10/0x10 [ 104.366443][ T5323] ? _raw_spin_unlock+0x28/0x50 [ 104.368875][ T5323] ? hfs_new_inode+0x8e8/0xc50 [ 104.371188][ T5323] hfs_mkdir+0x73/0xe0 [ 104.373072][ T5323] vfs_mkdir+0x40c/0x620 [ 104.375006][ T5323] filename_mkdirat+0x285/0x510 [ 104.377160][ T5323] ? __pfx_filename_mkdirat+0x10/0x10 [ 104.379395][ T5323] ? do_getname+0x151/0x250 [ 104.381582][ T5323] __se_sys_mkdirat+0x35/0x150 [ 104.384288][ T5323] do_syscall_64+0x166/0x520 [ 104.386516][ T5323] ? trace_irq_disable+0x3b/0x140 [ 104.388484][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.390902][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 104.392848][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.395246][ T5323] RIP: 0033:0x7f8e91d9e159 [ 104.397016][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.405006][ T5323] RSP: 002b:00007f8e92cd4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 104.408481][ T5323] RAX: ffffffffffffffda RBX: 00007f8e92025fa0 RCX: 00007f8e91d9e159 [ 104.411754][ T5323] RDX: 00000000000001ff RSI: 0000200000001500 RDI: ffffffffffffff9c [ 104.415233][ T5323] RBP: 00007f8e91e3503b R08: 0000000000000000 R09: 0000000000000000 [ 104.418654][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.421985][ T5323] R13: 00007f8e92026038 R14: 00007f8e92025fa0 R15: 00007fff908efba8 [ 104.425130][ T5323] [ 104.427045][ T5323] syz.0.0: attempt to access beyond end of device [ 104.427045][ T5323] loop0: rw=8388608, sector=2339, nr_sectors = 1 limit=64 [ 104.427059][ T5323] Buffer I/O error on dev loop0, logical block 2339, async page read [ 104.427066][ T5323] syz.0.0: attempt to access beyond end of device [ 104.427066][ T5323] loop0: rw=8388608, sector=2340, nr_sectors = 1 limit=64 [ 104.427074][ T5323] Buffer I/O error on dev loop0, logical block 2340, async page read